Auditors Negligence and Consequences

By Julius Opuni Asamoah (BSc MBA CA)

It is bestowed on companies and organisations to keep financial records and report on their financial performance to their shareholders and stakeholders. All over the world, businesses and all other organisations face the problem of fraudulent activities in their financial activities and dealings, which can take many forms. Due to the numerous accounting scandals, confidence in the reliability and the objectivity of financial statements of interested parties has been significantly reduced. Management, board of directors, audit committees, external auditors and internal auditors have a significant role in ensuring reliable financial reporting. The primary responsibility for the prevention and detection of fraud rests with both, those charged with governance of the entity and management. Members of management are responsible for evaluating and managing company’s business risks, including the risk of the financial reporting fraud, implementing and monitoring compliance with the appropriate internal controls to mitigate those risks to an acceptable level. It is important that management, with the oversight of those charged with governance, place a strong emphasis on fraud prevention, which may reduce opportunities for fraud to take place, and fraud deterrence, which could persuade individuals not to commit fraud because of the likelihood of detection and punishment. On the other hand, fraudulent financial reporting often involves the management override of controls that may otherwise appear to be operating effectively. Moreover, it is essential to determine roles and responsibilities of other stakeholders of the financial reporting in the prevention and detection of fraudulent behaviour in the companies.

Management is accountable to the board of directors or trustees, which provides governance, guidance and oversight. The board of directors has the responsibility for effective and responsible corporate governance, and role of the board is to oversee and monitor management’s actions to manage fraud risks. The board of directors and audit committee of a public company have ultimate responsibility for oversight of the business, including risk management. Audit committee supervises the work of internal auditors and cooperates with external auditors. The role and responsibility of internal auditors for fraud are defined in Internal Auditing Standards. According to IIA Standards, internal auditors must have sufficient knowledge to evaluate the risk of fraud and the manner in which it is managed by the organisation, but are not expected to have the expertise of a person whose primary responsibility is detecting and investigating fraud. According to IIA Standards, internal auditors must evaluate the potential for the occurrence of fraud and how the organisation manages fraud risk. The internal auditor’s roles in relation to fraud risk management could include initial or full investigation of suspected fraud, root cause analysis and control improvement recommendations, monitoring of a reporting or whistleblower hotline, and providing ethics training sessions. According to IIA Standards the Head of Internal Audit must report periodically to the board and audit committee on significant risk exposures and control issues, including fraud risks, governance issues, and other matters needed or requested by senior management and the board.

The external auditor is, in accordance with the International Standards on Auditing (ISA), responsible for obtaining reasonable assurance that the financial statements taken as a whole are free from material misstatement, whether caused by fraud or error. When obtaining reasonable assurance, the auditor is responsible for maintaining professional scepticism throughout the audit, considering the potential for management override of controls and recognising the fact that, audit procedures that are effective for detecting error may not be effective in detecting fraud. The external auditor may suspect or, in rare cases, identify the occurrence of fraud, but does not make legal determinations of whether fraud has actually occurred. Globally, external audits are implemented by a large number of organisations and they present the least effective control in combating occupational fraud. According to ISA 240, the auditor’s ability to detect a fraud depends on factors such as the skillfulness of the perpetrator, the frequency and extent of manipulation, the degree of collusion involved, the relative size of individual amounts manipulated, and the seniority of those individuals involved. While the auditor may be able to identify potential opportunities for fraud to be perpetrated, it is difficult for the auditor to determine whether misstatements in judgement areas such as accounting estimates are caused by fraud or error. However, because of their expert knowledge, external auditors are often in great position to provide useful perspectives on best practices in financial reporting and controls, including the mitigation of fraud risks.

Like other professionals such as physicians and architects, auditors are liable both civilly and criminally. Civilly, an auditor can be found liable either under the common law or a statutory law liability. Common law liability arises from negligence, breach of contract, and fraud. Statutory law liability is the obligation that comes from a certain statute or a law which is applied to society. The scope of both common law liability and statutory liability has been expanded to include certain third parties, mainly the foreseen or foreseeable users of audited financial statements. Prior to the start of an external audit, an engagement letter is written by the external auditor to the client. This therefore becomes a contractual liability binding both parties. This engagement letter on the conditions for audit and review engagements is, in many respects, a written contract between the external auditor and the client, stating both parties’ understanding of the professional relationship. It states the responsibilities of the engagement for the external auditor and the client.

