Author: Jaclyn Veno, CPA
This article originally appeared in the Summer 2025 issue of the South Carolina CPA Report
On February 27, 2025, the AICPA’s Auditing Standards Board (ASB) issued the exposure draft “Proposed Statement on Auditing Standards (SAS): External Confirmations.” The draft proposes revisions to three key sections of GAAS: AU-C sections 330 (Performing Audit Procedures in Response to Assessed Risks), 500 (Audit Evidence), and 505 (External Confirmations). These updates aim to enhance audit quality in an efficient and effective manner, particularly for audits of nonissuers. The ASB accepted comments on the proposal through June 30, 2025. If adopted, the standard will be effective for audits of financial statements for periods ending no earlier than December 15, 2027, with early implementation permitted.
Why the ASB Is Proposing These Changes
In developing the proposal, the ASB considered changes made by other standard setters, especially the Public Company Accounting Oversight Board’s (PCAOB) adoption of a new standard in September 2023. That standard, AS 2310 (The Auditor’s Use of Confirmation), replaces the previous PCAOB confirmation standard and modernizes requirements to reflect current communication practices and risks. It became
effective for audits of fiscal years ending on or after June 15, 2025.
The ASB reviewed AS 2310 and compared it to current GAAS to determine whether similar changes would be appropriate. The comparison focused on identifying incremental requirements or guidance in AS 2310, evaluating whether those additions would enhance audit quality for nonissuer audits, and assessing whether they warranted changes to GAAS.
Key Amendments to AU-C Section 330
One of the most notable changes is a new requirement to perform external confirmation procedures for cash and cash equivalents held by third parties. These procedures, which include direct access to information from a confirming party, must be used when responding to risks of material misstatement for certain assertions involving significant accounts or disclosures. The ASB believes confirming cash aligns with stakeholder expectations and reflects common audit practice.
However, exceptions apply. If confirmation procedures are prohibited by law or regulation, or if the auditor determines that the confirming party consistently will not respond, the requirement does not apply. Importantly, the proposed SAS does not mandate confirmation of all cash accounts—only those deemed significant based on a risk-based approach.
Additionally, proposed revisions expand documentation requirements. Auditors would be required to document their rationale for not using external confirmation procedures for both accounts receivable and cash—regardless of materiality—when exceptions apply. The amendments also emphasize that confirmation is only required for significant classes of transactions, balances, or disclosures—not across the board.
The revised guidance includes more examples to help auditors understand when external confirmations may provide audit evidence in response to identified risks at the assertion level.
Proposed Revisions to AU-C Section 505
The exposure draft adds definitions to provide clarity throughout the standard. Key terms now defined include:
- Confirmation request
- Confirming party
- External confirmation procedures
- Intermediary
- While the PCAOB’s standard does not define “intermediary,” the ASB has proposed a definition to distinguish parties that facilitate communication between the auditor and confirming party but are not themselves sources of evidence.
The term external confirmation has been revised to external confirmation response, now defined as information obtained directly from a confirming party, whether on paper, electronically, or through direct system access. The ASB retained existing language clarifying that direct access to information can qualify as an external confirmation procedure—something not explicitly acknowledged in the PCAOB’s version.
The proposal also includes a new requirement related to intermediaries. When an intermediary is used to facilitate confirmations, auditors would be required to evaluate the implications for reliability. The ASB offers this as application material—not a mandate—to align with GAAS’s principles-based approach, unlike the PCAOB’s rules-based requirements in AS 2310.
Clarifications are also made about direct access to information: if the access is provided by management (e.g., logins or shared credentials), it is not considered an external confirmation response. However, such access may still qualify as alternative audit evidence if it meets relevance and reliability criteria.
The revised guidance also clarifies that certain government regulatory bodies may be appropriate confirming parties, particularly in governmental audits. In situations where no reliable confirming party can be identified, auditors are reminded to reassess the risk of material misstatement and adjust their audit procedures accordingly.
To help auditors apply these requirements, additional application guidance has been proposed. For example, the auditor’s understanding of specific arrangements or transactions may assist in determining what information to confirm. Updated paragraphs also address how concerns about a confirming party’s objectivity or willingness to respond may raise doubts about the reliability of a confirmation response.
Updates to AU-C Section 500
The amendments to AU-C section 500 provide new application guidance explaining that confirmation requests are not limited to account balances or classes of transactions. For instance, auditors may seek confirmations for disclosures, estimates, or contractual arrangements when appropriate. This material is not a new requirement but is intended to encourage thoughtful use of confirmation procedures in light of the auditor’s risk assessment.
Final Thoughts
The ASB’s proposed changes to external confirmation procedures represent a significant step toward aligning GAAS with modern audit practices and international standards. By enhancing requirements around confirming cash, defining critical terms, expanding documentation, and offering practical guidance, the proposed amendments aim to promote consistency, clarity, and audit quality.
