An auditor can lose a career, a firm and personal wealth through a legal claim. Claims come in two forms. The state may prosecute for a crime, and a person who has lost money may sue for damages. Because audit reports are relied on by many people who never signed a contract with the auditor, the hardest legal question is who the auditor owes a duty to.
The courts have changed their answer over the years, and the cases are examinable for their principles.
This topic covers criminal liability, civil liability in contract and in tort, the standard of care, the cases that settled whether third parties can sue, section 415 of Companies and Allied Matters Act 2020 (CAMA 2020), out-of-court settlements, disclaimers, and how liability is avoided, insured and limited. Examiners ask you to apply the three conditions of negligence to a scenario and to advise on defences and on managing the risk.
In 30 seconds
Auditors face criminal liability (for example acting while unqualified, fraud, insider dealing) and civil liability for negligence. Only the company has a contract with the auditor, so third parties must sue in tort. A tort claim needs a duty of care, a breach of it and resulting loss.
After Candler, Hedley Byrne, JEB Fasteners and Caparo, an auditor owes a duty to the company and shareholders as a body, not to investors or bidders who rely on the accounts, because there is no proximity and it is not just and reasonable. Section 415 of CAMA 2020 requires reasonable care, diligence and skill, and lets directors, or a member after 30 days’ notice, sue for negligence.
Following standards and keeping working papers is the best defence. Liability is managed by quality work, professional indemnity insurance, and proposals to cap liability, use limited liability partnerships and include disclaimers.
Two kinds of legal claim
Legal claims against auditors fall into two strands.
- Criminal. The authorities may prosecute the auditor for a crime. The penalty may be a fine, or imprisonment for a guilty individual.
- Civil. Another person who has suffered loss because of the auditor’s actions sues, usually to get money (damages).
The details vary by country. Nigerian law follows the English legal system, with criminal law (such as fraudulent trading or insider dealing) and civil law (contract and tort), made by statute (such as CAMA 2020) and by common law, which is precedent set in earlier cases. The cases below are not all Nigerian, but they remain the reference point for Nigerian auditors.
Criminal liability
The auditor may be criminally liable:
- if he accepts appointment as auditor under a statutory provision without being qualified to act;
- if he is involved in fraud, such as falsifying accounting documents or records; or
- if he is guilty of insider dealing: using or passing on price-sensitive inside information, an offence in many countries and also prohibited by the International Federation of Accountants (IFAC) and Institute of Chartered Accountants of Nigeria (ICAN) codes.
Firms should take steps to reduce the risk of insider dealing, for example by limiting the number of shares staff may hold in clients and requiring staff to declare all shareholdings. Criminal liability may also arise for certain offences relating to the winding up of a company, tax law, financial services legislation (dealing in investments or giving investment advice) and money laundering.
Civil liability: contract and tort
Contract
A company has a contract with its auditor for audit services, so it may sue for breach of contract if the auditor is negligent in carrying out its terms. Only the company can do so. Banks, creditors and shareholders have no contract with the auditor and cannot sue in contract. The board usually starts the action.
The duty of care and the standard of skill
Views on the auditor’s duty to find fraud have changed. In Re Kingston Cotton Mill No 2 (1896) the auditor was described as a “watchdog, not a bloodhound”: on guard for fraud and error but with no active duty to search for it. Re London and General Bank (1895) said the auditor’s responsibility was to convey information, not to arouse enquiry.
By Re Thomas Gerrard (1967), the auditors were held liable because they failed to detect, over several years, that the managing director was falsifying invoices. Detecting fraud was not their prime responsibility, but more was expected of them in finding material problems.
The auditor must exercise reasonable care and skill. The IFAC and ICAN codes require professional competence and due care. The degree of skill and care depends on the circumstances: there is no general standard, and the auditor must react to the situation faced.
CAMA 2020, section 415
Section 415 states that:
- a company’s auditor shall, in performing his duties, exercise all the care, diligence and skill that is reasonably necessary in each circumstance;
- where the company suffers loss because the auditor failed in the fiduciary duty in subsection (1), the auditor is liable for negligence and the directors may bring an action against him; and
- if the directors fail to bring the action, any member may do so after 30 days’ notice to the company of his intention.
In general, an auditor who has followed auditing standards, and can show it in his working papers, will not usually be found negligent. That is why adequate working papers and sufficient, relevant and reliable evidence matter.
Tort of negligence: claims by third parties
A tort is a civil wrong, other than one arising under contract, that gives a claim for damages. Third parties who might suffer from negligent auditing include a bank that lent to the company and was not repaid, a supplier whose credit had to be written off, another company that made a takeover bid relying on the accounts, and an investor who bought shares that later fell in value.
For a successful claim in the tort of negligence, three conditions must be met:
- Duty of care. The auditor must owe a duty of care to the person who suffered loss. This has been the most difficult to establish.
- Breach. The duty must have been broken: the claimant must show that the auditor did not take reasonable care. Courts often call another firm of auditors as expert witnesses on whether the audit was done correctly.
- Loss. Loss or damage must result from the breach. A bank that lent on audited accounts that proved materially wrong, and then lost money when the borrower defaulted, can show a measurable loss.
The cases on duty of care
Concentrate on the principles, not the details. Some of these cases did not involve auditors, but the principles apply to them.
| Case | Facts in brief | Principle |
|---|---|---|
| Candler v Crane Christmas (1951) | An investor lost money after accountants negligently prepared accounts | No recovery, because the investor had no contract with the accountants. In the 1950s there was no duty to third parties without a contract |
| Hedley Byrne v Heller & Partners (1964) | A bank gave a negligent reference. The claimant lost money and the bank knew the claimant by name | A duty can exist without a contract where the adviser knows the claimant. The bank escaped paying because its letter had a general disclaimer |
| JEB Fasteners v Marks Bloom (1980) | Buyers acquired a company on negligently prepared accounts. The auditors knew of the plaintiffs but not of the bid | A duty was accepted, but the auditors were not liable because the buyers had suffered no loss: they would have bought at the same price anyway |
| Caparo Industries v Dickman and Touche Ross (1989) | Caparo bought shares and bid for Fidelity plc, relying on audited accounts that overstated profit | No duty to potential investors or bidders, for lack of proximity and because it was not just and reasonable. The audit protects the company, and gives shareholders information to scrutinise the directors. It does not exist to aid investment decisions |
Out-of-court settlements
Many claims, including high-profile ones such as Enron, are settled out of court by negotiation. Advantages: it avoids the cost and time of a trial, may avoid adverse publicity and the settlement may be lower. Disadvantages: final responsibility may remain undecided and the legal position unclear, it may encourage others to sue, and insurance premiums may rise.
Disclaimers in the audit report
A disclaimer is not required in an audit report, but some reports include one. It says the report is for the company and the shareholders as a body, and the auditor accepts no responsibility to anyone else for its content. Its purpose is to cut the risk of third-party claims in negligence. It cannot guarantee protection, in spite of the Bannerman ruling, because every claim has its own circumstances.
Managing the auditor’s liability
Avoiding claims
Firms reduce the risk of being sued by making sure staff do high-quality work. They should follow appropriate auditing standards, use effective quality control procedures, train staff to the right level of knowledge and skill, and keep up to date with modern auditing methods.
Meeting claims: professional indemnity insurance
If a claim succeeds, or an out-of-court settlement is agreed, the auditor must pay damages. If they exceed what the firm can afford, the law in some countries may allow claims against the partners’ personal assets. The profession takes the view that its image would be damaged if awards were not paid for lack of funds, so professional bodies often require members in practice to carry professional indemnity insurance (PII).
This is a policy that covers all civil liabilities arising from the firm’s business and pays if the firm cannot. Compulsory PII has disadvantages:
- it may increase the frequency and size of claims, because firms seem to have large funds
- it may encourage careless auditing
- it is costly, and costs rise with claims
Limiting liability
- a statutory limit on claims, such as a maximum percentage of the audit fee or a fixed amount;
- allowing auditors to agree a cap with the client, so that a company cannot claim more than the agreed sum or formula. This is now permitted in the United Kingdom;
- limited liability partnerships, where a firm cannot lose more than its fixed capital, like a company;
- PII-type cover for the directors of client companies, so that claimants may turn to directors who can pay; and
- disclaimers of liability to everyone except the company and shareholders in the auditor’s report.
The rules in more depth
Why the courts limited the duty to third parties
If every investor or lender could sue, the auditor would face unlimited claims from an unlimited number of people for a fee paid by one company. Caparo drew the line at proximity: the audit report is for the company and its shareholders as a body, so a duty to them is reasonable. A person who buys shares on the open market or makes a bid is outside that group.
Hedley Byrne shows how the line can move if the adviser knows who will rely on the advice and for what purpose.
Why the three conditions all matter
A claimant may prove a duty and fail on breach if the auditor followed the standards, or fail on loss, as in JEB Fasteners. A defence therefore needs only one condition to fail. This is why the working papers are so important: they are evidence of reasonable care.
Numbers: the 30-day notice
If a member gives notice on 10 March that he intends to sue the auditor because the directors will not, he may begin the action after the 30 days expire. March has 31 days, so 10 March plus 30 days is 9 April, and he can sue from that date.
Worked example: a bidder sues the auditor
Scenario. Binta Plc was audited by Ola and Co for several years. The managing director has overstated inventory every year. Zenox Ltd bought a majority stake in Binta, relying on the audited accounts, and now claims against Ola and Co. Ola and Co says its work met the ISAs and that the fraud was concealed by senior management. Advise Ola and Co on its defences.
