Ask most small business owners where their cash is, and they'll point to a bank statement. But for a growing share of companies, a meaningful chunk of "cash" never touches a traditional bank account at all. It sits inside a Stripe balance waiting to settle. It sits in a PEO's trust account, commingled with hundreds of other clients' payroll funds. It sits in an escrow account controlled by a title company or M&A paying agent. Until now, auditors mostly took management's word for it — a signed rep letter, maybe a basic bank confirmation if the intermediary happened to also be a bank.
That's changing. In July 2026, the AICPA's Auditing Standards Board issued Statement on Auditing Standards No. 150 (SAS 150), and its headline change is blunt: auditors will now be required to independently confirm cash and cash equivalents held by third parties, not just cash sitting in a traditional bank account. If your business gets a financial statement audit — because a lender requires it, an investor requires it, a bonding company requires it, or a grant funder requires it — this standard is going to change what your auditor asks you for.
What SAS 150 Actually Changes
SAS 150 updates the existing external confirmations standard (AU-C 505) to catch up with how businesses actually hold cash in 2026. The AICPA's own framing is that the update responds to "the increasingly widespread use of intermediaries in external confirmation procedures" — auditors have been treating a payment processor balance or a PEO trust account casually, when in substance it's exactly the kind of third-party-held asset that confirmation procedures exist to verify.
The standard's core provisions:
- Mandatory confirmation of cash held by third parties. Auditors must now perform external confirmation procedures on cash and cash equivalents held by intermediaries — payment processors, PEOs, escrow agents, and similar arrangements — unless specific conditions justify skipping it. This is the "most significant change" in the standard, according to the AICPA.
- A direct-access alternative. SAS 150 explicitly recognizes that an auditor directly accessing information maintained by a knowledgeable external source (think: a read-only auditor login to a payment processor's reporting dashboard) can satisfy the confirmation requirement, instead of requiring a formal mailed or emailed confirmation letter every time.
- Tighter rules on negative confirmations. The standard establishes new conditions that must be met before an auditor can rely on a negative confirmation request (where the third party is only asked to respond if they disagree with a stated balance) rather than a positive one requiring an affirmative reply.
Jennifer Burns, AICPA chief auditor, described the intent this way: the updates are meant to "strengthen that foundation in today's increasingly digital and intermediary-driven environment" — an acknowledgment that external confirmations, largely unchanged in concept since paper-and-mail audit practice, needed a refresh for how money actually moves now.
Effective Date: Don't Panic, But Don't Ignore It Either
SAS 150 is mandatory for audits of financial statements for periods ending on or after December 15, 2028, with early adoption permitted. That sounds far off, but two things make it worth acting on now rather than later:
- Early adoption is allowed, and some audit firms — especially ones that already got burned by a client whose "cash" turned out to be sitting somewhere murkier than expected — may start applying the spirit of this standard well before the mandatory date.
- The underlying risk it addresses doesn't wait for 2028. If a meaningful share of your reported cash sits with a payment processor, a PEO, or an escrow agent, that's a real audit-evidence gap today, standard or no standard. SAS 150 is really just formalizing what a careful auditor should already be probing.
Why This Exists: The Third-Party Cash Problem
Traditional bank confirmations work well because banks are regulated, have standardized confirmation formats (the interbank confirmation request, familiar to any auditor), and are legally distinct from the business being audited. Payment processors, PEOs, and escrow agents are a messier category:
- Payment processor balances (Stripe, PayPal, Square, and similar) represent funds owed to you that are held, at least temporarily, by the processor before settlement — and the processor's own books, not a bank statement, are the authoritative record of what you're owed.
- PEO trust accounts commingle payroll funds for potentially hundreds of client companies. Your specific share of that trust account isn't something a generic bank confirmation captures — you need the PEO itself to attest to your balance.
- Escrow and paying-agent arrangements (common in M&A deals, real estate closings, or contract holdbacks) hold cash subject to conditions that only the escrow agent can confirm — release triggers, remaining balances after distributions, and so on.
In each case, the entity attesting to "yes, this company's money is really here" isn't a bank — it's a business relationship the auditor previously had less standardized language for confirming. SAS 150 gives auditors a clearer mandate and clearer tools (including the direct-access option) to close that gap.
What This Means for Your Business
If your company is audited under AICPA standards (most private-company financial statement audits, as opposed to public-company audits under PCAOB standards) and any of the following apply, expect your next audit engagement letter or PBC ("provided by client") request list to look different:
- You process significant revenue through a payment processor and carry a meaningful balance awaiting settlement at period end.
- You use a PEO for payroll, benefits administration, or HR outsourcing, and the PEO holds funds in trust between your funding date and disbursement date.
- You have money in escrow — an acquisition holdback, an earnout reserve, a real estate transaction, a contract performance bond.
- You maintain a trust or custodial account with any third party that isn't a traditional depository bank.
Practically, prepare for your auditor to ask for:
- Direct confirmation authorization. You may need to authorize your payment processor, PEO, or escrow agent to respond directly to auditor confirmation requests, or to grant your auditor read-only access to a reporting portal.
- Reconciliations, not just balances. Auditors will likely want to see how your internal books tie to the third party's reported balance, not just accept a screenshot of a dashboard total.
- Documentation of any conditions or restrictions on the funds — an escrow release schedule, a PEO trust agreement, a payment processor's rolling reserve policy.
None of this should be alarming if your books are already clean. It's mostly a shift in how the auditor gets comfortable with a number you should already be tracking accurately internally.
The Real Lesson: Third-Party Cash Needs Its Own Ledger Line
The businesses that will sail through this change are the ones that already treat every third-party cash holding as its own distinct, reconciled account — not as an afterthought lumped into "cash and equivalents" on a summary balance sheet. If your Stripe balance, your PEO trust funds, and your escrow holdback are each tracked as separate accounts with their own running balance and their own reconciliation trail, producing a clean answer for an auditor (or for a lender, or for yourself) is trivial. If they're not, SAS 150 is a preview of the scramble you'll face at your next audit.
This is exactly the kind of discipline that plain-text, version-controlled accounting encourages by default. When every account — bank, payment processor, PEO trust, escrow — is its own explicit ledger account rather than a manual spreadsheet adjustment, reconciling what a third party says you're owed against what your books say becomes a simple diff, not a fire drill.
Keep Every Account Reconciled Before Your Auditor Asks
As audit standards catch up to how modern businesses actually hold cash, the businesses with the cleanest books — the ones where every payment processor balance, PEO trust account, and escrow holding is tracked as its own reconciled account — won't feel this change at all. Beancount.io gives you plain-text accounting that makes every dollar, wherever it's held, fully transparent and auditable, with a complete version-controlled history. Get started for free and see why developers and finance-savvy business owners are switching to a ledger they can actually trust.