Modernizing Audit Evidence: Analyzing the AICPA’s New Standards for External Confirmations
In the evolving landscape of global finance, the integrity of audit evidence remains the bedrock of investor confidence. As digital transformation reshapes how businesses manage cash, transact with intermediaries, and store financial data, the auditing profession must evolve in tandem. The American Institute of Certified Public Accountants (AICPA) recently took a significant step in this modernization process with the publication of Statement on Auditing Standards (SAS) No. 150, External Confirmations.
This new standard represents a comprehensive update to existing audit protocols, specifically designed to address the complexities of a modern, intermediary-driven, and increasingly digitized financial environment. By refining the requirements for obtaining audit evidence, the AICPA aims to ensure that the audit profession maintains high standards of reliability and skepticism.
Main Facts: What SAS No. 150 Changes
At its core, SAS No. 150 serves as a bridge between traditional auditing practices and modern technological realities. The most striking change introduced by the standard is the mandate regarding cash and cash equivalents. Under the new guidelines, auditors are generally required to perform external confirmation procedures for cash and cash equivalents held by third parties. While this has long been a best practice, the standard formalizes the requirement, making it a professional obligation unless specific, narrow conditions are met.
Furthermore, the standard explicitly acknowledges the role of technology in evidence gathering. It recognizes that "direct access" to information maintained by a knowledgeable, independent third party can, in certain circumstances, satisfy the requirements of an external confirmation. This acknowledges the reality of cloud-based banking portals and secure data-sharing platforms, which allow auditors to verify balances without the traditional "paper-in-the-mail" approach.
Additionally, SAS No. 150 provides rigorous new criteria for the use of "negative confirmation requests"—a process where an auditor asks a third party to respond only if they disagree with the information provided. The standard clarifies the conditions under which these requests are appropriate, thereby reducing the risk of audit failures resulting from non-responses.
Chronology: From Proposal to Implementation
The journey toward SAS No. 150 reflects the deliberate and thorough nature of the AICPA’s standard-setting process.
The Development Phase
The Auditing Standards Board (ASB) began evaluating the existing guidance on external confirmations in light of the rapid shift toward digital banking and the emergence of third-party service providers (intermediaries). Recognizing that SAS No. 67, The Confirmation Process, was increasingly misaligned with current market practices, the ASB initiated a multi-year project to draft a successor.
The Vote and Initial Announcement
In May 2024, the ASB officially voted to approve the standards update. This milestone was followed by a public statement from the AICPA, signaling to the profession that a major shift was on the horizon. During this period, the AICPA emphasized that the update was not merely a regulatory exercise but a necessary reinforcement of audit quality.
Official Publication
The finalized standard was formally published in late 2024. Its release marks the beginning of an "implementation runway," providing practitioners with several years to update their internal audit methodologies, adjust their firm-wide training programs, and ensure that their technology stacks are capable of facilitating the new confirmation procedures.
The Effective Date
SAS No. 150 is effective for audits of financial statements for periods ending on or after December 15, 2028. However, recognizing the varying levels of digital maturity across accounting firms, the AICPA has explicitly permitted early adoption. This flexibility allows forward-thinking firms to transition their processes well ahead of the deadline.
Supporting Data: Why Change Was Necessary
The transition to SAS No. 150 is backed by data-driven observations regarding the audit profession’s challenges in recent years.
The Rise of Intermediaries
Modern business transactions rarely occur directly between two parties. The rise of payment processors, digital wallets, and complex escrow services has introduced "intermediaries" into the confirmation loop. Historical auditing standards were often unclear on how to treat confirmations involving these third parties. By addressing the "intermediary" issue, SAS No. 150 mitigates the risk that auditors might mistakenly rely on non-independent or improperly verified sources of information.
The Digital Shift
The shift away from physical mail and toward digital confirmation platforms (such as Confirmation.com or proprietary bank portals) has changed the definition of "reliable evidence." Data suggests that digital confirmations are faster and less prone to manual error than paper-based confirmations. SAS No. 150 embraces this reality, providing a framework for auditors to use "direct access" to secure portals as a valid substitute for traditional formal requests, provided the auditor can verify the authenticity of the data source.
Addressing the "Negative Confirmation" Gap
Research has shown that auditors sometimes relied on negative confirmation requests in situations where they provided insufficient evidence, specifically when the recipient was unlikely to read or verify the request. The new standard tightens these requirements, ensuring that negative requests are only utilized when the risk of material misstatement is low and the recipient is likely to be attentive.
Official Responses: Perspectives from Leadership
The industry response to the publication of SAS No. 150 has been largely positive, with leadership emphasizing that these changes are designed to protect the reputation of the audit profession.
Jennifer Burns, CPA, the AICPA’s chief auditor, highlighted the necessity of the update during the May 2024 announcement. She remarked: "External confirmations remain a critical source of reliable audit evidence, and these updates are designed to strengthen that foundation in today’s increasingly digital and intermediary-driven environment."
Burns and other members of the ASB have underscored that the standard is not meant to add "red tape," but rather to provide a clearer map for auditors navigating complex financial environments. By providing a clear framework for when direct access to data is sufficient, the AICPA is effectively reducing the friction associated with audit procedures while simultaneously raising the bar for evidence quality.
Implications for Audit Firms and Practitioners
The transition to SAS No. 150 will require significant preparation for audit firms of all sizes. The implications are far-reaching, touching on methodology, technology, and staff education.
Methodological Overhaul
Firms will need to revise their audit programs and internal manuals. Standard audit procedures for cash existence will no longer be "one-size-fits-all." Auditors must now document the specific conditions that allow them to forgo traditional external confirmations in favor of direct access, or vice versa. This requires a more nuanced approach to risk assessment.
Investment in Technology
To comply with the spirit of the new standard, firms may need to invest in secure, audit-ready platforms. While the standard does not mandate a specific software, it does mandate a level of scrutiny that is difficult to achieve manually. Firms that rely on legacy systems for external confirmations will likely find themselves at a disadvantage compared to firms that have integrated with real-time financial reporting APIs.
Training and Competency
Staff auditors will need to be trained not only on the new standard’s text but also on the intent behind the changes. Understanding how to evaluate the reliability of a third-party intermediary—and knowing when a confirmation is sufficient—requires a higher level of professional judgment. Firms should begin planning internal seminars and professional development tracks to ensure their teams are ready for the 2028 implementation.
Impact on Client Relationships
The new standard may also change how auditors interact with their clients. For example, auditors may now require clients to provide specific types of access to banking portals or to utilize designated confirmation services. Firms will need to communicate these requirements early in the engagement process to ensure that clients are prepared to facilitate the necessary evidence gathering.
Conclusion: A Proactive Stance on Audit Quality
SAS No. 150 is more than just a regulatory update; it is a declaration of the auditing profession’s commitment to staying relevant in an age of rapid technological change. By codifying the requirements for cash confirmations and formalizing the use of digital data access, the AICPA is ensuring that the audit remains a trusted indicator of financial accuracy.
While the December 2028 deadline may seem distant, the complexity of the changes suggests that firms should treat this as a multi-year project. By proactively updating methodologies and embracing the digital tools now recognized under the standard, practitioners can not only ensure compliance but also improve the efficiency and effectiveness of their audit engagements. As the financial world continues to innovate, the audit profession is showing that it, too, is capable of evolving to meet the challenges of the future.
To comment on this article or to suggest an idea for another article, contact Bryan Strickland at [email protected].