- Contract. Zenox has no contract with Ola and Co, so it cannot sue in contract. Only Binta can.
- Tort: duty of care. Zenox must show a duty. After Caparo, there is no duty to potential investors or bidders because of the lack of proximity and because it is not just and reasonable. This is the strongest defence.
- Tort: breach. Even if a duty existed, Zenox must show that reasonable care was not taken. If the work followed the ISAs and is documented. The fraud was concealed by a senior person, the auditor can show that the work could not reasonably have found it. A rival firm may be called as an expert witness.
- Tort: loss. As in JEB Fasteners, if Zenox would have paid the same price regardless, it has suffered no loss caused by the audit.
- Disclaimer and settlement. A disclaimer in the report, if there was one, helps but cannot be relied on alone. The firm should consider a settlement if the risk is high, weighing the cost, publicity and effect on insurance premiums.
- Conclusion. Ola and Co should defend on no duty of care first, then on no breach and no loss, rely on the working papers, notify its insurer, and review its quality procedures.
How to score full marks
- For negligence scenarios, work through the three conditions. Duty, breach and loss, in that order. Say who is suing, because that decides contract or tort.
- Name the case and give its principle in one sentence. Caparo for no duty to investors and bidders, Hedley Byrne for knowing reliance, JEB Fasteners for no loss, Candler for the old rule. The facts are not needed in detail.
- Quote section 415. Reasonable care, diligence and skill, action by directors, member action after 30 days’ notice.
- Give defences in order of strength. No duty, no breach (standards followed, working papers), no loss, then disclaimer.
- For managing liability, group the points. Avoid (quality), insure (PII with its drawbacks), limit (cap, limited liability partnership (LLP), statutory limit, disclaimer, directors’ cover).
- Time. Spend time in proportion to marks, with a short conclusion.
Common mistakes in the exam
- Saying a bank or investor can sue the auditor in contract.
- Missing that all three conditions of negligence must be met.
- Saying Caparo creates a duty to all investors. It denied one.
- Describing the case facts at length instead of the principle.
- Saying a disclaimer gives complete protection.
- Listing PII as an advantage only. Its disadvantages are examinable.
- Forgetting that following standards, shown in working papers, is the main defence.
- Forgetting criminal liability for acting while unqualified or for insider dealing.
Quick revision
- Criminal: unqualified acting, fraud, insider dealing, plus winding up, tax, financial services and money laundering offences. Civil: contract (company only) and tort (third parties).
- Tort conditions: duty of care, breach, loss.
- Cases: Candler (no duty without contract), Hedley Byrne (duty if the adviser knows the claimant; disclaimer worked), JEB Fasteners (no loss), Caparo (no duty to investors or bidders).
- CAMA section 415: reasonable care, diligence and skill; directors sue; a member may sue after 30 days’ notice.
- Settlement: cheaper and quieter, but unclear and may raise premiums. Disclaimer: helpful but not a guarantee.
- Manage: quality and standards; PII; limit by statute cap, agreed cap, LLP, directors’ cover, disclaimer.
Practice questions
These are original questions written in the style of the ICAN exam. Try each one before you open the answer. Full model answers follow the written questions.
Recall check: multiple choice
The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.
Question 1. Who may sue an auditor for breach of contract?
- Any shareholder
- A bank that lent to the company
- Only the company
- A supplier
Show the answer
C. Only the company has a contract.
Question 2. Which is NOT one of the three conditions for negligence in tort?
- Duty of care
- Breach of duty
- Loss
- A written contract
Show the answer
D. Tort exists where there is no contract.
Question 3. Caparo v Dickman decided that an auditor owes no duty of care to:
- The company
- Shareholders as a body
- Potential investors and bidders
- The board
Show the answer
C. There was no proximity, and it was not just and reasonable.
Question 4. In JEB Fasteners v Marks Bloom the auditors escaped liability because:
- They owed no duty
- The claimants had suffered no loss
- They had a disclaimer
- They were not negligent
Show the answer
B. The buyers would have paid the same price anyway.
Question 5. The phrase “watchdog, not a bloodhound” comes from:
- Re Kingston Cotton Mill No 2
- Caparo
- Re Thomas Gerrard
- Candler
Show the answer
A. It dates from 1896.
Question 6. If the directors fail to sue the auditor under section 415, a member may do so after:
- 7 days’ notice
- 14 days’ notice
- 30 days’ notice
- 90 days’ notice
Show the answer
C. 30 days’ notice to the company.
Question 7. An advantage of settling out of court is:
- Final responsibility is settled
- It avoids cost, time and some publicity
- Premiums fall
- It deters other claims
Show the answer
B. The disadvantages include unclear responsibility.
Question 8. A disclaimer in the audit report:
- Guarantees no third-party claims
- Is compulsory
- Reduces but cannot remove the risk of third-party claims
- Binds the courts
Show the answer
C. Each claim depends on its own circumstances.
Question 9. A disadvantage of compulsory professional indemnity insurance is that it:
- Pays claims
- May encourage careless auditing and larger claims
- Protects the profession’s image
- Costs nothing
Show the answer
B. It is also costly.
Question 10. Which is a way to limit auditors’ liability?
