What is PCAOB AS 2310, The Auditor’s Use of Confirmation?

AS 2310 is the PCAOB standard that replaced the former confirmation standard, AS 2310, The Confirmation Process, and retitled it The Auditor’s Use of Confirmation. It establishes requirements for obtaining audit evidence from a knowledgeable external source through confirmation, and adds specific requirements for cash held by third parties, accounts receivable, and the terms of certain transactions. It is effective for audits of financial statements for fiscal years ending on or after 15 June 2025.

What changed for cash and accounts receivable?

Under paragraph .24, for cash held by third parties and for accounts receivable the auditor should perform confirmation procedures, or otherwise obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source. For accounts receivable, if that is not feasible based on the auditor’s experience, the auditor obtains external information indirectly through other substantive procedures, using items the company received from external sources such as subsequent cash receipts, shipping documents, and signed contracts. Where a significant risk in cash or receivables is not addressed by confirmation or direct access, the auditor communicates that to the audit committee.

How does the standard treat electronic confirmation intermediaries?

Paragraph .17 and Appendix B allow an intermediary to facilitate direct electronic transmission of confirmation requests and responses, but require the auditor to evaluate the implications for reliability. The auditor obtains an understanding of the intermediary’s controls over interception and alteration, determines whether those controls are designed and operating effectively, and assesses whether the company can override them. If the controls are not effective and the risk cannot be addressed, or if the company can override the controls, the auditor does not use the intermediary.

Why is AS 2310 a systems and data problem for finance teams?

Both roads to evidence run on data a finance team owns. A confirmation only works if the counterparty master data is accurate and the routing sits outside the units being confirmed, so the company cannot override it. Direct access relies on bank connectivity and, for receivables, on preserved external documents kept in the form they arrived. Holding a confirmation readiness record per significant account, the external source, the route, the counterparty data, the intermediary controls, and a completeness query over unrouted accounts, turns audit readiness into a byproduct of clean data rather than a year end scramble.

When does AS 2310 take effect?

The standard is effective for audits of financial statements for fiscal years ending on or after 15 June 2025. It was adopted by the PCAOB on 28 September 2023 and approved by the SEC on 1 December 2023. Calendar year 2025 audits, performed through 2026, are the first conducted under the new standard.

Digital

Finance

Team

Why Cash And Receivables What The Standard Asks Confirmation As DataPublished September 1, 2026

Your cash and receivables can prove themselves from the outside.

The PCAOB’s confirmation standard now asks the auditor to get cash and receivables evidence from a knowledgeable external source, by confirming it or by reading the source directly. Both roads run on data your systems already touch. The teams that own their bank connectivity, their counterparty records, and the outside documents behind each receivable hand the auditor a clean trail and close the year faster.

Article signals

Audience: Controllers, treasury and order to cash leads, internal audit and SOX teams, and the finance systems people who own bank connectivity, the accounts receivable subledger, and the counterparty master data an external auditor leans on at year end
Trigger: PCAOB AS 2310, The Auditor’s Use of Confirmation, replaced the former confirmation standard and is effective for audits of financial statements for fiscal years ending on or after 15 June 2025. Calendar year 2025 audits, in progress through 2026, are the first performed under it
Published: September 1, 2026
Scope: Any company audited under PCAOB standards where cash held by third parties and accounts receivable are significant accounts, and any arrangement where confirmation is used for debt, guarantees, or the terms of a complex or unusual transaction
The shift: For cash and accounts receivable, the auditor should either perform confirmation procedures or otherwise obtain relevant and reliable evidence by directly accessing information maintained by a knowledgeable external source. That puts more weight on the outside record your systems already touch, and it makes the reliability of that record a finance responsibility, not only an audit one
The artefact to build: A confirmation readiness record per significant account: the knowledgeable external source behind it, the route to that source (a controlled confirmation, direct portal access, or preserved external documents), the counterparty master data and its owner, the intermediary and who controls the routing, and a completeness query over any cash or receivables population with no recorded external route

Cash and receivables get their own rule for a reason.

