Who is legally accountable for the action of the internal audit of a company in the U.S.? If the internal audit of a company doesn't do due diligence by not properly auditing the financial documents of the company who is legally accountable for the lack of oversight of the internal audit? The CEO and the CFO or just the CFO?

  • 1
    What do you mean by "legally accountable"? Liable to be sued by shareholders, or by the government, or subject to criminal charges, or just subject to being fired, or what? Also, what is the jurisdiction, and the structure of the company, and what is the legal basis for an audit being required? Commented Jul 29, 2021 at 0:50
  • I used the tag criminal-law.
    – Sayaman
    Commented Jul 29, 2021 at 0:53
  • 1
    Which location/jurisdiction? Is there a specific criminal offense you expect either the CEO or CFO to be charged with?
    – Greendrake
    Commented Jul 29, 2021 at 1:23

1 Answer 1


Who is legally accountable for the action of the internal audit of a company in the U.S.? If the internal audit of a company doesn't do due diligence by not properly auditing the financial documents of the company who is legally accountable for the lack of oversight of the internal audit? The CEO and the CFO or just the CFO?

This answer is prefaced with a lot of context and discussion of possible fact patterns, because it contains some implicit assumptions about how liability for inaccurate financial statements works.


Publicly held companies, non-profit organizations with certain kinds of grants, and some privately held companies with large unsecured bank loans, are required, as a matter of law, or as a contractual requirement, to prepare financial statements that are audited by a third-party certified public accountancy firm.

This kind of audit is one of the few accounting functions that can only be performed by a CPA, even though, in practice, most more sophisticated accounting tasks are performed by CPAs.

The process for conducting this kind of audit is established by industry standards adopted by a CPA industry non-profit organization called the Financial Accounting Standards Board (FASB).

The Sarbanes-Oxley Act of 2002 requires the CEO of a publicly held company to certify that the financial statements of the company are materially true to the best of the CEO's knowledge, and that the CEO has reviewed the internal controls in the company and that they are either adequate, or that they have flaws which are expressly disclosed.

Federal law also requires publicly held company to periodically change their outside CPA firms and regulates the governance requirements for such firms in connection with hiring and evaluating outside CPA firms.

The inclusion of a knowingly false or misleading statement about a matter that is material to a potential investor in a publicly held firm's financial statements or other public disclosures is one form of securities fraud. Someone who participates in securities fraud may have civil or criminal liability as a result, although civil liability requires a showing that a particular investor who is suing suffered damages caused by the false or misleading statement.

The inclusion of a knowingly false or misleading statement about a matter that is material to a lender or grant provider who contractually requires an internal audit of a privately held profit or non-profit firm is a breach of the lending agreement or grant agreement, that could have contractually determined penalties, and could sometimes, but not alway, constitute criminal fraud, or justify a civil lawsuit for fraud by the aggrieved lender or grant provider. These misstatements could also be a ground for making the breach of contract debt not dischargeable in bankruptcy.

Another reason that firms sometimes conduct an internal audit would be for management to hire a CPA firm to investigate, forensically, a suspicion that fraud or misconduct has taken place within the firm, by someone at a lower level in the organization or affiliated with the organization, when management doesn't know for sure if something is amiss or not. This could happen in any kind of firm, but is most common in a large privately held company in which there is strong overlap between the group of senior managers of the company and the owners of the company.

What Can Go Wrong?

Legal accountability is something that is necessary only when the processes in the company to produce its financial disclosures and other disclosures are inaccurate for some reason.

There are a variety of people who could have legal accountability, and who is legally accountable depends upon why the disclosures were inaccurate.

Most often, the firm that commissioned the audit may have legal liability to the people for whom the audited financial information was prepared. In the case of a publicly held company, this firm is called the "issuer" and the financial statements are prepared for the benefit of the holders of publicly traded stock and corporate bonds of the issuer.

In the case of a non-profit, this would be the grant issuer who imposed the audit requirement (and also the state attorney general, who has general supervisory authority over all non-profits in a state). In the case of a commercial lender to the firm, this would be the lender.

Usually, the liability of an issuer for disclosing audited financial statements or disclosures that are inaccurate comes to be in the form of a civil lawsuit for money damages from someone who alleges that they were harmed by the inaccurate disclosure against the issuer.

A civil lawsuit could also name, as co-conspirators or additional defendants directly in fraud claims, anyone who participated in preparing the financial statements and knowingly did something wrong in the process with an intent to mislead the person to whom the statements were directed.

This liability could arise because the CEO certified that the financial statements were accurate knowing that they were not accurate, or certified that there were adequate internal controls in place knowing that there were not adequate internal controls in place.

This liability could arise because some other officer or employee of the company knowingly manipulated the accounting records of the company, or knowingly set up an inaccurate reporting system to generate accounting records of the company, producing the wrong results. This could take the form of actual fake entries or omissions from accounting business records. It could also take the form of characterizing and aggregating data in accounting business records in a manner inconsistent with the Generally Accepted Accounting Principles (GAAP) that are established by the FASB.

This liability could arise because the same kind of misconduct or negligence of some kind was committed by the CPA firm hired to conduct the audit. The issuer whose financial statements were inaccurate might sue the CPA firm for malpractice (effectively to indemnify it for the liability it incurred to others), or a third-party who relied upon the audited financial statements to its detriment could sue the CPA firm that conducted the audit as a third-party beneficiary of the representation from the CPA firm that the financial statements were materially accurate.

Any of the people above, if they engaged in intentionally defrauding the intended audience of the financial statements with an intent to deceive (and not mere negligence) could also be prosecuted criminally for securities fraud.

For example, when a CPA at the national accounting firm of Arthur Anderson intentionally destroyed records with an intent to cover up misconduct, and prepared misleading financial statements for the failed oil and gas firm Enron, the firm was prosecuted criminally for that conduct, convictions were obtained against individuals and the firm, and the firm ceased to exist while the appeal of its conviction was pending. The conviction was ultimately overturned on appeal, but for reasons that don't change the basic concept that accountants and accounting firms can be prosecuting criminally for intentionally and knowingly misleading investors in a publicly held company that it audits with an intent to mislead the public about the audited firm's finances.

Anyone who was in on the fraud and not deceived themselves could also have criminal liability, from a low level book keeper faking data entry records, to a CFO who, for example, intentionally reports the proceeds of loans owed by the company as purchase of stock in the company, in order to make it look like the company has less debt than it actually does.

But, suppose that the CEO relies upon information from the CFO and the CPA firm conducting the audit that the financial statements are correct and has no reason to suspect otherwise. In that case, even if the CEO certified that the financial statements were correct and was inaccurate in making that certification, the CEO would have no civil or criminal liability.

Criminal liability for inaccurate financial statements or disclosures requires knowledge that they are inaccurate accompanied by a statement to the contrary, or knowing participating in conduct that causes the statements to be inaccurate (and not mere negligence).

Sometimes, there is civil liability, but not criminal liability, for "negligent misrepresentation" when there are inaccurate financial statements or disclosures, the person states that they are accurate, and due to that person's negligence (but not knowledge or intentional misstatement) the financial statements or disclosure are actually not accurate in a material way that harms someone. The damages available and the legal treatment of the debt in bankruptcy are much more serious for intentional or knowing misstatements than they are for negligent misrepresentations. Negligent misrepresentation liability is limited to actual economic harm and can be discharged in bankruptcy. Securities fraud liability can include punitive damages and is usually impossible to discharge in bankruptcy, and securities fraud debts may be collected from certain kinds of assets that are otherwise exempt from creditor's claims.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .