Advanced Auditing, Assurance and Professional Ethics · Professional Ethics & Liabilities of Auditors

Civil and Criminal Liabilities of Auditors

Updated 5 October 2026 · Fact-checked

Auditor liability is the legal responsibility an auditor bears for negligence, misstatements or fraud. Civil liability means paying damages to the company or affected parties. Criminal liability means fines or imprisonment, mainly under sections 147 and 447 of the Companies Act, 2013. To solve a question, identify the wrong, the person harmed, the law, and the consequence.

Understand Civil and Criminal Liabilities of Auditors

An auditor is paid to give an independent opinion. If the work is careless or dishonest, someone may suffer a loss. The law then holds the auditor responsible. This responsibility comes in two forms: civil and criminal.

Civil liability is about compensation. The injured party sues for damages. The usual basis is negligence: the auditor did not use the reasonable care and skill expected of a competent professional. The auditor owes this duty to the company under the engagement contract. Third parties can claim only in limited cases.

Criminal liability is about punishment by the State. It needs more than carelessness. It arises when the auditor knowingly or wilfully breaks the law, intends to deceive, or takes part in fraud. The punishment is a fine, imprisonment or both.

The case law sets the standard of care. The auditor is a watchdog, not a bloodhound. He may rely on management if he has no reason for suspicion. But he must act when something looks wrong. Third-party claims turn on whether the auditor owed that party a duty of care. Courts ask whether the auditor knew the statements would be shown to that party for a specific purpose, and whether that party relied on them.

The Companies Act, 2013 adds statutory duties and penalties. These include the duty to report fraud under section 143(12), penalties under section 147, liability for misstatements in a prospectus, and the fraud offence under section 447. Disciplinary action under the Chartered Accountants Act, 1949 is separate and can run alongside civil and criminal action.

Key rules to remember

Test for civil liability (negligence): Duty of care + breach of that duty + loss caused by the breach = liability for damages; All three must be present. If the auditor followed SAs and used reasonable care, there is no breach, even if the loss occurred.
Section 147: contravention of auditor provisions: Sections 139, 140, 141, 143, 144 or 145 contravened: fine ₹25,000 to ₹5,00,000. Knowing or wilful contravention with intent to deceive the company, shareholders, creditors or tax authorities: imprisonment up to 1 year and fine ₹1,00,000 to ₹25,00,000; Intent to deceive is what moves the case from the lower fine to imprisonment. If the auditor is convicted under section 147(2) (knowing or wilful contravention with intent to deceive), he must also refund the remuneration received, and is liable to pay damages to the company, statutory bodies or authorities, or any other persons for loss from incorrect or misleading statements in the audit report. These consequences do not follow from the lower-tier fine alone.
Section 143(12): reporting fraud: Fraud of ₹1 crore or more: report to the Central Government. Fraud below ₹1 crore: report to the audit committee or Board, and it is disclosed in the Board's report; Applies when the auditor has reason to believe an offence involving fraud is being or has been committed against the company by its officers or employees. The timelines come from the Companies (Audit and Auditors) Rules, 2014, not from the section itself. The auditor reports to the Board or audit committee within 2 days of knowledge and seeks a reply within 45 days. He then reports to the Central Government within 15 days of receiving the reply, or of the 45 days expiring.
Section 143(15): failure to report fraud: Fine of ₹50,000 to ₹25,00,000; Applies to an auditor who fails to comply with section 143(12). For a firm, the same applies to the auditor concerned.
Section 447: punishment for fraud: Imprisonment 6 months to 10 years and fine of at least the amount involved in the fraud, up to 3 times that amount; Applies to anyone, including an auditor, who is guilty of fraud as defined in the Act. Do not confuse it with the lower penalties of section 147.
Prospectus liability: Section 34: criminal liability for untrue statements. Section 35: civil liability to compensate persons who subscribed; An auditor who consents as an expert to a statement in a prospectus can be liable if the statement is misleading and he cannot prove reasonable belief.
Class action: Section 245: members or depositors may seek damages or other action against the auditor for improper or misleading statements; This gives shareholders a direct route to the Tribunal, in addition to ordinary suits.
Landmark cases and what each decided: Kingston Cotton Mill (1896): reasonable care, watchdog not bloodhound. London and General Bank (1895): auditor must report doubtful matters to shareholders. Re City Equitable Fire Insurance (1925): standard of care depends on the circumstances and he may rely on honest officials unless suspicious. Leeds Estate v Shepherd (1887): liable if dividend is paid out of capital after a negligent audit. Re Thomas Gerrard & Son (1967): must probe suspicious entries and is liable for failing to detect a fraud he should have pursued. Hedley Byrne v Heller (1964): a House of Lords case, not an auditor case; it established liability for negligent misstatement where there is a special relationship and reliance. Caparo v Dickman (1990): narrowed this for auditors; no general duty to individual investors or buyers of shares, and a duty needs the auditor to have known the statements would be used for a specific purpose; Quote the principle with the case name. Do not recite facts at length.