- Limited liability partnership structure
- Removing working papers
- Hiding fees
- Accepting all clients
Show the answer
A. Others include a statutory cap, an agreed cap and disclaimers.
Written questions
Question 11 (10 marks). Describe the circumstances in which an auditor may be criminally liable and the steps firms can take to reduce the risk of insider dealing.
Question 12 (20 marks). (a) Explain the three conditions for a successful claim for negligence in tort. (6 marks) (b) Explain the principles established by Candler, Hedley Byrne, JEB Fasteners and Caparo. (8 marks) (c) Explain how an auditor’s liability may be avoided, insured and limited. (6 marks)
Question 13 (10 marks). Lagos Finance Ltd lent ₦500 million to Kebbi Mills Plc relying on audited accounts that overstated receivables. Kebbi defaulted. The auditors, Sule and Co, followed the ISAs and kept full working papers. Lagos Finance sues the auditors in negligence. Advise Sule and Co. (10 marks)
Model answers
Show the model answer to Question 11
Criminal liability. The auditor may be prosecuted and, if guilty, fined or, for an individual, imprisoned. (1) Circumstances: accepting appointment under a statutory provision without being qualified (1.5); being involved in fraud, such as falsifying accounting documents or records (1.5); insider dealing, which is using or passing on price-sensitive inside information, and which IFAC and ICAN rules also prohibit (2); and offences relating to winding up, tax, financial services legislation and money laundering (1.5).
Reducing insider dealing. Restrict the number of shares staff may hold in clients (1.5) and require staff to declare all shareholdings (1).
Show the model answer to Question 12
(a) Three conditions (6 marks). A duty of care owed by the auditor to the person who suffered loss, which has been the hardest to prove (2). A breach of that duty, shown by proof that reasonable care was not taken, often through expert witnesses from another audit firm (2). Loss or damage caused by the breach, such as a bank’s measurable loss on a loan made on faulty accounts (2).
(b) Cases (8 marks). Candler: no duty to a third party with no contract, in the 1950s view (2). Hedley Byrne: a duty can exist without a contract where the adviser knows the claimant, though the disclaimer protected the bank (2). JEB Fasteners: a duty was accepted but there was no liability because there was no loss (2).
Caparo: no duty to potential investors and bidders, because of lack of proximity and because it is not just and reasonable. The audit protects the company and gives shareholders information to scrutinise directors (2).
(c) Managing liability (6 marks). Avoid: follow standards, quality control, training, up-to-date methods (2). Insure: professional indemnity insurance, which professional bodies often require, with its disadvantages of larger claims, careless auditing and cost (2). Limit: statutory cap, agreed cap, limited liability partnership, cover for directors and disclaimers (2).
Show the model answer to Question 13
Contract (1 mark). Lagos Finance has no contract with Sule and Co, so it cannot sue in contract and must use tort.
Duty of care (3 marks). Lagos Finance must show that a duty was owed. A lender is a third party. Under Caparo, the audit exists to protect the company and inform shareholders, not to guide lending, so the lack of proximity and the fact that it is not just and reasonable weigh against a duty, unless the auditors knew of the lender and its purpose, as in Hedley Byrne. (3)
Breach (3 marks). Lagos Finance must show that reasonable care was not taken. Sule and Co followed the ISAs and has full working papers, which is strong evidence of reasonable care. A rival firm as expert witness would be asked whether the audit was proper. (3)
Loss and conclusion (3 marks). A ₦500 million default is a measurable loss (1). The firm should defend first on no duty, then on no breach, notify its professional indemnity insurer, consider a settlement if the risk is high, weighing cost, publicity and premiums, and review its quality procedures (2).
Pathfinder on auditor liability
These are the ICAN Pathfinder questions that test this topic. ICAN owns the questions and the suggested solutions, so we point you to them and do not copy them. Open your Pathfinder, attempt each question under exam conditions, then check your answer against the notes above.
The liability gap, a lack of understanding of whom the auditor may be liable to, is one element of the expectation gap. This topic gives the law behind it.
Revise first: The cases on duty of care
Section A is a single compulsory case with several requirements. It has drawn on ethics, quality management, group audits and reporting. Practise the scenario method in this topic before you attempt it.
Revise first: How to score full marks
Source: ICAN Pathfinder, Advanced Audit, Assurance and Forensics. Diets covered: May Diet, 2026 and November Diet, 2025.
Spotted a mistake? Tell us and we will check it.
