Advanced Audit and Assurance (International) · Professional liability

Auditor Liability to Third Parties in ACCA Advanced Audit and Assurance

Updated 11 October 2026 · Fact-checked

Auditor liability to third parties is the question of whether an auditor owes a duty of care to someone who is not the client, such as a lender or investor. Under negligence, you must show a duty, a breach, causation and loss. The duty is owed to the company, and third parties succeed only in narrow cases.

Understand Auditor Liability to Third Parties

The client has a contract with the auditor. If the audit is poor, the company can sue for breach of contract. Nobody else has a contract, so a third party must use the law of tort, mainly negligence.

Negligence needs four things: a duty of care, a breach of that duty (falling below the standard of a reasonably competent auditor), causation and loss. In exam answers, the contest is nearly always the first one: was there a duty?

Hedley Byrne v Heller established that a duty can arise for careless words (negligent misstatement), not just careless acts, where there is a special relationship. The adviser knows the advice will be relied on by a particular person for a particular purpose, and it is reasonable for that person to rely on it. For negligent statements, assumption of responsibility is the main approach.

Caparo v Dickman set the narrow modern approach for audits. Caparo, an existing shareholder, bought further shares and then made a takeover bid in reliance on the audited accounts. The House of Lords held that no duty was owed to Caparo, either as a shareholder or as an investor and bidder. The audit duty is owed to the company. The accounts are prepared so that shareholders as a body can oversee management. They were not prepared to help individuals decide whether to buy shares or make a takeover bid.

Courts often use a three-stage framework: foreseeability of harm, proximity between the parties, and whether imposing a duty is fair, just and reasonable. Treat it as a general framework, not a universal test. In Robinson v Chief Constable of West Yorkshire (2018), the Supreme Court said courts should reason incrementally from precedent. In audit cases, the key is the purpose of the statement (the audit report) and whether the auditor knew it would be used for that purpose.

ADT v BDO Binder Hamlyn (1995) is an example where a duty was found. It was a High Court decision, so it is persuasive rather than binding at the highest level. BDO attended a meeting and told the buyer that the audited accounts of the target could be relied on. BDO knew the buyer was relying on them for the purchase. It was held to have assumed responsibility by the statement at the meeting, and was liable. The point is that direct statements and knowledge of the specific use can create a duty that the audit report alone does not.

A practical point: auditors can reduce risk with disclaimer wording on reports, engagement letters, and caution when giving comfort to outsiders. Disclaimers are not guaranteed to work, and they depend on being reasonable and being brought to the reader's attention.

Key rules to remember

Elements of negligence: Duty of care + Breach + Causation + Loss = Negligence claim; All four must be shown. A third party usually fails at the duty stage.
Caparo three-stage test: Foreseeability of harm + Proximity + Fair, just and reasonable to impose a duty; A general framework, not a universal test. For audits, the key question is the purpose of the report: did the auditor know it would be used by this party for this purpose?
Hedley Byrne special relationship: Skill/knowledge + Known reliance for a known purpose + Reasonable reliance = Duty for negligent statements; The adviser must assume responsibility for the advice.
Contract v tort: Contract: client only, based on the engagement terms. Tort: any party who can prove a duty.; Third parties have no contract with the auditor, so they must use tort.

How to solve Auditor Liability to Third Parties questions

Use this method for any scenario asking whether an auditor is liable to a third party.

1Identify the claimant and their relationship to the audit. Is it the client, a shareholder, a lender, a bidder or a buyer?
2State that there is no contract with the third party, so the claim is in tort (negligence).
3Set out the four elements of negligence. Say you will focus on duty first.
4Apply Caparo: was harm foreseeable, was there proximity, is it fair, just and reasonable? Ask what the purpose of the audit report was.
5Look for facts of direct contact. Did the auditor know the claimant would rely on the accounts, for a specific purpose, and did they make statements to them? Compare with Hedley Byrne and ADT v BDO.
6Consider breach, causation and loss briefly. Was the audit below standard (for example, ISA failings), and did the claimant's loss flow from the reliance?
7Consider defences and protections: disclaimers, contributory negligence, engagement terms.
8Conclude clearly: liable, not liable or uncertain, and give a recommendation for the firm.

Quickest way: Purpose and knowledge test

When to use it: When time is short and the question is a short scenario with a claimant.

Ask: why was the report produced? If it was for members as a body, a third party is unlikely to have a duty owed to them.
Ask: did the auditor know this claimant would rely on the accounts for this specific purpose, and did they say or do something to encourage it?
If yes to both, a duty is likely (Hedley Byrne, ADT). If no, no duty (Caparo).
Add one line on breach, causation and loss, and one on how the firm should protect itself.

