Legal liability of auditors

Auditors sell assurance, and when that assurance proves wrong, someone may lose money and look for a defendant who can pay. Audit firms carry insurance and have partners with assets, so they are often the deepest pocket left after a company fails. This lesson explains who can sue an auditor, on what legal theories, and what defenses are available. It covers the common law of negligence, statutory liability under securities legislation, and the regulatory and disciplinary consequences that can follow a failed audit. The aim is not to make you a lawyer, and nothing here is legal advice. It is to show why the standards in the rest of the course are written as they are: much of what auditors document, they document because one day they may need to show a court or a regulator what they did and why.

Sources of liability

An auditor can face four broad kinds of consequence. First, civil liability to the client under contract and in tort, if the audit was negligent and the client suffered a loss as a result. Second, civil liability to third parties, such as investors and lenders, who relied on the audited statements. Third, statutory civil liability under securities legislation, which may be easier for investors to establish than common law claims. Fourth, regulatory, disciplinary and, in rare cases, criminal consequences: sanctions from the oversight body, discipline from the professional body, or prosecution where an auditor knowingly participated in fraud.

Negligence and the standard of care

Negligence requires the plaintiff to prove four elements. The auditor owed the plaintiff a duty of care. The auditor breached that duty by failing to meet the standard of care. The breach caused the plaintiff's loss. And the loss was not too remote. The standard of care is that of a reasonably competent auditor in the same circumstances, and courts look to the auditing standards as strong evidence of what that requires. An auditor who followed the standards is not automatically safe, and one who departed from them is not automatically liable, but compliance with the standards, and documentation that shows it, is the auditor's best defense.

A spectrum of fault runs from ordinary negligence, a lack of reasonable care, through gross negligence, an extreme departure from reasonable care, to constructive fraud or recklessness, and finally to actual fraud, a knowing misstatement intended to deceive. Some claims, especially under United States federal securities law, require proof at the upper end of that spectrum.

Who is owed a duty: third parties

The hardest question in auditor liability is how far the duty extends. An audit report is read by thousands of people the auditor never meets, and if every one of them could sue for any loss, liability would be indeterminate. Courts have drawn the line in different places.

The starting point in the common law world is the 1931 New York case Ultramares Corp. v. Touche. Judge Cardozo held that an auditor who was negligent, though not fraudulent, was not liable to a lender it did not know about, because otherwise auditors would face liability "in an indeterminate amount for an indeterminate time to an indeterminate class." Ultramares limited negligence liability to those in privity of contract with the auditor, or in a relationship so close as to approach privity.

In the United States, auditor liability to third parties under common law is a matter of state law, and the states follow three broad approaches. A minority, led by New York, follow a refined Ultramares rule: the auditor must have known the statements would be used by a particular party for a particular purpose, and there must be conduct linking the auditor to that party (Credit Alliance v. Arthur Andersen, 1985). Most states follow the Restatement (Second) of Torts Section 552, which extends liability to a limited group of persons the auditor intends or knows will receive the information, for a transaction the auditor intends or knows the information will influence. A few states once applied a broad foreseeability test, liability to anyone the auditor could reasonably foresee would rely, but several have since retreated from it, and California rejected it in Bily v. Arthur Young (1992).

Two United States Supreme Court cases shaped how courts treat claims under federal securities law. In Ernst & Ernst v. Hochfelder (1976), the Court held that a private claim under Section 10(b) of the Securities Exchange Act of 1934 and Rule 10b-5 requires scienter, an intent to deceive, manipulate or defraud, so ordinary negligence is not enough; lower courts generally accept recklessness. In Central Bank of Denver v. First Interstate Bank (1994), the Court held that private plaintiffs cannot sue for aiding and abetting a Rule 10b-5 violation, so an auditor can be liable only as a primary violator who made a misstatement, though the SEC itself can still pursue aiders and abettors.

Statutory liability under securities law

Under Section 11 of the Securities Act of 1933, purchasers of securities in a registered offering can sue anyone who signed or certified part of the registration statement, including the auditor whose report is included, if it contains a material misstatement or omission. The plaintiff need not prove reliance or negligence; the auditor must prove its due diligence defense, that after reasonable investigation it had reasonable grounds to believe the statements were true. Secondary-market investors usually sue under Section 10(b) of the Exchange Act and Rule 10b-5, which require proof of a material misstatement, scienter, reliance (often presumed under the fraud-on-the-market doctrine), loss causation and damages. The Private Securities Litigation Reform Act of 1995 (PSLRA) raised pleading standards, introduced a safe harbor for forward-looking statements, and replaced joint and several liability with proportionate liability for defendants who did not knowingly commit a violation.

