Auditor

An auditor is a person or firm that independently examines an organisation's financial statements, records, systems or controls and reports an opinion on whether they are accurate, complete and compliant with the relevant rules. External auditors are usually licensed accountants working for audit firms; internal auditors are employees who review their own organisation's risks and controls; government auditors examine public bodies and taxpayers. The auditor's value rests on competence, independence and professional scepticism.

Auditors carry out an audit and sign the resulting auditor's report. In most countries, the audit of listed companies, banks and insurers is a regulated activity reserved for registered firms, and the four largest global networks, known as the Big Four, audit most of the world's biggest companies. An independent auditor is the term used in many laws for the external auditor of a company.

An auditor is like a referee checking the scorecard after a match. The teams keep their own score, but everyone relies on the referee to confirm it is right. The referee must not be on either team's payroll or be friends with the players, or nobody would trust the result.

Companies pay their auditors, which creates an obvious tension. Much of the regulation around auditors exists to keep that referee independent, competent and willing to say "no" to the people paying the bill.

• External auditors. Independent firms appointed by shareholders or the board to audit annual accounts.
• Internal auditors. Staff who assess risk management, controls and governance and report to the audit committee of the board of directors.
• Government auditors. Bodies such as national audit offices that examine public spending, and tax authority examiners who audit returns.
• Compliance and specialist auditors. Professionals who carry out reviews such as an independent AML review, IT security audits or ESG assurance.
• Smart contract auditors. Security firms that review blockchain code for vulnerabilities; their work is technical rather than a regulated audit.

External auditors of companies generally must hold a recognised professional qualification. In the United States this means being a certified public accountant, licensed by state boards of accountancy after passing the CPA exam, with professional standards also set by the AICPA for private company audits. Auditors of US-listed companies must register with the Public Company Accounting Oversight Board, created by the Sarbanes-Oxley Act of 2002, which inspects firms and can impose sanctions. In the UK, chartered accountancy bodies register auditors under oversight from the Financial Reporting Council, and the EU requires statutory auditors to be approved by national authorities.

Rules aim to keep auditors objective:

• Rotation. US rules require the lead audit partner on a listed company to rotate every five years; EU rules require public-interest entities to change audit firm after a maximum period, generally ten years with possible extensions.
• Non-audit services. Auditors are barred from providing many consulting services, such as bookkeeping or certain tax and valuation work, to listed audit clients.
• Financial interests. Audit staff may not hold shares in or have close financial ties with their clients.
• Audit committees. Independent directors appoint and oversee the auditor rather than management alone.

Many large audit firms have been cautious about crypto clients because of the difficulty of verifying who controls private keys, the risk of commingled customer funds and uncertain accounting rules. In December 2022, shortly after the collapse of FTX, the firm Mazars paused its proof of reserves work for crypto exchanges, highlighting how such reports differ from full audits. Some stablecoin issuers and crypto companies now obtain audits from established firms, while others publish monthly attestations. Investors are encouraged to check the auditor's identity, regulatory registration and the scope of the engagement.

Auditors can be sued by clients and, in some circumstances, by investors who relied on their reports, and regulators fine firms for poor work. The collapse of Arthur Andersen in 2002, after its role auditing Enron, showed that failures can destroy even a large firm. More recent scandals, including the Wirecard collapse in 2020, revived criticism that auditors are too close to management, that market concentration among the largest firms limits choice, and that the "expectation gap" between what audits do and what the public assumes they do remains wide. Proposals include stronger regulators, separating audit and consulting businesses and greater use of technology to examine whole datasets rather than samples.