The agreed upon terms of any audit engagement should be documented in an audit engagement letter or other suitable form of written agreement and should include the objective and scope of the audit of the financial statements; the responsibilities of the auditor; the responsibilities of management; a statement that because of the inherent limitations of an audit, together with the inherent limitations of internal control, an unavoidable risk exists that some material misstatements may not be detected, even though the audit is properly planned and will be performed in accordance with the accounting standards. It also includes identification of the applicable financial reporting framework for the preparation of the financial statements; and reference to the expected form and content of any reports to be issued by the auditor and a statement that circumstances may arise in which a report may differ from its expected form and content. Suit in contract is based on privity of contract and the auditors’ alleged breach of the engagement letter. While an engagement letter will not make the external auditor immune from lawsuits, the letter can be the ‘first line of defence’ if a client makes a claim against the external auditor. The roles of management and those charged with governance in agreeing on the terms of the audit engagement for the entity depend on the governance structure of the entity and relevant law or regulation. Depending on the entity’s structure, the agreement may be with management, those charged with governance, or both. When the agreement on the terms of engagement is only with those charged with governance, the auditor is required to obtain management’s agreement that it acknowledges and understands its responsibilities. When a third party has contracted for the audit of the entity’s financial statements, agreeing the terms of the audit with management of the entity is necessary in order to establish that the preconditions for an audit are present. The auditor should not agree to a change in the terms of the audit engagement when no reasonable justification for doing so exists. If, prior to completing the audit engagement, the auditor is requested to change the audit engagement to an engagement for which the auditor obtains a lower level of assurance, the auditor should determine whether reasonable justification for doing so exists. If the terms of the audit engagement are changed, the auditor and management should agree on and document the new terms of the engagement in an engagement letter or other suitable form of written agreement. If the auditor concludes that no reasonable justification for a change of the terms of the audit engagement exists and is not permitted by management to continue the original audit engagement, the auditor should withdraw from the audit engagement when possible under applicable law or regulation; communicate the circumstances to those charged with governance; and determine whether any obligation, either legal, contractual, or otherwise, exists to report the circumstances to other parties, such as owners, or regulators.

The legal liabilities of auditors in detecting material misstatements and frauds in the financial statements and illegal acts put the auditor in front of criminal and legal liability and important responsibility to inform the specialist authorities about any kind of fraud and material misstatement. Due to the important role of the auditor in detecting illegal acts, there are a number of regulations that organise auditor’s work and task as well as specifying auditor’s responsibility. The auditor must do his job in quality and in a professional way as expected from clients, so as to contribute to the country’s economic development. Professionals always specify the suitable levels for auditing work quality by putting recognised auditing criteria and certification standards and rules of professional behaviour. Despite these standards and regulation that determine the service quality provided by the auditor, it obliges to grant a special mechanism to monitor the occupational performance and this is an important matter to sustain the desired service quality. If the auditor takes the responsibility on contrary of the standard behaviour then they should provide special ways to limit such contraries if happened and specify punishment, thus, disciplinary and legal actions to be taken about it. For internal regulation to prevail from the auditing services then the beneficiary of the audit should obtain the services at the desired quality level identical to their expectations. The differences between the understanding of beneficiary and auditor to service quality, and in particular to what is associated with the certificate occupation, is termed as the “Gap of Expectation”. This gap is the difference between what is expected from the beneficiaries from financial statements of the auditors and between what the auditors believe they can do.

With regard to auditing of financial statements, the auditor may be accused of negligence. In fact, this type of negligence can be accidental negligence, gross negligence or constructive fraud. In cases of negligence, the defendant must prove that the financial statements include substantial distortions and that the dependant relied on the financial statements and has been damaged as a result of this dependence. Applying the generally accepted auditing standards should lead to the discovery of these distortions. Going back to accidental negligence means that the auditor did not take into consideration, professional care and complete implementation of the audit procedure and due diligence during the audit. Accidental negligence is unintentional or a simple lack of interest without any attempt to deceive or deliberate any kind of intention to cheat. For example, due to the lack of notice and careless, the auditor could not identify an important commitment or obligation in the financial statements. Accordingly, in the case of accidental negligence, the allegation is that the auditor did not do his job with high interest and professional care that the client expected from him. Here, it means that the auditor could not detect errors or constructive frauds that could possibly be discovered if the auditor was committed to the International Standards on Auditing.