Joint and several versus proportionate liability

When several defendants caused a loss, the law must decide how to share the damages. Under joint and several liability, each defendant can be made to pay the full award, and a solvent defendant may end up paying the share of one who cannot. Under proportionate liability, each defendant pays only its share of fault. Because company directors and officers are often insolvent or underinsured after a collapse, joint and several liability can make an auditor that was 25 percent at fault pay much more than 25 percent of the damages.

# Allocating a damages award between defendants: joint and several vs proportionate liability
award = 30_000_000                         # damages assessed in a misrepresentation case
fault = {"Fairhaven directors": 0.60, "Bramble Shaw (auditor)": 0.25, "Underwriter": 0.15}
can_pay = {"Fairhaven directors": 4_000_000, "Bramble Shaw (auditor)": 50_000_000, "Underwriter": 20_000_000}

def joint_and_several(award, fault, can_pay):
    # each defendant pays its share; any shortfall falls on the solvent defendants in proportion to fault
    paid = {d: min(award * f, can_pay[d]) for d, f in fault.items()}
    short = award - sum(paid.values())
    solvent = {d: f for d, f in fault.items() if can_pay[d] > paid[d]}
    tot = sum(solvent.values())
    for d, f in solvent.items():
        paid[d] += short * f / tot
    return paid

def proportionate(award, fault, can_pay):
    return {d: min(award * f, can_pay[d]) for d, f in fault.items()}

for name, rule in (("Joint and several", joint_and_several), ("Proportionate", proportionate)):
    paid = rule(award, fault, can_pay)
    print(name)
    for d, v in paid.items():
        print(f"  {d:<26}{v:>14,.0f}")
    print(f"  {'Recovered by plaintiffs':<26}{sum(paid.values()):>14,.0f}")

Joint and several
  Fairhaven directors            4,000,000
  Bramble Shaw (auditor)        16,250,000
  Underwriter                    9,750,000
  Recovered by plaintiffs       30,000,000
Proportionate
  Fairhaven directors            4,000,000
  Bramble Shaw (auditor)         7,500,000
  Underwriter                    4,500,000
  Recovered by plaintiffs       16,000,000

Under joint and several liability, Bramble Shaw would pay far more than its 25 percent share because the directors cannot pay theirs. The PSLRA applies proportionate liability to federal securities claims against defendants who did not knowingly violate the law, with an exception that makes them jointly liable for the uncollectable share owed to small investors (those with net worth under $200,000 who lost more than 10 percent of it), and an extra 50 percent of their own share where other defendants cannot pay. State law varies for common law claims.

Regulatory and disciplinary consequences

The PCAOB can censure, fine, suspend or bar registered firms and their associated persons. The SEC can bring civil enforcement actions and, under Rule 102(e) of its Rules of Practice, deny accountants the privilege of practicing before it. State boards of accountancy can revoke licenses. Criminal liability under federal securities and mail and wire fraud statutes applies to knowing participation in fraud; Sarbanes-Oxley Section 802 made it a crime to destroy or alter audit records to obstruct an investigation and requires auditors to retain audit documentation for seven years.

High-profile failures shape the rules. The collapse of Enron and the conviction (later overturned) of Arthur Andersen in 2002 led to Sarbanes-Oxley. In Canada, the failure of Livent and later cases involving Nortel and Sino-Forest pushed securities regulators and CPAB toward stronger oversight. The 2020 collapse of Wirecard in Germany, after auditors failed for years to confirm cash balances that did not exist, shows why lesson 9 insists on direct confirmation of cash with banks.

Managing liability

Firms manage legal risk mainly by doing good audits, and the rest of this course is about exactly that. A few practices matter particularly for liability. A clear engagement letter defines the scope of the work and the responsibilities of each party. Careful client acceptance avoids clients whose management lacks integrity (lesson 4). Thorough documentation shows what the auditor did and why; work that is not documented is, as far as a court or inspector is concerned, work that was not done. Firms also carry professional liability insurance and organize as limited liability partnerships (LLPs), which protect partners' personal assets from claims arising from other partners' negligence, though not from their own.

AS 1215 requires audit documentation sufficient to enable an experienced auditor with no previous connection to the engagement to understand the work performed, who performed and reviewed it, and the conclusions reached. The complete file must be assembled within 14 days of the report release date and kept for seven years. For non-issuer audits, AU-C 230 sets a 60-day assembly period and a minimum five-year retention.