Most of an audit tests numbers against the company’s own records. Confirmation is different. It reaches outside the company to a party that keeps its own version of the same fact, a bank that knows the cash balance, a customer that knows what it owes, a lender that knows the terms of a loan. That outside view is what makes confirmation valuable, and it is why the PCAOB rebuilt the standard around it. AS 2310, The Auditor’s Use of Confirmation, replaced the older confirmation standard and is effective for audits of fiscal years ending on or after 15 June 2025, so the calendar year 2025 statements being audited right now are the first under it.

The heart of the standard is a single objective: obtain relevant and reliable audit evidence from a knowledgeable external source about a relevant assertion of a significant account. For two accounts the standard is firm about it. For cash held by third parties and for accounts receivable, the auditor should either perform confirmation procedures or otherwise obtain that evidence by directly accessing information the external source maintains. Reading a bank balance on the bank’s own secure site counts. Confirming a customer balance counts. What does not count is the internal ledger figure on its own, however tidy the reconciliation looks.

The standard is also modern in a way that lands squarely on finance systems. It recognises that confirmations now travel electronically and often pass through a third-party intermediary, and it tells the auditor to test that channel: understand the intermediary’s controls against interception and alteration, check that they work, and assess whether the company itself could override them. That last point is the one to sit with. The reliability of a confirmation depends on the company not being able to quietly redirect it, which turns the ownership of counterparty contact data and routing into an audit-relevant control that finance owns.

Read as a systems problem, this is an opportunity rather than a chore. The same data that makes a confirmation reliable, accurate bank and customer records, a channel the business cannot bend, and preserved documents from outside parties, is the data that makes cash application faster and reconciliations cleaner all year. Build it once as a confirmation readiness record, and the audit stops being a scramble to reassemble outside evidence and becomes a lookup against a trail you already keep. The rest of this piece walks through what the standard asks, then gets concrete about that record.

What the standard asks, step by step.

The requirements read cleanly once you follow the path of a single confirmation. The table below sets out each step, where it sits in AS 2310, what the standard asks, and what it should produce in the data a finance team owns. The paragraph references and the standard text were read directly from Appendix 1 of the PCAOB adopting release, downloaded as a PDF rather than taken from a summary.

The steps AS 2310 sets for the auditor’s use of confirmation, with the paragraph reference for each and what each should produce in a finance team’s data. The standard text was read directly from Appendix 1 of PCAOB Release No. 2023-008.
Step	Where it sits	What the standard asks	What it produces in your data
Anchor the evidence to a knowledgeable external source	AS 2310 .01, .02, .06	The objective is to obtain relevant and reliable audit evidence from a knowledgeable external source about a relevant assertion of a significant account or disclosure. Confirmation can support existence for cash, receivables and investments, completeness for payables and debt, occurrence for revenue, and rights such as assets pledged as collateral.	A record of which significant accounts rely on external evidence and which outside source stands behind each, rather than a source rediscovered every audit.
For cash and receivables, confirm or read the source directly	AS 2310 .24	For cash held by third parties and for accounts receivable, the auditor should perform confirmation procedures in accordance with paragraphs .08 through .23, or otherwise obtain relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source.	A recorded route per cash account and receivables population: a controlled confirmation, or direct access to the source such as a bank portal, held as an attribute set on purpose rather than settled by habit.
Keep the process under the auditor’s control	AS 2310 .14, .15, .16	The auditor should maintain control over the confirmation process so requests and responses are not intercepted or altered, and should select the items, send the requests directly to the confirming party, and receive the responses directly back.	Counterparty master data that is accurate and owned: the right confirming party, the right physical or electronic address, kept current so requests reach the source and responses return to the auditor.
Treat an electronic intermediary as something to be tested	AS 2310 .17, Appendix B	When an intermediary facilitates direct electronic transmission, the auditor evaluates the implications for reliability: understanding the intermediary’s controls over interception and alteration, testing whether they operate, and assessing whether the company can override them.	Clarity on who controls the confirmation routing and the contact data, so the company cannot override the channel, which is the condition that lets the auditor rely on it.
For receivables, keep the outside documents that stand in for a confirmation	AS 2310 .25, Appendix C	If direct evidence is not feasible based on the auditor’s experience, the auditor obtains external information indirectly through other substantive procedures, using items the company received from external sources such as subsequent cash receipts, shipping documents, purchase orders, and signed contracts.	Preserved, unaltered third party documents tied to each receivable, so the indirect route has real external evidence to draw on instead of an internal reprint.
Confirm the terms behind debt and unusual transactions	AS 2310 .29, .30	Beyond cash, the auditor should consider confirming other financial relationships such as lines of credit, other indebtedness, compensating balance arrangements, and guarantees, and for significant risks in a complex or unusual transaction, consider confirming terms such as side agreements, bill and hold sales, and supplier concessions.	A link from a significant transaction to its contract terms and the third party who can confirm them, so the terms are evidenced from outside rather than asserted from within.

The steps AS 2310 sets for the auditor’s use of confirmation, with the paragraph reference for each and what each should produce in a finance team’s data. The standard text was read directly from Appendix 1 of PCAOB Release No. 2023-008.

Two points are worth drawing out. The first is the two roads in paragraph .24. For cash and receivables the auditor can run a confirmation or directly access the external source, and the standard treats them as alternatives that both reach a knowledgeable external source. Appendix C makes the direct route concrete: viewing cash on a financial institution’s secure website, and for receivables examining subsequent cash receipts, shipping documents, and signed contracts. The cleaner and more externally sourced that data is, the more the direct route is available and the less confirmation chasing the audit needs.

The second is that reliability is not automatic once a response arrives. The auditor evaluates whether a response might have been intercepted or altered, flags signs such as a reply from an address other than the one the request went to or a response with no signature, and treats a confirmation exception as a possible misstatement and a possible control deficiency rather than a clerical fix. Negative confirmations, where silence is taken as agreement, provide significantly less evidence and cannot carry an account on their own. All of this rewards a process where the outside party, the address, and the channel are known and controlled in advance.

Confirmation, read as a governed record.

A worked example makes it concrete. Take an operating cash account at a bank and a receivables population confirmed through an electronic platform. For the cash account the team uses direct access, reading the balance on the bank’s secure portal, with the account reference and the legal name held as counterparty master data owned by treasury rather than by the business unit. For the receivables the team uses a controlled confirmation through an intermediary whose controls have been tested and which the company cannot override, with preserved subsequent receipts, shipping documents, and signed contracts kept as the fallback if a confirmation goes unanswered.

Here is that logic expressed as a record. Each significant account carries its knowledgeable external source, the route chosen to reach it, the counterparty data the confirmation depends on, and, where an intermediary is used, whether its controls were tested and whether the company could override them. A completeness rule at the end names any significant cash or receivables population with no external route, and any intermediary channel the business could bend, because those are the two conditions that leave the evidence short.

A confirmation readiness record for a significant account

# Confirmation readiness for a significant account
# Figures and names are placeholders for shape, not real values.

account: "cash: operating USD, Bank A"
significant_account: true
assertion: existence and rights            # AS 2310 .06
owner: "treasury.ops@entity"
version: 2026.1

external_source:
  knowledgeable_external_source: "Bank A"  # AS 2310 .24
  route: direct_access                      # confirm | direct_access | indirect_documents
  direct_access:
    method: "read balance on the bank’s secure portal"  # Appendix C.a
    counterparty_master:
      legal_name: "Bank A, N.A."
      account_ref: "****4821"
      contact_owned_by: treasury            # not editable by the business unit
  intermediary:
    used: false                             # AS 2310 .17, Appendix B
    company_can_override_controls: false

other_relationships:                        # AS 2310 .29
  - "revolving line of credit, Bank A"
  - "compensating balance arrangement"

receivables_population:
  significant_account: true
  assertion: existence                      # AS 2310 .06
  route: confirm                            # positive confirmation, auditor controlled
  intermediary:
    used: true
    name: "electronic confirmation platform"
    controls_tested: true                   # Appendix B.a, B.b
    company_can_override_controls: false    # Appendix B.c
  indirect_fallback:                        # AS 2310 .25, Appendix C.b
    preserved_documents:
      - subsequent_cash_receipts
      - carrier_shipping_documents
      - signed_contracts_and_amendments

