1 | Auditors face liability risk in longer going concern reviews

The Issue

The ICAEW has confirmed that members have contacted the Audit and Assurance Faculty, flagging the fact that numerous requests have been made to auditors to extend the going concern assessment period.

Under the Financial Reporting Council's International Standard On Auditing (U.K.) 570, which sets out an auditor's responsibilities in respect of going concern assumptions in financial statements, the current assessment must cover at least 12 months from the date that the financial statements are approved.

This 12-month period is a minimum, not a hard cap. It is becoming increasingly common for entities to extend their going concern assessments, typically to 15 months or more, with such requests often presented as being routine in nature.

This trend can be attributed to a mixture of regulatory, market and sector-specific pressures, against a background of economic and geopolitical uncertainty. The key drivers for the requests include regulatory and trade bodies, lenders and investors, as well as other third parties seeking longer-term comfort in respect of the entity's financial resilience. Stakeholders may often seek reassurance on the future financial health and viability of the entity for longer than 12 months.

The issue ties into a bigger picture trend, that auditors are seeing an increased focus on forward-looking assessments, for example in respect of environmental, social and governance issues, resulting in a shift in the fundamental nature of the role.

The ICAEW does not suggest that such longer-term analysis is wrong, or inconsistent with good governance. On the contrary, many entities and third parties, such as regulators, already look far ahead of 12 months.

The concern is that specific requests that the auditor's assessment and report be extended to a longer period can create additional issues, particularly where such requests are made by, or ultimately originate from, third parties.

Such requests may create additional work for the auditor, and the longer the relevant period, the more uncertain the financial forecast will be, resulting in the auditor having to rely on their own judgment to a greater degree. Further, such requests can result in an expansion in the duties owed by the auditor.

Duty of Care to Third Parties

A major concern flagged by the ICAEW is that, depending upon the circumstances, extension requests have the potential to create a duty of care to third parties.

The more specific the request is for an extension, and the more closely tied to the position of a third party of the audited entity, the greater the risk of a duty of care to that third party arising. As such, these requests should not be treated as routine, but require careful consideration by auditors and those advising them.

As a starting point, auditors assume responsibility for the audit report to the members of the entity as a whole, as per Chapter 3 of Part 16 of the Companies Act 2006. However, in some circumstances auditors can owe duties to others.

In 2005, the case of RBS v. Bannerman in Scotland's Court of Session highlighted that auditors can owe a duty to third parties who assert that they rely on audit reports, and that the absence of a disclaimer of liability might be a relevant circumstance, pointing to an assumption of responsibility in respect of information or advice tendered.2

As such, the ICAEW recommends that Bannerman wording is included in audit reports, making clear that the report is made solely to the company's members as a body, and that the auditor does not accept or assume responsibility to any other party.

However, while the use of such clauses has been widely adopted, they do not necessarily present an absolute defense to a claim by a third party that seeks to rely upon the audit report, and to assert that an auditor has assumed a duty of care.

The Bannerman wording can effectively be overridden by actions that are inconsistent with it. For example, in the 2023 High Court decision in Amathus Drinks PLC v. EAGK LLP, it was highlighted that auditors could owe a duty of care to third parties in contract and/or tort, even where Bannerman wording was present in the audit report, depending upon the specific circumstances.3

Such a duty appears particularly likely to arise when the auditor is aware, or ought to be aware, that a third party will rely on information presented in the audit report.

Practical Takeaways

For both auditors and those advising them, it is important not to treat extension requests as routine, but instead to consider the full circumstances and context of the request, including the position of any relevant third parties.

Lawyers advising will wish to consider the circumstances carefully. It is worth considering whether the third party truly requires an extended assessment period, or whether they simply want a broader view on the future financial resilience of the entity.

As the ICAEW highlights, one practical step is to consider engagement documentation, for example whether to issue a separate letter of engagement to the audited entity, to cover any additional work being requested that goes beyond that required by the statutory audit.

Naturally, while this may itself inform the scope of the relevant duties, it will allow the auditor to be precise about the scope of the work to be carried out, plus the purpose of the work and the extent of their responsibilities.

One should also consider whether a separate letter of engagement with any third party requesting the extension may be suitable, so that that party's own requirements for assurance can be satisfied.

This will formalize the relationship and duty owed, but would potentially allow for clarity and visibility in respect of the extent of the auditor's role and responsibilities with respect to the third party.

In addition, auditors may wish to consider the introduction of further and more specific cautionary wording into the statutory audit report, for example making it clear that, the longer the assessment period is, the greater degree of uncertainty there will be.