Bank confirmations have run the same way for decades: a letter or portal request, routed through the client or a bank's operations queue, chased for days, and returned as a static PDF. Two standards issued in the last 18 months, PCAOB AS 2310 and AICPA SAS No. 150, make it clear that that process is no longer the gold standard for audit evidence. This article looks at what actually changed, why it matters to your engagements now, and where a connected confirmation platform fits into meeting it.
What changed, in plain terms
PCAOB AS 2310, The Auditor's Use of Confirmation, took effect for audits of fiscal year sending on or after June 15, 2025 and replaced a confirmation standard that had barely changed since 2003. The consequential shift: AS 2310 recognizes direct access to information maintained by a knowledgeable external source, with the auditor in control of the process throughout, as valid confirmation evidence in its own right. Not a workaround but the standard itself.
In May 2026, the AICPA's Auditing Standards Board extended the same principle to private company audits with SAS No. 150, External Confirmations (published July 2026, effective for periods ending on or after December 15, 2028). Two changes matter most for banking evidence: a new requirement to perform external confirmation procedures for cash and cash equivalents held by third parties (unless impracticable or risk is already low and addressed elsewhere), and formal recognition (mirroring AS 2310) that direct access to a knowledgeable external source's own records can satisfy the confirmation requirement.
Neither standard mandates specific technology. What they do is remove the ambiguity: evidence obtained directly from the confirming party's own systems, under the auditor's control, is now explicitly the model both regulators point toward.
Why this isn't just a compliance footnote
● Quality of evidence. A confirmation that passes through a client's hands, or relies on shared portal credentials, introduces a point where data could be altered, delayed, or intercepted. Evidence sourced directly from the bank's own systems closes that gap.
● Audit efficiency. Every week spent waiting on a bank response is a week the engagement can't move forward. Teams already running confirmations this way report completing them up to 80% faster, an estimated 20 hours per audit redirected from chasing evidence to the judgment work that actually makes up an audit.
● Regulatory alignment. Firms adopting a source-verified process now are aligning with where both standards are heading rather than retrofitting after SAS No. 150's 2028 deadline. A direct bank connection, once built, doesn't need rebuilding for the next engagement. Instead it compounds in value.
Where a connected platform fits
Circit already facilitates bank, AR/AP, legal, and custodian confirmations on one connected platform: every confirmation type on a US engagement sent, tracked, and evidenced from the same place, to the same standard.
The centrepiece is direct API connectivity: live access to bank and transactional data straight from source, rather than a static PDF relayed through a client-held document or a shared login. It's the first time this has been available in the industry, and it's the specific evidential model both AS 2310 and SAS No. 150 describe: evidence obtained directly from the confirming party's own systems, under the auditor's control throughout.
Every counterparty on the Circit network (banks, law firms, fund administrators, custodians) is verified before a confirmation ever reaches them. That removes the callback: auditors no longer need a separate step to establish that a response came from who it says it came from, because the network has already established it.
Circit's network currently spans over 6,500 connections, with 53.8 million transactions independently verified in 2026 and is used across more than 100,000 audit engagements to date. That combination solves what firms need today: faster, verified, auditor-controlled confirmations across every type, while opening a path to something beyond a confirmation: bank and transactional data live from the first day of fieldwork, rather than a static response filed once and revisited at year-end.
What this means for your firm
Neither standard forces a specific vendor or system. What they do is raise the bar for what counts as strong confirmation evidence, and formally recognize a model most current bank confirmation processes weren't built around. That bar has now moved for public and private company audits alike.
SAS No. 150 isn't mandatory until periods ending on or after December 15, 2028, but the direct-access model it describes is available today: AS 2310 already recognizes it, and the AICPA permits early adoption of SAS No. 150 ahead of that date. The firms adopting it now are building the data foundation their AI tooling will need next, on a runway they set themselves.
One platform. Every confirmation. Trusted intelligence.
Learn more about Circit Confirm here.
