Former MACPA chair and Auditing Standards Board member Mike Manspeaker breaks down the standards taking effect this year, major changes involving confirmations and fraud, and what’s coming next

For auditors, keeping pace with new standards can sometimes feel like a full-time job unto itself. And lately, there has been plenty to keep track of.

Several important auditing and quality management standards are reaching their effective dates, and the Auditing Standards Board has recently completed significant new standards addressing confirmations and fraud. Meanwhile, work continues on attestation standards, going concern, audit evidence, risk response, and other issues that could shape audit practice for years to come.

Mike Manspeaker has a front-row seat to all of it.

A former chair of the Maryland Association of CPAs and longtime audit practitioner, Manspeaker is one of 19 members of the ASB, where he represents the perspective of local and regional accounting firms. He also serves on several of the task forces that do much of the detailed work behind the board’s standards.

That experience has given Manspeaker a new appreciation for the deliberation behind standards setting. Long before a standard is issued, he says, the ASB researches practice issues, considers whether new requirements are actually necessary, solicits stakeholder feedback, and weighs how proposed changes will affect audit quality and practitioners.

In a recent conversation, Manspeaker offered a guided tour of the increasingly busy standards landscape — including what auditors should be preparing for now, what will change in 2028, and what the ASB is working on next.

MACPA: You’ve been serving on the Auditing Standards Board for a while now. Remind us about your role and how the board operates.

Manspeaker: There are 19 members of the Auditing Standards Board. The larger firms have representation, and about five slots are reserved for local and regional accounting firms. I fill one of those roles. There are also positions for other stakeholders, including academics and governmental auditors.

Among the practitioners, we have a wide range of experience in terms of client size, complexity, and industries. It’s an interesting group of incredibly dedicated people who bring a lot of experience to the process.

The board does almost all of its work through task forces. A task force focuses on a particular project, drills down into the details, and brings issues back to the board for direction and ultimately approval. Once a proposed standard goes through the exposure process, the task force analyzes every comment letter, considers whether changes are needed, and eventually brings the final standard back to the full board for a vote.

By the time we issue a standard, I feel as though every issue and point of view has been considered.

MACPA: As a longtime practitioner, has serving on the ASB changed the way you look at the standards-setting process?

Manspeaker: Absolutely. One of the most interesting things to me is how much work goes on before anyone even considers issuing a new standard.

There is significant research into whether new standard setting is necessary, whether additional non-authoritative guidance might be more appropriate, or whether practitioners are simply having difficulty implementing an existing standard. We’re constantly asking: What does the profession need? Where are the potential risks to audit quality?

Sometimes we go through that process and conclude that the existing standard is fit for purpose. Nothing new gets issued, so practitioners never see all of that work.

We also ask whether the changes we’re considering are really necessary and how they will improve quality. Even when we’re considering terminology changes, we ask whether changing familiar language is worthwhile or whether we can make only the adjustments necessary to enhance quality.

Having spent decades on the other side, using auditing standards in practice, I understand that feeling of, “Why won’t they slow down and give us time to get this under our belts?” I can tell you those concerns are absolutely part of our discussions.

MACPA: Let’s talk about what auditors need to prepare for now. What’s taking effect for 2026 year-end engagements?

Manspeaker: There are two main buckets: group audits and quality management.

For group audits, SAS No. 149 is effective for periods ending on or after Dec. 15, 2026. A group financial statement essentially combines more than one entity, business unit, or division. That might mean consolidated financial statements involving a parent and subsidiaries, combined statements for related entities, different divisions within a single entity, or an equity-method investee.

We’ve had group audit standards before, but this has been a common area for peer-review findings because there has been some confusion about what constitutes a group audit and when the standard applies.

I think SAS 149 clarifies much of that and is organized in a way that makes it easier to apply, particularly in less complex situations.

If another auditor is auditing a subsidiary or another component, that auditor is considered a component auditor. That adds complexity because the group engagement partner must take responsibility for the group audit and appropriately direct and coordinate with the component auditor.

The key takeaway is simple: If you’re auditing group financial statements for a Dec. 31, 2026, year-end, you need to be applying SAS 149.

MACPA: And what should firms know about quality management as we approach year-end?

Manspeaker: Everyone focused on Dec. 15, 2025, because that was the date by which firms had to have their systems of quality management designed and implemented under SQMS No. 1.

Now comes monitoring and remediation. You can’t monitor compliance with your quality management system until you’ve actually operated it. Firms must complete their first monitoring and remediation process and evaluate their system of quality management by Dec. 15, 2026.

Importantly, that doesn’t mean you have to wait until December. The first evaluation has to be completed by then and annually thereafter. If your firm traditionally did its internal inspection during the summer because that’s a slower time, you can continue to structure your process accordingly.

There are two other pieces to keep in mind. SQMS No. 2 addresses engagement quality reviews — what some firms have historically called second-partner reviews — and establishes requirements for performing those reviews.

Then there are the engagement-level quality management standards: SAS No. 146 for audits, SSARS No. 26 for accounting and review services engagements, and SSAE No. 23 for attestation engagements. These essentially help the auditor apply the firm-wide quality management system to each of the individual engagements.

The thrust of those standards is that the engagement partner is responsible for making sure the relevant aspects of the firm’s quality management system are appropriately implemented at the engagement level.

MACPA: The ASB also recently completed SAS No. 150 on confirmations. Why was an update needed?

Manspeaker: We’ve used confirmations forever, and third-party confirmation is one of the more persuasive forms of audit evidence available to us. But business practices and technology have changed significantly.

