Audit regulation and auditor engagement and liability

1 Regulation

Auditors are regulated by:

• Professional bodies (eg ACCA)
  

• International bodies (eg IFAC, the International Federation of Accountants)
  

• National bodies (in the UK the FRC, Financial Reporting Council)
  

IFAC supports the accountancy profession and the adoption of high-quality standards. IAASB and IESBA are independent standard-setting boards within the International Foundation for Ethics and Audit (IFEA), rather than boards within IFAC. Their roles are:

• IAASB (International Auditing and Assurance Standards Board): Sets International Standards on Auditing (ISAs) and other assurance standards
  

• IESBA (International Ethics Standards Board for Accountants): Issues the International Code of Ethics for Professional Accountants.
  

The IAASB's ISAs are adopted by the FRC in the UK which has local regulatory power. The IESBA's Code has been adopted by ACCA in its Code of Ethics and Conduct.

2 International Standards on Auditing (ISAs)

2.1 Authority

The IAASB’s International Standards do not override local (national) laws or regulations that govern the audit of financial statements. Therefore, if an audit is conducted in accordance with national requirements that differ from or conflict with ISAs, it may not comply with International Standards.

2.2 Purpose

ISAs promote consistent, high-quality audits internationally and help strengthen public confidence in financial reporting.

2.3 Scope

ISAs apply to and are written in the context of an audit of financial statements by an independent auditor. An audit will comply with the IAASB’s Standards only if the auditor has complied fully with all standards relevant to the audit.

The vast majority of the standards listed in the next section will be relevant to all audits. Clearly though, ISAs 610 and 620 would only be relevant if the auditor uses the work of internal audit or an expert.

2.4 Examinable documents

Glossary of Terms

Preface to the International Quality Management, Auditing, Review, Other Assurance, and Related Services Pronouncements

ISA 200   Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with ISAs

ISA 220 (Revised) Quality Management for an Audit of Financial Statements

ISA 230   Audit Documentation

ISA 260 (Revised) Communication with Those Charged with Governance

ISA 265   Communicating Deficiencies in Internal Control to Those Charged with Governance and Management

ISA 300   Planning an Audit of Financial Statements

ISA 315 (Revised 2019) Identifying and Assessing the Risks of Material Misstatement

ISA 320   Materiality in Planning and Performing an Audit

ISA 330   The Auditor’s Responses to Assessed Risks

ISA 450   Evaluation of Misstatements Identified During the Audit

ISA 500   Audit Evidence

ISA 501   Audit Evidence – Specific Considerations for Selected Items

ISA 505   External Confirmations

ISA 520   Analytical Procedures

ISA 530   Audit Sampling

ISA 540 (Revised) Auditing Accounting Estimates and Related Disclosures

ISA 560   Subsequent Events

ISA 570 (Revised 2024) Going Concern

ISA 580   Written Representations

ISA 610 (Revised) Using the Work of Internal Auditors

ISA 620   Using the Work of an Auditor’s Expert

ISA 700 (Revised) Forming an Opinion and Reporting on Financial Statements

ISA 705 (Revised) Modifications to the Opinion in the Independent Auditor’s Report

Also examinable: the conforming amendments to ISAs and related material arising from the quality management project; ACCA Code of Ethics and Conduct (December 2024). The session list includes documents issued by 31 August 2025 even where their effective date is later. This is why ISA 570 (Revised 2024) is taught here.

3 Engagement acceptance

3.1 Factors to be considered

It is, of course, flattering to be asked to be a company’s auditor. The assumption is that the company has heard good reports and a new audit means new fees. However, there are many factors to be considered before accepting an audit engagement:

• Is it ethical to take on the new work? For example, there might be close personal relationships to consider or the new fee income would make the auditor unduly reliant on that client.
  

• Will the auditor be able to meet the professional competence and due care criteria? For example, the potential client might be an insurance company but the auditor has no experience of auditing such specialist businesses.
  

• Is it practical to take on the new work given the size of the job and the auditor’s current staffing levels and commitment to existing clients?
  

• What is known about the type of business, its directors and its owners? Some types of business are more risky than others, some businesses might be in business sectors the auditor feels might cause reputational damage, and some directors can have shady pasts.
  

• Is the fee acceptable?
  

The steps that an audit firm should take before agreeing to become the auditor of a new client are therefore:

• Ensure that it is professionally qualified to act on both ethical and legal grounds.
  

• Ensure that existing resources are adequate to cover both the required expertise and the time that the new work will take
  

• Investigate the company, its owners and directors
  

• Communicate with the present /outgoing auditor.
  

3.2 Communication with existing auditor

This is obligatory: the outgoing auditor will be well-placed to tell the prospective auditor if there are professional or other reasons why the work should not be accepted.

If, for example, there had been serious disagreements about an accounting treatment and the directors were not willing to amend the financial statements, the new auditor might think twice about becoming involved with what might be a difficult client.

If, however, the outgoing auditor declined to be reappointed because the client had become too big for them, that would not be a reason why the prospective auditor could not accept the engagement.

The full process when taking over from a previous auditor is as follows:

• Ask the client for permission to contact the outgoing auditor. If the new client refuses, the appointment should be refused (what are they trying to hide?)
  

• Contact the outgoing auditor and ask if there are any reasons why they should not accept appointment.
  

• The outgoing auditor has to ask the client’s permission to reply to the new auditor (confidentiality rules require this). If the client refuses, the appointment should be refused (what are they trying to hide?)
  

• Assess any information received in the reply, together with other evidence collected independently.
  

3.3 Engagement letter

Assuming that the auditor wants to accept the new client, then a letter of engagement will be sent out to the client. This forms the contract between auditor and client, so it is a very important document. Typical matters covered in the letter include:

• Setting out the respective responsibilities of management and auditors
  

• The scope of the audit (reasonable assurance, financial statements, material misstatements, not primarily trying to detect fraud)
  

• The financial reporting framework to be used.
  

• The form of any reports to be issued
  

• The auditor’s entitlement to see all documentation and receive all explanations necessary for the audit.
  

• Practical arrangements, such as timing and the involvement of internal audit.
  

• The fee.  
  

4 Auditor liability

4.1 Introduction

Occasionally auditors get it wrong and they put their name to a set of financial statements which contain a material misstatement. Obviously, if users of the financial statements have relied on those statements (eg to make investment decisions), they could suffer financial harm because they would have been misled.

When auditors are appointed they send an engagement letter to the company. Essentially, this is a contract setting out both the auditors’ and the company’s responsibilities. It is possible for the auditors to breach this contract and so be liable for damages, but the main legal risk that auditors suffer is from the tort of negligence.

For a claimant to prove a negligence claim, it must be shown that:

• A duty of care to the claimant existed
  

• The duty was breached
  

• Monetary loss was suffered.
  

4.2 Duty of care

The English courts have been very reluctant to extend an auditor’s duty of care beyond the members of the company as a whole. The key case is known as the Caparo case where a company was taken over by Caparo on the basis of financial statements Caparo claimed were misleading. The House of Lords (the UK’s highest court then) concluded that the auditors of the company taken over owed no duty of care to members of the public at large, such as potential investors.

In partial contrast, in the Bannerman case it was held that auditors could owe a duty of care to a bank if the auditors knew that the bank was relying on the audited financial statements and the auditors did not disclaim their liability to the bank.

4.3 Breach of the duty of care

If the auditors carried out their audit in accordance with the International Standards on Auditing it will be difficult to prove that they fell short of their duty of care.

4.4 Monetary loss

Negligence is a practical matter: monetary loss has to have occurred before the courts are interested.