completeness_control:
  rule: >
    every cash and receivables population that is a significant account has a
    recorded external route, and every route through an intermediary has the
    intermediary controls tested and no company override
  blocked:
    - account: "cash: escrow, Bank C"
      route: none                           # no external source recorded
      status: blocked                       # would force an audit committee note (.28)
    - account: "receivables: distributor channel"
      route: confirm
      intermediary_override_possible: true  # company controls the contact routing
      status: blocked                       # channel not reliable until fixed

The blocks at the end are what keep it honest. Holding the external source and the route as attributes means the audit reads a register rather than rediscovering who to ask. Keeping the contact and routing outside the units whose balances are confirmed is exactly the separation the auditor tests for an intermediary, so a passing Appendix B evaluation is designed in rather than hoped for. Preserving the outside documents unaltered gives the indirect route real evidence to stand on. And the blocked list is the control: while a significant account has no external route, or a channel the company could override, the evidence is not yet in place, and for a significant risk that is precisely what the auditor would have to raise with the audit committee. None of this is elaborate. It is ordinary data discipline pointed at the evidence an audit was always going to ask for.

AS 2310 routes cash and accounts receivable evidence to a knowledgeable external source by one of two roads: a confirmation the auditor controls from selection to response, or direct access to the source such as a bank portal or the preserved external documents behind receivables. An electronic intermediary is allowed only where its controls are tested and the company cannot override them. The paragraph references are AS 2310 .14 to .17, .24, .25, and .28, with Appendices B and C.

An implementation checklist.

1.List the significant accounts that lean on an external source, and name the source. Cash held by third parties and accounts receivable are the two the standard singles out, but debt, guarantees, lines of credit, and compensating balances belong on the list too. For each, record the knowledgeable external source that stands behind the number, so the audit starts from a register rather than a search.
2.Set the route to each source on purpose. For cash and receivables the standard offers a controlled confirmation or direct access to the source, and for receivables an indirect route through preserved external documents when direct evidence is not feasible. Record which route each account uses, so the choice is owned and repeatable rather than re-argued each year.
3.Own the counterparty master data the confirmation depends on. A confirmation only works if it reaches the right party at the right address and comes back to the auditor. Keep the confirming party, the legal name, and the physical or electronic contact accurate and under a clear owner, because a stale address is the quiet reason a confirmation becomes a nonresponse.
4.Make the confirmation channel one the business cannot override. Where an electronic intermediary carries requests and responses, the auditor has to judge whether your company could override the intermediary’s controls or edit the contact routing. Keep that routing and the contact data outside the reach of the units whose balances are being confirmed, so the channel stays reliable and the auditor can rely on it.
5.Preserve the outside documents behind each receivable, exactly as they arrived. Subsequent cash receipts, carrier shipping documents, purchase orders, and signed contracts are the evidence the indirect route runs on. Store them unaltered and linked to the receivable, so when a confirmation goes unanswered the fallback is a real external record rather than an internal reprint.
6.Link significant and unusual transactions to their terms and a party who can confirm them. For a complex or unusual transaction the auditor may confirm terms such as side agreements, bill and hold arrangements, or supplier concessions. Keep the contract, its amendments, and the counterparty contact tied to the transaction, so a term can be confirmed from outside without a hunt.
7.Run one completeness query before year end. Any cash or receivables population that is a significant account with no recorded external route, and any route through an intermediary the company could override, is a gap. While that list has entries, the evidence the auditor needs is not yet in place, and for a significant risk it is exactly what the auditor must raise with the audit committee.

Failure modes, framed so you can avoid them.

