Hold Harmless Letters May Not be Legal

Dear All

I have been doing some research and I am concerned about hold harmless letters in the context of a statutory audit conducted in terms of the APA. Here are my thoughts:

A client changes auditor. The old auditor is known as the predecessor auditor and the new auditor is the “new” auditor. International Standard on Auditing 510 states - When the prior period’s financial statements were audited by a predecessor auditor, the “new” auditor may be able to obtain sufficient appropriate audit evidence regarding opening balances by reviewing the predecessor auditor’s working  papers. It is a generally accepted practice within the auditing profession for the predecessor auditor to grant access to the “new” auditor of the working papers but disclaim liability for such work and request the “new” auditor to agree to such a disclaimer.

Section 46 (8) of the APA provides that a registered auditor may not through an agreement or in any other way limit or reduce the liability that such auditor may incur in terms of this section. The question arises therefore as to how be it possible for a registered auditor to issue a hold harmless letter where the registered auditor limits reliance by third parties on his or her work. The substance of such a limitation has the effect of limiting or reducing the liability of the registered auditor. Section 46 (8) bases its liability to third parties on the foreseeability test. In other words if the registered auditor knew, or could in the particular circumstances reasonably have been expected to know that audit report or statement would be relied upon by the third party to induce the third party to act or refrain from acting. The question arises as to whether the “new” registered auditor is a third party as contemplated by s 46. If so a registered auditor in South Africa may not issue a hold harmless letter limiting the reliance and ultimately liability on his or her work. Related to this where s 46 refers to a report or statement does it include the statements made by auditors in their audit working papers. It has been suggested that the granting of access to audit working papers might give rise to a duty of care to third parties that may not otherwise have existed. If it can be shown that the “new” auditor is a third party as contemplated by s 46 then this view is not acceptable as a duty of care was intended by s 46 to the “new” auditor by the predecessor auditor. The premise of a hold harmless letter between a new and predecessor auditor is that the predecessor’s audit work was not created for use by the “new” auditor and therefore it is not be suitable for the purposes which the “new” auditor intends. This seems strange as the objective of the registered auditors when conducting an external independent audit is the same for both parties. In fact to support such a view it is suggested that it is inappropriate to request a hold harmless letter from a component auditor.

In considering whether a predecessor auditor acted unlawfully in relation to a “new” auditor, i.e. in breach of a legal duty, the nature, context, purpose of the statement and knowledge thereof are considered and so is the relationship between the parties. In general, auditors have no duty to third parties with whom there is no relationship. It is submitted despite the hold harmless letter liability will arise when the work in question is of a kind which it was reasonable for the “new” auditor to rely on for predecessor auditor’s particular purpose.

In my view the cardinal consideration is whether the auditor knew of the specific purpose for which the reports would be relied upon. In other words did the predecessor auditor foresee at the time of the audit that a “new” auditor would rely on his or her work? If he was aware that his or her work would be relied upon for purpose of assessing the audit of opening balances as contemplated by ISA 510 and they are thus relied upon by a “new” auditor to its financial detriment, then the predecessor auditor would be liable to such “new” auditor irrespective of whether he knew of the specific circumstances or objectives, assuming of course that the requisite link between the “new” auditor and the predecessor auditor has also been established. Which is relatively easy as it is required by statute. A registered auditor should always know that changes in audit firms is common place and generally accepted and happens more often than not.

The only issue that may stand against such a duty of care is that audit working papers are not reports or statements as contemplated by s 46. If they are registered auditors in South Africa when granting access to their work in terms of ISA 510 (and only ISA 510) may not in terms of law issue a hold harmless letter.