In the case of gross negligence, it represents strong and flagrant violations to the standards of due diligence and efficiency in the performance of occupational duties. It means that the auditor failed to do the minimum care expected to be done by the auditor in similar cases, and the consequent of gross negligence is lack of ability to detect series and highly important material misstatements or frauds. These are instances that should have been detected through applying the general auditing standards. It is important to distinguish between two types of negligence because the auditor always asks for gross negligence, but should not permanently be responsible for ordinary negligence. As the relative importance of distortion increases, then the probability of detecting such distortions by the auditors increases as well. If the client did register fake sales with high values at the end of the year in order to increase profit of sales, then applying the accidental or regular procedures of auditing alert the auditor to the existence of these fake sales. If the auditor fails to detect the intentional distortion, then this kind of negligence will be interpreted as a gross negligence when a legal action is taken against the auditor.

According to auditing standards, the auditor should determine significant weaknesses in accounting controls and then expands in the verification choices in those areas. It is possible to expect that the auditor detects important financial statement distortions because of major weaknesses in control within the system. However, the distortions resulting from fraud may occur through collusion between some employees to avoid the get around the auditing system or by avoiding that by the management or ignoring internal audit, such kind of distortions are extremely difficult to detect by the external auditor, especially with the existence of sophisticated and smart ways to hide the facts.

Hence, if privacy relationship is extended to the third party, then the liability of auditor may not be equal to the amount of audit fees and the value of fault or negligence which has been committed by the auditor. But in some cases it may be auditor’s responsibility to third parties for accidental negligence, like the client, and the cases of “Primary Beneficiary Relationships”. The “Primary Beneficiary Relationships” are the relationships which identify the client to the auditor as an appointed auditor specifically to do the review for the benefit of a specific third party and the objective of the auditing is to make this party depending on its results to make a particular decision. So if the third party is able to prove the primary beneficiary relationship with the auditor, then the third party will have the right to sue auditor just like client for accidental negligence in accordance with the provisions of common law when two conditions are available: The first condition is that the third party is known specifically to the auditor, and the second condition that this party is the one who will get the basic benefit of the auditing process. To explain that, for example; the expected buyer to the company request from the owner to appoint auditor to witness and verify to the accuracy of the financial statements as a condition of purchase, and that the expected buyer is known by the auditor, and it has been said to the auditor that this auditing process will be for the benefit of the buyer to take the decision to buy the company. In this case, although there is no contractual relationship between the expected buyer and auditor but there is a main beneficiary relationship and then liability is on the auditor to respect responsibility towards the expected buyer in the same level just like toward the client.

In conclusion, the auditor needs to be highly responsible and spend his best efforts to verify the financial statements before submitting the report to the client or beneficiary from the audit report. The legality nature of auditors work through verification of the correct allegations of the client and the values indicated in the financial statements, and commitment to follow the accounting principles in processing all accounts of the client, the responsibility facing the auditor in case of commitment to violation of law is determined by the type of committed violation, as well as stating by the laws and regulations of the accountancy profession and laws of the country. The auditor must plan for the auditing procedures using doubtful assumption, in particular matters that may bear potential risk because of materials distortion in the financial statements resulting from fraud and illegal acts. The auditor should understand the probability of distortion in financial statements due to fraud and illegal acts, in addition to that understanding the accounting system and internal monitoring applied in preventing faults and misstatements. When the auditor detects material distortion due to fraud and misstatement then the auditor must inform the management and authorised personnel in the control positions or employees in the higher position inside the organisation to take necessary actions against the perpetrators. It is essential that auditors take responsibility for detection of fraud and illegal acts in financial statements that they audit because the potential risk of detection of fraud and illegal acts in the financial statements is higher than the risk of non-detection of distortions resulting from material misstatements.