Assuming the internal ledger balance is the evidence. The number in the general ledger is the assertion, not the proof. AS 2310 keeps the weight on a knowledgeable external source, so a cash or receivables balance that has never been matched to a bank record or a customer confirmation is unsupported no matter how clean the internal reconciliation looks.
Leaving the confirmation contact data with the business unit. When the team whose balance is being confirmed also controls the address the confirmation is sent to, the channel is exactly the one the auditor is required to doubt. The override risk in Appendix B is not hypothetical, and the fix is to hold the confirming party contact and routing outside the units being tested.
Trusting an electronic confirmation platform without asking who can change the routing. Direct electronic transmission is welcome, but the standard makes the auditor test the intermediary’s controls and assess whether the company can override them. A platform where a company user can quietly redirect a confirmation invites a finding, and the check is cheap to do up front.
Discarding the outside documents once the invoice is paid. Subsequent cash receipts, shipping documents, and signed contracts are the indirect evidence the standard names for receivables. Systems that overwrite or purge these after settlement leave the fallback route with nothing external to stand on, so a single nonresponse turns into a scramble.
Reprinting internal documents and calling them external. A shipping document regenerated from the order system, or a contract retyped into a memo, is internal evidence wearing an external label. The reliability of evidence depends on its source, so the record has to keep what the third party actually sent, in the form it arrived.
Relying on negative confirmations to carry an account on their own. The standard is explicit that negative confirmation requests provide significantly less evidence, and are not sufficient by themselves. A process built around silence being agreement will not meet the bar for a significant account, and treating it as if it does hides a real gap.
Treating a confirmation exception as a clerical fix. A difference between the confirmation and the ledger has to be evaluated as a possible misstatement and a possible control deficiency, not quietly adjusted. A workflow that lets an exception be cleared without that assessment loses the very signal the confirmation exists to surface.
Finding out at year end that a cash or receivables source was never set. When no external route is recorded for a significant account, the auditor may have to tell the audit committee that confirmation or direct access was not performed. Discovering that in the audit rather than in a completeness query turns a data task into a governance conversation nobody wanted.

What this asks of the data model.

The knowledgeable external source is a named attribute of the account, not an audit-time discovery. For each significant account that leans on outside evidence, the source that stands behind it belongs on the record, so the audit reads a register rather than reconstructing who to ask.
The route to the source is a stored choice with three shapes. A controlled confirmation, direct access to the source such as a bank portal, and the indirect document route for receivables are the options the standard describes. Holding the chosen route as data makes it owned and repeatable, and makes a missing route visible.
Counterparty master data is the reliability of the confirmation, held to a standard. The confirming party, the legal name, and the physical or electronic contact decide whether a request reaches the source and returns to the auditor. Owning that data and keeping it current is what turns a confirmation from a gamble into a control.
Who can change the confirmation routing is itself a control fact. Because the auditor assesses whether the company can override an intermediary’s controls, the record should show that the routing and contact data sit outside the units whose balances are confirmed. That separation is the difference between a channel the auditor can use and one it cannot.
External documents behind receivables are evidence only if preserved unaltered. Subsequent cash receipts, carrier shipping documents, purchase orders, and signed contracts should be stored in the form they arrived and linked to the receivable, so the indirect route rests on a real outside record rather than an internal copy.
A confirmation exception is a typed event, not a stray note. An exception has to be evaluated as a possible misstatement and a possible control deficiency, so the record should capture the difference, its cause, and its resolution, keeping the signal the standard relies on.
The audit committee trigger is a data condition worth watching. When a significant risk in cash or receivables has no confirmation and no direct access, the auditor communicates that to the audit committee. A completeness query over unrouted significant accounts lets finance see that trigger before the auditor does.
Completeness reduces to one testable query. Any significant cash or receivables population with no recorded external route, and any intermediary route the company could override, is the exception list. That query is the readiness signal, and it can run before year end rather than surfacing in the audit.

The audit evidence to keep.