How to solve Civil and Criminal Liabilities of Auditors questions

Use this order for any question on auditor liability. It keeps your answer in provision-facts-conclusion form.

1Read the facts and find the wrong: negligence, misstatement, non-reporting of fraud, false statement in a prospectus, or a plain breach of a duty.
2Identify the harmed party: the company, a shareholder, a lender or other third party, or the State.
3Decide the type of liability: civil (compensation) or criminal (punishment). Check for intent to deceive. Without it, the case is usually civil, or only the lower penalty applies.
4State the provision or principle: section 143(12), 147, 34, 35, 245 or 447, or the case-law principle on duty of care.
5Apply it to the facts. Use the numbers and dates given, such as the fraud amount, the days elapsed and what the auditor knew.
6Test the defence: did the auditor follow SAs, rely reasonably on management, and use reasonable care and skill?
7Conclude clearly: liable or not, to whom, civil or criminal, and the consequence. Mention that ICAI disciplinary action may follow.

Quickest way: Four-line answer frame

When to use it: For 4 to 6 mark theory questions and for case-scenario MCQs where you have about a minute or two.

Wrong: name what the auditor did or failed to do.
Law: give the section or case principle in one line.
Link: apply it to the facts, noting the party harmed and any intent.
Result: civil, criminal or both, with the consequence. For fraud questions, check the ₹1 crore threshold first.

Common mistakes in Civil and Criminal Liabilities of Auditors

Treating every audit failure as criminal.
Students remember the penalty provisions and forget that intent is required for imprisonment.
Fix: Ask whether the auditor acted knowingly or wilfully with intent to deceive. If not, the case is civil negligence or a fine-only contravention.
Saying an auditor is always liable to third parties, or never liable.
Students half-remember Caparo and Hedley Byrne.
Fix: State both. Hedley Byrne: liability for negligent misstatement needs a special relationship and reliance. Caparo narrowed this for auditors: there is no general duty to unknown investors, but a duty may arise where the auditor knew the statements would be used by that party for a specific purpose and the party relied on them.
Mixing up the section 143(12) threshold and the reporting route.
Students recall only the Central Government route.
Fix: Below ₹1 crore, the auditor reports to the audit committee or Board, and it is disclosed in the Board's report. At ₹1 crore or more, the report goes to the Central Government after the Board's reply or the 45 days.
Applying section 143(12) to frauds by outsiders or in the audit client's customers.
Students ignore the condition in the section.
Fix: The section covers fraud against the company by its officers or employees. Check who committed the fraud before applying it.
Quoting a case without its principle.
Students memorise case names as a list.
Fix: Write each case as 'Case name: one-line principle', then apply it to the facts.
Forgetting disciplinary liability and that it runs alongside other liability.
Students focus only on the Companies Act.
Fix: Add one line that ICAI may act for professional misconduct under the Chartered Accountants Act, 1949, independently of court proceedings.

Worked examples

Example 1

Case: Zenith Ltd's auditor accepted the management's inventory figure of ₹3,40,00,000 without attending the physical count or testing any records. The inventory was later found to be overstated by ₹90,00,000. A bank lent ₹2,00,00,000 to Zenith Ltd on the strength of the audited balance sheet and suffered loss. There was no indication that the auditor knew of the loan or that the balance sheet would be shown to the bank. The auditor had no intent to deceive. Discuss his liability.

Show the solution

Wrong: the auditor skipped basic procedures on inventory and relied only on management. This is a failure to use reasonable care and skill, so it is negligence.
Duty to the company: the auditor owes a duty under the engagement. Breach and loss are shown, so he is liable to the company for damages.
Liability to the bank: Hedley Byrne allows liability for negligent misstatement only where there is a special relationship and reliance. Caparo v Dickman narrowed this for auditors: there is no general duty to lenders or investors who rely on the accounts, unless the auditor knew the accounts would be used by that party for a specific purpose. He had no such knowledge here.
Criminal liability: there was no intent to deceive and no fraud. Imprisonment under section 147 or section 447 does not apply. Only if a provision such as section 143 was contravened would a fine of ₹25,000 to ₹5,00,000 be possible.
Add that ICAI may take disciplinary action for failing to obtain sufficient appropriate audit evidence.