SAS 150 modernizes the standard in several important ways.

First, the old standard required confirmation of accounts receivable. The new standard also requires confirmation of cash held by others. That can include bank accounts and potentially other forms of cash held by third parties, including certain digital assets depending on how they’re classified under the accounting standards.

The standard also provides more guidance about circumstances in which confirmation of cash or accounts receivable might be impracticable or ineffective and what the auditor must do in response.

Second, the standard addresses third-party intermediaries. Some banks, for example, will only process confirmations through an intermediary. When you have someone between the auditor and the party holding the information, the auditor needs to determine whether the information passing through that intermediary can be relied upon.

Third, there’s technology. Technology is a double-edged sword. It can make the flow of information much easier, but it can also make fraudulent information much easier to create.

SAS 150 therefore includes guardrails around “direct access.” For example, a bank might maintain a secure portal containing information and provide the auditor with direct access. If the requirements in SAS 150 are met, that direct access can serve in lieu of a traditional confirmation.

SAS 150 isn’t effective until 2028, so firms have some runway to update methodologies, audit programs, and checklists.

MACPA: SAS No. 151 deals with fraud, which is obviously a major issue for auditors. What’s changing?

Manspeaker: SAS 151 addresses the auditor’s consideration of fraud in a financial statement audit. It replaces the existing fraud standard, although the basic framework remains familiar.

The biggest emphasis is on helping auditors approach the risk assessment process through more of a “fraud lens.”

A material misstatement can occur because of error or fraud, but fraud is inherently more difficult to detect because someone is typically trying to conceal it. The goal is to provide additional guidance that helps auditors think more intentionally about where fraud risks actually exist.

One example involves fraud interviews. Auditors have long been required to make inquiries of management, those charged with governance, and others within the organization. But too often, I’ve seen auditors simply interview the people they happen to interact with most during the engagement.

The new guidance encourages auditors to think about where the risk of fraud actually exists and whom they should interview as a result.

More focus on fraud risks and responses will make fraud procedures more effective rather than just going through the motions.

MACPA: Does SAS 151 change how auditors should approach revenue recognition?

Manspeaker: The presumption that revenue recognition as a fraud risk remains.

But auditors should be laser-focused in applying that presumption. You shouldn’t simply throw a blanket over all revenue and say, “Revenue recognition is a fraud risk.”

Look at the different types of revenue the entity has. Which are more susceptible to manipulation? How could management manipulate revenue recognition?

A fraud risk is considered a significant risk, and a significant risk requires a specific audit response. You want that response focused on where revenue recognition fraud could actually occur.

MACPA: What happens when an auditor suspects fraud?

Manspeaker: That’s another area where SAS 151 provides significantly more guidance.

The existing standard offers relatively little help when an auditor suspects or becomes aware of fraud. And in reality, it’s usually suspected fraud. When you identify a suspicious transaction and ask the client about it, people generally don’t immediately confess. You get explanations, and sometimes those explanations simply don’t hold together.

Under the new standard, if you suspect fraud, you need to follow up. The first step is generally to inquire of management at a level above where you suspect the issue originated.

You then evaluate management’s response. If you can determine that the fraud was clearly inconsequential — considering both quantitative and qualitative factors — you may be finished. If not, additional investigation is necessary.

That investigation might involve telling the client that it needs to consult its attorney or perform additional work. The important point is that the auditor often can’t determine whether suspected fraud materially affects the financial statements until that additional investigation occurs.

I think the expanded guidance in SAS 151 will be very helpful to auditors.

MACPA: Beyond these recently completed standards, what’s next on the ASB’s agenda?

Manspeaker: I’d highlight three projects.

The first involves the attestation standards, which apply when CPAs provide assurance or perform procedures on subject matter other than financial statements. SOC engagements are one common example, but the standards can be adapted to many different types of subject matter.

We’re working on significant revisions to make sure concepts involving reasonable assurance and limited assurance remain consistent across auditing, review, and attestation engagements. The project also includes new guidance related to sustainability information.

The exposure period ended June 30, and we’re now working through the comment letters in detail. We literally consider them issue by issue and paragraph by paragraph. If the process stays on schedule, a final vote next May is planned.

The second area is going concern. We already have an existing standard, but we’re working on enhancements to help auditors better identify and respond to risks surrounding an entity’s ability to continue as a going concern. An exposure draft in the second quarter of next year is anticipated.

Finally, we’re closely following an International Auditing and Assurance Standards Board project dealing with the auditor’s response to assessed risks — areas such as testing controls, designing audit procedures, substantive analytical procedures, audit evidence, and the use of technology.

These are foundational issues.

We spend considerable time monitoring international and PCAOB standards because we want to converge where doing so makes sense. If there’s a concrete reason why something isn’t appropriate in the U.S. environment, we can diverge. But otherwise, convergence makes life easier for auditors who may need to work under multiple sets of standards.

MACPA: After seeing the standards-setting process from the inside, what do you most want practitioners to understand about it?

Manspeaker: It’s important to understand both the process and the “why” behind the standards.

The standard-setting process occurs in open meetings that anyone can observe. We seek input before projects begin. With the fraud standard, for example, we conducted surveys before we even started developing the standard.

Then issues are deliberated publicly, stakeholders have an opportunity to submit comments, and we carefully consider those comments. Add to that the diversity of experiences and perspectives represented on the board itself.

It’s a very open, thoughtful process designed to get as much input as possible.

And ultimately, that communication matters. Practitioners need to understand not only what new standards require, but why they were issued and why those changes are important.

Image by pressfoto on Magnific.