Common mistakes in Auditor Liability to Third Parties

Saying auditors are liable to anyone who relies on the accounts.
Students stop at foreseeability and ignore proximity and purpose.
Fix: Always apply the full Caparo test and ask what the report was for.
Treating Caparo as meaning auditors never owe a duty to third parties.
The case is remembered for its no-duty outcome.
Fix: Say it is narrow, not absent. Duty can arise where the auditor knows of a specific use and the claimant is identified, as in ADT v BDO.
Claiming a third party can sue for breach of contract.
Students mix up contract and tort.
Fix: State that the contract is with the client only, so the third party must use negligence.
Naming cases without applying them to the facts.
Students recall the case names but not why they matter.
Fix: After each case, state the principle and link it to a fact in the scenario.
Ignoring breach, causation and loss.
The duty discussion uses all the time.
Fix: Give at least a sentence on each. A duty with no breach or loss gives no claim.
Giving no advice to the firm.
The question is read as purely legal.
Fix: Add practical steps: disclaimers, restricting contact with outsiders, clear engagement terms and professional indemnity insurance notification.

Worked examples

Example 1

Hartman & Co audits Zeta Ltd. Zeta's annual accounts were sent to its bank, Norland Bank, which then increased Zeta's overdraft. Zeta failed, and the bank lost money. The audit was later found to be negligent. The auditor had no contact with the bank. Discuss whether Hartman & Co owes a duty to the bank. (8 marks)

Show the solution

The bank has no contract with the auditor, so the claim must be in negligence (tort). It must show duty, breach, causation and loss.
The key issue is duty. Under Caparo, the court asks about foreseeability, proximity and whether it is fair, just and reasonable to impose a duty.
The purpose of the audit report is to let members oversee management. It was not produced for lending decisions.
There was no contact between the auditor and the bank, and no evidence the auditor knew the accounts would be used for this loan. This suggests weak proximity and no assumption of responsibility (Hedley Byrne).
Contrast ADT v BDO, where the auditor made direct statements to a buyer knowing it would rely on them. That is absent here.
If a duty existed, breach looks likely because the audit was negligent, and loss is caused by the lending. But without a duty the claim fails.
Advice for the firm: be careful about whether lenders are known users of accounts, and use disclaimers where the client sends accounts to third parties.

Answer: Hartman & Co probably owes no duty to Norland Bank. The report was for members, the auditor had no contact with the bank and did not know of the loan. The bank's claim is likely to fail at the duty stage.

Example 2

During a takeover of Tolan Ltd, the audit partner of Kerr & Partners attends a meeting with the bidder, Vega plc. He confirms that the audited accounts are reliable and he knows Vega will use them to fix its price. Vega buys Tolan, then finds that the accounts were materially misstated because of an audit failure. Explain whether Vega can claim against Kerr & Partners. (7 marks)

Show the solution

Vega has no contract with Kerr, so it must claim in negligence.
Under Hedley Byrne, a duty can arise for negligent statements where there is a special relationship: the adviser has skill, knows the claimant will rely, for a known purpose, and the reliance is reasonable.
Under Caparo, the court considers foreseeability, proximity and fairness. Here harm was foreseeable, as the partner knew of the price decision.
Proximity is strong because the partner spoke directly to Vega at a meeting. The case is similar to ADT v BDO (a High Court decision, so persuasive), where the auditor was held to have assumed responsibility by its statement at a meeting with the buyer.
The partner assumed responsibility, and it was reasonable for Vega to rely on the statement.
Breach: the accounts were misstated due to an audit failure, so the work fell below the standard of a competent auditor. Loss: Vega paid too much, and the reliance caused that loss. Vega must prove these facts.
Kerr might argue contributory negligence if Vega did its own due diligence and ignored warning signs, which may reduce damages.

Answer: Vega can probably claim. A duty of care arises because the partner knew of the specific purpose, gave direct assurance and Vega reasonably relied on it. If breach, causation and loss are proved, Kerr is liable, although damages might be reduced for contributory negligence.

Exam tips

Always state first that third parties sue in tort because they have no contract. It earns an easy mark.
Link each case to a fact in the scenario. A name with no application earns little.
Look for facts signalling knowledge of use: meetings, letters, comfort given, the auditor being told the purpose.
Finish with advice to the firm, such as disclaimers and controlling communications. This earns professional skills marks for commercial awareness.
Write a clear conclusion even when the answer is uncertain, and say what facts would change it.

Practice questions from Professional liability

Auditor Liability to Third Parties in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Auditor Liability to Third Parties: frequently asked questions

What is the difference between contractual and tort liability for an auditor?

Contractual liability is owed to the client under the engagement terms. Tort liability, mainly negligence, can be owed to others if the court finds a duty of care. Third parties must use tort because they have no contract.

What did Caparo v Dickman decide?

It decided that the auditors owed no duty to Caparo, an existing shareholder that bought more shares and made a takeover bid relying on the accounts. The duty is owed to the company, and the accounts are for members as a body to oversee management. The case is linked with the three-stage framework of foreseeability, proximity and fair, just and reasonable, which is a general framework rather than a universal test.

How is Hedley Byrne different from Caparo?

Hedley Byrne established that a duty can exist for negligent statements where there is a special relationship and known reliance. Caparo narrowed this for audits by focusing on the purpose of the report. Hedley Byrne opens the door and Caparo limits how far it opens.

Why does ADT v BDO matter?

It shows that an auditor can owe a duty to a buyer when the auditor knew the buyer would rely on the accounts for the purchase and gave direct assurance. It was a High Court decision, so it is persuasive rather than binding at the highest level. It is the example to use when the scenario includes direct contact with the claimant.