Legal liability of auditors

Auditors sell assurance, and when that assurance proves wrong, someone may lose money and look for a defendant who can pay. Audit firms carry insurance and have partners with assets, so they are often the deepest pocket left after a company fails. This lesson explains who can sue an auditor, on what legal theories, and what defences are available. It covers the common law of negligence, statutory liability under securities legislation, and the regulatory and disciplinary consequences that can follow a failed audit. The aim is not to make you a lawyer, and nothing here is legal advice. It is to show why the standards in the rest of the course are written as they are: much of what auditors document, they document because one day they may need to show a court or a regulator what they did and why.

Sources of liability

An auditor can face four broad kinds of consequence. First, civil liability to the client under contract and in tort, if the audit was negligent and the client suffered a loss as a result. Second, civil liability to third parties, such as investors and lenders, who relied on the audited statements. Third, statutory civil liability under securities legislation, which may be easier for investors to establish than common law claims. Fourth, regulatory, disciplinary and, in rare cases, criminal consequences: sanctions from the oversight body, discipline from the professional body, or prosecution where an auditor knowingly participated in fraud.

Negligence and the standard of care

Negligence requires the plaintiff to prove four elements. The auditor owed the plaintiff a duty of care. The auditor breached that duty by failing to meet the standard of care. The breach caused the plaintiff's loss. And the loss was not too remote. The standard of care is that of a reasonably competent auditor in the same circumstances, and courts look to the auditing standards as strong evidence of what that requires. An auditor who followed the standards is not automatically safe, and one who departed from them is not automatically liable, but compliance with the standards, and documentation that shows it, is the auditor's best defence.

A spectrum of fault runs from ordinary negligence, a lack of reasonable care, through gross negligence, an extreme departure from reasonable care, to constructive fraud or recklessness, and finally to actual fraud, a knowing misstatement intended to deceive. Some claims, especially under United States federal securities law, require proof at the upper end of that spectrum.

Who is owed a duty: third parties

The hardest question in auditor liability is how far the duty extends. An audit report is read by thousands of people the auditor never meets, and if every one of them could sue for any loss, liability would be indeterminate. Courts have drawn the line in different places.

The starting point in the common law world is the 1931 New York case Ultramares Corp. v. Touche. Judge Cardozo held that an auditor who was negligent, though not fraudulent, was not liable to a lender it did not know about, because otherwise auditors would face liability "in an indeterminate amount for an indeterminate time to an indeterminate class." Ultramares limited negligence liability to those in privity of contract with the auditor, or in a relationship so close as to approach privity.

In Canada, the leading case is Hercules Managements Ltd. v. Ernst & Young, decided by the Supreme Court of Canada in 1997. Shareholders sued the auditor of two companies that had failed, claiming they had relied on negligently audited statements when making investment decisions. The Court accepted that the auditor owed a prima facie duty of care, because harm to shareholders was reasonably foreseeable and their reliance was reasonable. But it negated the duty for policy reasons: the statements had been prepared to let shareholders as a group oversee management at the annual meeting, not to help individual shareholders make investment decisions. To allow the claims would expose auditors to indeterminate liability. The result is that an auditor is generally liable to third parties only when it knew, or should have known, the identity of the plaintiff or the class of plaintiffs and that the statements would be used for the specific purpose for which the plaintiff relied on them.

The Supreme Court revisited auditor liability in Deloitte & Touche v. Livent Inc. (Receiver of) in 2017. Livent's auditor failed to detect a fraud by senior management, and the company continued to trade, deepening its insolvency. A majority of the Court held that the auditor owed Livent a duty in respect of its statutory audit, because the purpose of that audit is to let shareholders supervise management, and losses flowing from that supervisory function were within the scope of the duty. However, the Court held that a separate engagement to help Livent issue a press release did not make the auditor liable for all the losses from the company's continued trading. It also limited damages to losses within the scope of the duty actually undertaken. Livent confirms the two-stage analysis of Hercules and focuses attention on the purpose for which the auditor's services were provided.

Statutory liability under securities law

Canadian provincial securities acts give investors statutory rights of action for misrepresentation. For prospectus offerings, purchasers can sue the issuer, directors, underwriters and experts, including the auditor whose report is in the prospectus, without proving reliance. The auditor's main defence is due diligence: that it conducted a reasonable investigation and had no reasonable grounds to believe there was a misrepresentation. Since 2005, Part XXIII.1 of the Ontario Securities Act and similar provisions elsewhere also give secondary-market investors a statutory right of action for misrepresentations in continuous disclosure documents. Plaintiffs need court leave to proceed, damages are capped for most defendants (for an expert such as an auditor, the greater of $1 million and the fees earned from the issuer in the prior year, unless the auditor knowingly participated), and liability is generally proportionate rather than joint and several.

Joint and several versus proportionate liability

When several defendants caused a loss, the law must decide how to share the damages. Under joint and several liability, each defendant can be made to pay the full award, and a solvent defendant may end up paying the share of one who cannot. Under proportionate liability, each defendant pays only its share of fault. Because company directors and officers are often insolvent or underinsured after a collapse, joint and several liability can make an auditor that was 25 per cent at fault pay much more than 25 per cent of the damages.

# Allocating a damages award between defendants: joint and several vs proportionate liability
award = 30_000_000                         # damages assessed in a misrepresentation case
fault = {"Fairhaven directors": 0.60, "Bramble Shaw (auditor)": 0.25, "Underwriter": 0.15}
can_pay = {"Fairhaven directors": 4_000_000, "Bramble Shaw (auditor)": 50_000_000, "Underwriter": 20_000_000}

def joint_and_several(award, fault, can_pay):
    # each defendant pays its share; any shortfall falls on the solvent defendants in proportion to fault
    paid = {d: min(award * f, can_pay[d]) for d, f in fault.items()}
    short = award - sum(paid.values())
    solvent = {d: f for d, f in fault.items() if can_pay[d] > paid[d]}
    tot = sum(solvent.values())
    for d, f in solvent.items():
        paid[d] += short * f / tot
    return paid

def proportionate(award, fault, can_pay):
    return {d: min(award * f, can_pay[d]) for d, f in fault.items()}

for name, rule in (("Joint and several", joint_and_several), ("Proportionate", proportionate)):
    paid = rule(award, fault, can_pay)
    print(name)
    for d, v in paid.items():
        print(f"  {d:<26}{v:>14,.0f}")
    print(f"  {'Recovered by plaintiffs':<26}{sum(paid.values()):>14,.0f}")

Joint and several
  Fairhaven directors            4,000,000
  Bramble Shaw (auditor)        16,250,000
  Underwriter                    9,750,000
  Recovered by plaintiffs       30,000,000
Proportionate
  Fairhaven directors            4,000,000
  Bramble Shaw (auditor)         7,500,000
  Underwriter                    4,500,000
  Recovered by plaintiffs       16,000,000

Under joint and several liability, Bramble Shaw would pay far more than its 25 per cent share because the directors cannot pay theirs. Canada has moved partway toward proportionate liability: the Canada Business Corporations Act (section 237.3) provides proportionate liability for financial loss arising from errors in financial information required under the Act, except where the plaintiff is a small investor or the defendant acted fraudulently, and the secondary-market securities provisions use proportionate liability too. Provincial negligence law otherwise generally applies joint and several liability among defendants.

Regulatory and disciplinary consequences

CPAB can impose requirements, restrictions and sanctions on participating firms, refer matters to provincial CPA bodies and, from March 2026, publishes individual firm inspection reports. Provincial CPA bodies discipline individual members through fines, suspension and expulsion. Securities commissions can also sanction auditors who contribute to a misleading disclosure, for example by barring them from acting for reporting issuers. The Canadian Criminal Code fraud provisions apply to auditors who knowingly participate in fraud.

High-profile failures shape the rules. The collapse of Enron and the conviction (later overturned) of Arthur Andersen in 2002 led to Sarbanes-Oxley. In Canada, the failure of Livent and later cases involving Nortel and Sino-Forest pushed securities regulators and CPAB toward stronger oversight. The 2020 collapse of Wirecard in Germany, after auditors failed for years to confirm cash balances that did not exist, shows why lesson 9 insists on direct confirmation of cash with banks.

Managing liability

Firms manage legal risk mainly by doing good audits, and the rest of this course is about exactly that. A few practices matter particularly for liability. A clear engagement letter defines the scope of the work and the responsibilities of each party. Careful client acceptance avoids clients whose management lacks integrity (lesson 4). Thorough documentation shows what the auditor did and why; work that is not documented is, as far as a court or inspector is concerned, work that was not done. Firms also carry professional liability insurance and organize as limited liability partnerships (LLPs), which protect partners' personal assets from claims arising from other partners' negligence, though not from their own.

CAS 230 requires audit documentation sufficient to enable an experienced auditor, with no previous connection to the audit, to understand the procedures performed, the evidence obtained and the conclusions reached. The final audit file must be assembled within 60 days of the report date and kept for at least five years under CSQM 1, though firms often keep files longer.