Answer: The auditor is civilly liable to Zenith Ltd for negligence. He is probably not liable to the bank, because he owed it no duty of care. There is no criminal liability for lack of intent. Disciplinary action may still follow.

Example 2

Case: During the audit, the auditor of Orion Ltd finds that the accounts head diverted ₹2,40,00,000 of company funds through fictitious vendors. The auditor mentions it in a note to the finance director but does not report it further. He signs his report and the matter is not disclosed. Advise on his position.

Show the solution

Provision: section 143(12) applies when the auditor has reason to believe that officers or employees are committing or have committed an offence involving fraud against the company.
Threshold: ₹2,40,00,000 is above ₹1 crore, so the report must go to the Central Government.
Procedure: under the Rules, the auditor first reports to the Board or audit committee within 2 days of knowledge and asks for a reply within 45 days. Then he forwards his report with the reply to the Central Government within 15 days of the reply or of the 45 days expiring.
Application: informing only the finance director is not compliance. The auditor did not report to the Board or audit committee, or to the Central Government.
Consequence: under section 143(15), failure to report is punishable with a fine of ₹50,000 to ₹25,00,000. He may also face ICAI disciplinary action. If he knowingly concealed the fraud with intent to deceive, he risks section 147(2), with imprisonment up to 1 year and a fine of ₹1,00,000 to ₹25,00,000, and possibly section 447.

Answer: The auditor has not complied with section 143(12). He is liable to a fine of ₹50,000 to ₹25,00,000 under section 143(15). If concealment was knowing and intentional, he could also face imprisonment up to 1 year and a fine of ₹1,00,000 to ₹25,00,000 under section 147(2), or action for fraud under section 447. He is also exposed to disciplinary action.

Exam tips

Write sections together with the amounts and ranges. Marks go to the fine of ₹25,000 to ₹5,00,000 under section 147(1) versus imprisonment up to 1 year with a fine of ₹1,00,000 to ₹25,00,000 under section 147(2), to the ₹50,000 to ₹25,00,000 fine under section 143(15), and to the ₹1 crore threshold.
In a case scenario, look for the intent word: 'knowingly', 'wilfully', 'to deceive'. It decides between civil and criminal.
For third-party questions, name Caparo and Hedley Byrne together and apply the test to the facts given. Do not give a one-sided answer.
Use the format provision, facts, conclusion in every answer. A short conclusion line earns marks even when the section is not recalled exactly.
MCQs have no negative marking. If unsure, eliminate options that give imprisonment for mere negligence and choose the best remaining one.

Practice questions from Professional Ethics & Liabilities of Auditors

Civil and Criminal Liabilities of Auditors in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Civil and Criminal Liabilities of Auditors: frequently asked questions

What is the difference between civil and criminal liability of an auditor?

Civil liability is for compensation. It arises from negligence or breach of duty, and the injured party claims damages. Criminal liability is punishment by fine or imprisonment. It usually requires knowing or wilful wrongdoing or fraud, and is prosecuted by the State.

Is an auditor liable to third parties?

Not generally. Hedley Byrne established liability for negligent misstatement where there is a special relationship and reliance. Caparo v Dickman narrowed this for auditors: they owe no general duty to individual investors or creditors who rely on the accounts, and a duty needs the auditor to have known the statements would be used by that party for a specific purpose. Under the Companies Act, 2013, an auditor convicted under section 147(2) may also be liable for damages to other persons for loss from misleading statements in his report.

Which sections of the Companies Act, 2013 matter most for auditor liability?

Learn section 143(12) and (15) for fraud reporting and the penalty, section 147 for penalties, sections 34 and 35 for prospectus liability, section 245 for class action, and section 447 for fraud. Together they cover most exam questions.

Which landmark cases should I learn?

Learn Kingston Cotton Mill, London and General Bank, Re City Equitable Fire Insurance, Leeds Estate v Shepherd, Re Thomas Gerrard, Hedley Byrne and Caparo. Write the principle of each in one line and be ready to apply it to a scenario.