The problems began the year after the audit report was issued. The audit had gone well, and, like previous years, an unmodified opinion was issued. Armed with a clean opinion, the client attracted a prospective buyer, which purchased the client shortly thereafter.

The new owner soon discovered a problem with their acquisition: The purchased company had allowed state business licenses to lapse and could not operate for months. The new owner, who purchased the company primarily to expand to that market, was furious. Fingers were pointed, allegations were made, and the lawsuits followed. Assertions against the CPA firm, alongside their client’s executive team, included fraud in the inducement, negligence, breach of duties, and breach of the implied covenant of good faith and fair dealings. Damages claimed by the buyer included purchase price, lost business revenue, and punitive damages.

Over the next several years, various experts and attorneys reviewed the auditor’s documentation: audit reports, workpapers, risk assessments, audit staffing, communications with and about the client, and continuing professional education records. Eventually, it was determined that the audit team performed its duties appropriately and was not liable for the buyer’s alleged damages. While this was a welcome relief for the CPA firm, there was no undoing the hours of time dedicated to or dollars spent defending the claim.

WHY ARE AUDIT CLAIMS SO EXPENSIVE?

While less frequent than claims in other areas of public accountancy, audit claims are typically much more expensive to resolve. Why?

• Audit claims are document-intensive and often involve the use of experts to assess the CPA firm’s adherence to the standard of care. Not only are these processes expensive, but they are also lengthy. An audit claim can take multiple years, and a lot of attorneys’ fees, to resolve.
• The nature of audit services opens the door for third parties to assert a claim in addition to the client. Claims can be made by investors, creditors, shareholders, or anyone else who can assert reliance on the firm’s audit report. Multiple claimants and multiple suits can increase the cost of an audit claim.
• Damage models in an audit claim often include multiple types of damages, including lost profits and consequential and other indirect damages, which can inflate the alleged amount to a sizable sum. In addition, because no engagement is perfect, even if the CPA firm’s estimated percentage of liability is small, a small percentage of a large damages number can still result in substantial exposure.

HOW DO AUDIT CLAIMS ARISE?

Put simply, the auditor is often blamed when people lose money. Common assertions made in audit claims include:

• Failure to detect misstatements or disclosure error: This assertion involves a party’s reliance on allegedly misstated financial statements when making a financial decision. In the claim, the party ties their loss to the misstated financial statements. For example, a third-party lender may assert that they relied upon the accounts receivable valuation when extending a loan collateralized by receivables.
• Failure to detect theft or fraud: If the client experiences a theft or fraud, then the auditor may face a claim, even if they performed their responsibilities in adherence to relevant professional standards. Plaintiffs will allege that the auditor should have communicated weaknesses in internal controls that allowed the fraud to occur or pointed out other red flags.
• Failure to issue a report and disengagement disputes: Auditors are sometimes blamed for not completing the services in the engagement letter, even when the letter clearly states that the firm may not be able to reach a conclusion and may need to withdraw without issuing the report. While the risk of this type of claim exists, defending such a claim is preferred to defending a report that, perhaps, should not have been issued in the first place.

BOLSTERING THE DEFENSE

While preventing an audit claim is not always possible, any auditor can help their defense of a future claim by employing some critical practices when delivering audit services.

Professional skepticism

Professional skepticism involves having a questioning mind and critically assessing audit evidence. In a claim, plaintiff counsel will assert that the auditor did not exercise skepticism and, thus, missed an error or fraud. Therefore, it is important to consistently and continually reinforce the importance of professional skepticism during all phases of the audit and by all team members.

While professional skepticism applies to the entire audit process, approach higher-risk areas, such as prior-year management points or other identified prior-year audit issues, with special consideration. When issues or inconsistencies are noted in the performance of audit procedures, document the nature of the item, who was spoken to at the client, the client’s response, and how the audit approach was adjusted as a result.

Documentation

The importance of high-quality audit documentation in a malpractice claim shouldn’t come as a surprise. Just as in a peer review or regulatory review, the audit file will be heavily scrutinized, and some sort of documentation deficiency will generally exist. The auditor’s risk assessment and the resulting nature, timing, and extent of audit procedures will be dissected by both plaintiff and defense experts. Workpapers tell the story of how the audit team planned and performed the services and reached its conclusion. In a claim, it is best to make sure that story is clear and consistent, start to finish.

Competence

No one likes to have their competence called into question, but in the event of a claim, the plaintiff attorney will attempt to discredit the audit team. In the context of claim defense, demonstrating competence can include proof of:

• Taking relevant CPE, demonstrating industry and issue knowledge.
• Utilizing team members with relevant industry and service experience.
• Performing timely review of workpapers.
• Providing senior-level involvement and oversight.
• Consulting with others when needed.

Independence

In audit claims, plaintiff counsel will attempt to call the firm’s independence into question and paint the picture that the firm’s bias diminished its professional skepticism, causing the firm to overlook or disregard circumstances that led to the claim. Alleged threats to independence follow similar patterns: familiarity threats for long-term clients, self-interest threats if the client is a significant revenue source, and self-review threats if the firm also provides nonaudit services and gives the appearance of auditing one’s own work.

A CPA firm can bolster its defense by being mindful of threats to independence, especially those that are not black and white. In addition, consider leveraging the Conceptual Framework included in the AICPA Code of Professional Conduct to help evaluate threats to independence and implement safeguards.

Communications

Professionalism is always important, but much more so during an audit claim defense. Unbecoming electronic communications, either externally or internally, can unfortunately undermine an otherwise strong defense. The defenses listed above can all be hindered by an inappropriate text message, email, or instant message that suggests that professional skepticism, competence, or independence might be impaired. Emphasize the importance of professionalism in all communications, both within the audit team and with the client, always. Before hitting send on a text or email, imagine how it would look if it were displayed in a court room and if the message could be manipulated to paint the audit team in a negative light.

HOW ELSE CAN I MITIGATE MY RISK?

While the defenses listed above are helpful in the event of a claim, it’s better to avoid a claim altogether. Unfortunately, while there is no magic that removes the risk of a claim entirely, rigorous client acceptance and continuance procedures can help keep a problematic client at bay before a claim results.

32%

The percentage of audit claims made against firms in the AICPA Professional Liability Insurance Program from 2021 to 2024 that were asserted by third parties.

Source: CNA Accountants Professional Liability Claim Database, underwritten by Continental Casualty Co. Copyright © 2025. All rights reserved.

Kevin Hayes, CPA, is a risk control consultant at CNA. For more information about this article, contact specialtyriskcontrol@cna.com.

Continental Casualty Company, one of the CNA insurance companies, is the underwriter of the AICPA Professional Liability Insurance Program. Aon Insurance Services, the National Program Administrator for the AICPA Professional Liability Program, is available at 800-221-3023 or visit cpai.com.

This article provides information, rather than advice or opinion. It is accurate to the best of the author’s knowledge as of the article date. This article should not be viewed as a substitute for recommendations of a retained professional. Such consultation is recommended in applying this material in any particular factual situations.

Examples are for illustrative purposes only and not intended to establish any standards of care, serve as legal advice, or acknowledge any given factual situation is covered under any CNA insurance policy. The relevant insurance policy provides actual terms, coverages, amounts, conditions, and exclusions for an insured. All products and services may not be available in all states and may be subject to change without notice.