The register of significant accounts that rely on an external source, with the knowledgeable external source named for each, so cash, receivables, debt, and guarantees can be tied to the outside party that stands behind them.
The recorded route for each cash account and receivables population, controlled confirmation, direct access, or preserved external documents, so the auditor can see the evidence path was chosen on purpose and applied consistently.
The counterparty master data used for confirmations, showing the confirming party, the legal name, and the current contact, with the owner and the last review, evidencing that requests reach the source and responses return to the auditor.
The intermediary assessment for any electronic confirmation channel, showing the controls tested and that the company could not override the routing, so the auditor’s Appendix B evaluation has a record to lean on.
A sample of preserved external documents for receivables, subsequent cash receipts, shipping documents, and signed contracts, held in the form they arrived, evidencing that the indirect route rests on outside records.
The confirmation exceptions log, showing each difference between confirmation and ledger, its evaluation as a possible misstatement and control deficiency, and its resolution, so the signal was handled rather than adjusted away.
The link from significant or unusual transactions to their contract terms and the party who can confirm them, evidencing that terms such as side agreements or bill and hold arrangements can be confirmed from outside.
The completeness exception report before year end, ideally empty, listing any significant cash or receivables population with no external route and any overridable intermediary channel, so a reader can see the two conditions were checked before the audit.

Questions worth asking in your own review.

For each significant cash account and receivables population, can we name the knowledgeable external source that stands behind the balance, and the route we use to reach it?
Is the route recorded as a deliberate choice, a controlled confirmation, direct portal access, or preserved external documents, rather than decided anew each audit?
Is the confirming party contact and routing owned outside the business units whose balances are confirmed, so the channel is one the auditor can rely on?
For any electronic confirmation platform we use, do we know whether a company user could redirect a request, and can we show the routing cannot be overridden?
Do we preserve subsequent cash receipts, shipping documents, and signed contracts unaltered and linked to each receivable, so the indirect route has real external evidence?
When a confirmation exception arises, is it evaluated as a possible misstatement and a possible control deficiency, or is it cleared as a clerical adjustment?
Can we link a significant or unusual transaction to its terms and a third party who can confirm them, without a hunt through email?
Could we produce, today, a list of every significant cash or receivables population with no recorded external route and every intermediary channel the company could override?

What this adds up to.

AS 2310 is a sensible piece of standard setting. It keeps the weight of cash and receivables evidence on a knowledgeable external source, it accepts that confirmations now travel electronically, and it asks the auditor to make sure the channel is one the company cannot bend. None of that is a burden on a finance team that already runs good bank connectivity and keeps its customer and contract records in order. For that team the standard mostly formalises what a careful close already does.

The build that makes it easy is small and pays off well beyond the audit. Name the external source behind each significant account. Record the route to it, a controlled confirmation, direct portal access, or preserved external documents. Own the counterparty data and keep the routing outside the units being confirmed. Preserve the outside documents behind each receivable in the form they arrived. Do that and the confirmation, the direct read, and the fallback all draw from one record, and the evidence an auditor asks for is already sitting where the audit can find it.

If there is one place to start, run the completeness query against your own accounts before year end: any significant cash or receivables population with no recorded external route, and any intermediary channel the company could override. For a simple structure that list is short and the work is a note to file. For a group with many banks, many customers, and an electronic confirmation platform, it is the work, and it is far better found now, while there is time to set a source and fix a channel, than surfaced as a conversation with the audit committee later.

Sources.

The requirements, the paragraph references, the two roads for cash and receivables in paragraph .24, the control and intermediary rules in paragraphs .14 to .17 and Appendix B, the alternative procedures in Appendix C, the definitions in Appendix A, and the effective date were read directly from Appendix 1 of PCAOB Release No. 2023-008, downloaded as a PDF and read rather than summarised, so they rest on the primary text. The implementation timing was cross checked against the PCAOB standard page and its confirmation implementation resources, and the adoption and SEC approval against the PCAOB news release and the Federal Register order. A practitioner walk-through was used only to corroborate the standard-setter text. No embedded posts from X appear in this article, because no public post on this topic could be verified as current, relevant and authentic at the time of writing, and an unverified embed is worse than none. Nothing here is audit, accounting, or legal advice for a specific company. The figures and names in the worked example and the model are placeholders for shape rather than real values, and how a given company applies AS 2310 depends on its own facts and its auditor’s judgement.