An approved financial statement with a favorable audit report may lead one to think that the accounts are reliable. If significant errors, unrepresented losses, or values lacking adequate support subsequently emerge, the doubt is understandable: is the statutory auditor liable for damages? And who can claim compensation, the company, the shareholder who invested, or the creditor who relied on that data?

An accounting error alone is not enough. I want to help you distinguish the error attributable to directors from the breach of audit duties, understand what damage can be claimed, and not overlook the deadline within which the action must be initiated. The first distinction to make concerns the specific engagement: an external auditor and a board of statutory auditors that also performs the audit do not in fact follow the same liability rules.

The auditor checks the financial statements, but does not replace the directors

Directors draw up the financial statements; the auditor verifies them. Statutory audit does not transfer business management, the choice of economic transactions, or daily bookkeeping to the auditor. Their task instead concerns the controls necessary to express an opinion on the financial statements in the audit report, according to the rules applicable to the engagement.

For this reason, an inaccurate figure in the financial statements does not automatically identify a fault on the part of the auditor. It is necessary to ask whether the error was recognizable through controls consistent with the engagement, whether elements existed that required further checks, and whether the report correctly represented the outcome of the work performed. Article 14 of Legislative Decree No. 39 of 2010 governs the content, signature, and filing of the report, as well as the right of the appointed entity to obtain information and documents useful for the audit from the directors: Article 14 of Legislative Decree No. 39 of 2010.

The report is a central element, not the only one. Its content must be read together with the financial statements to which it refers, the notes to the financial statements, the available accounting records, and facts known or ascertainable during the audit period. A report without qualifications can be significant if precisely the relevant anomalies were detectable; however, it does not demonstrate, by itself, either the breach or the compensable damage.

When an error can lead to compensatory liability

Compensation requires a precise connection. Article 15 of Legislative Decree No. 39 of 2010 provides for the liability of the statutory auditor and the audit firm for damages arising from the breach of their duties, also jointly and severally with the directors towards the company, shareholders, and third parties. The regulatory reference to start from is Article 15 of Legislative Decree No. 39 of 2010.

In concrete terms, at least three connected steps are needed. The first is to identify an unfulfilled audit duty: for example, an omitted check in the face of significant inconsistencies or a conclusion in the report that does not reflect the acquired elements. The second is to prove economically appreciable damage. The third is to explain the causal link, that is, why that damage would not have occurred, or would have been less, if the auditor had properly fulfilled their engagement.

Not every loss depends on the audit. If a company has suffered losses due to wrong business choices, the fact that the financial statements represented them poorly does not necessarily attribute the entire negative result to the auditor. Instead, additional damage caused by relying on incorrectly verified accounting information may become relevant: a financial decision made, a loan granted, an investment made, or an operation that could have been avoided if the anomaly had emerged in a timely manner.

Joint liability with the directors does not mean that the auditor becomes the general guarantor of all the company's liabilities. It means that when multiple conducts have contributed to the same damage, the claim can involve multiple liable parties; in internal relations, Article 15 limits the auditor's liability to their effective contribution to the causation of the damage. The extent of the damage must therefore be separated from the share of damage actually attributable to the breach of audit duties.

Company, shareholders, and creditors: damage must be attributed to the right subject

The company's damage remains the company's. If the audit error affected the corporate assets first and foremost, the claim for compensation concerns the prejudice suffered by the entity. Examples include the worsening of a loss, the cost of an operation continued on the basis of unreliable data, or the deterioration of assets that could have been limited with the correct emergence of critical issues.

A shareholder may suffer personal damage, but it is not sufficient to indicate the reduction in the value of the shareholding or the failure to distribute profits as if they were automatically direct damage. The Court of Cassation, regarding the individual action of a shareholder against directors, reiterated that the loss of share value and the failure to perceive profits can only be reflected consequences of the damage to corporate assets. This is a useful distinction also to guide the claim against the auditor, without superimposing the shareholder's damage on that of the company: Court of Cassation review on the individual shareholder action.

The shareholder must distinguish their own prejudice from the common one. Personal damage can arise when the information submitted to audit directly affects a specific financial choice of theirs. The difference is not formal: if the damage is corporate, the compensation goes to the company; if it is direct and individual, it is necessary to show how the auditor's conduct immediately affected the assets of the single subject.

For the creditor, the decisive point is analogous. The credit does not turn every loss of the company into damage automatically compensable by the auditor. It is necessary to identify the concrete reliance generated by the accounting data, the decision taken on their basis, and the consequent prejudice. A loan disbursed, an extension granted, or a guarantee not requested can only have significance if the choice is linked to the accounting representation and the alleged audit breach.

External auditor and board of statutory auditors: why qualification matters

Before taking action, the engagement must be identified. The statutory audit is generally entrusted to a statutory auditor or an audit firm registered in the registry; in companies not required to draw up consolidated financial statements, the bylaws may attribute it to the board of statutory auditors, provided it is composed of registered statutory auditors. The distinction results from Article 2409-bis of the Civil Code, reported in Legislative Decree No. 39 of 2010.

If the engagement is entrusted to an external auditor or audit firm, the specific liability regime is that of Article 15 of Legislative Decree No. 39 of 2010. If, on the other hand, the audit is carried out by the board of statutory auditors, the duties and liability of statutory auditors also come into play. Therefore, it is not enough for a person to be registered as a statutory auditor: it is necessary to know in what capacity they operated for the company and what activity was actually attributed to them.

A different regime applies to statutory auditors. Law No. 35 of 2025 amended Article 2407 of the Civil Code and, barring willful misconduct, provided for liability limits linked to the annual fee received: fifteen times the fee up to 10,000 euros, twelve times for fees from 10,000 to 50,000 euros, and ten times above that threshold. The rule expressly includes cases where the statutory audit is carried out by the board of statutory auditors: Law No. 35 of 2025, Article 1.

This same law entered into force on April 12, 2025, and establishes, for actions against statutory auditors, a five-year limitation period from the filing of the report provided for by Article 2429 of the Civil Code relating to the financial year in which the damage occurred. For events occurring before April 12, 2025, the application over time of the new discipline requires specific examination: the text of the law does not allow treating prior and subsequent situations as identical automatically.

Deadline and useful steps for a claim for compensation

The limitation period depends on who is claiming damages. For a claim by the company that appointed the auditor, Article 15 of Legislative Decree No. 39 of 2010 sets five years from the audit report. However, the Constitutional Court clarified in judgment No. 115 of 2024 that this starting point does not automatically extend to shareholders and third parties who suffer direct damage. Their tort claims are governed by Article 2947 of the Civil Code, and time cannot start running before the harmful tort has occurred. Any interruption or suspension of the limitation period must also be considered.

The first useful step is to precisely distinguish the financial statements, the financial year, and the report involved. A critical issue that emerges today may depend on data referring to multiple years, but the claim must be linked to the specific audit activity alleged to be unfulfilled. Confusing dates can compromise protection, especially if an anomaly is attributed to a report different from the one that should have intercepted it.

It is then necessary to reconstruct the damage without summing non-homogeneous items. The company's loss, the shareholder's individual damage, the creditor's reliance, and the damage caused directly by the directors do not coincide. A reliable quantification clarifies which economic consequence is attributed to the omitted or inadequate control and which, instead, derives from other facts.

For a preliminary framing, the engagement letter or appointment resolution, audit reports, financial statements and notes of the years involved, relevant minutes, and documents proving the financial choice from which the damage arises are normally useful. There is no need to collect documents without criteria. Each act should help prove one of the essential points: audit duty, detectable anomaly, damage, or the link between conduct and prejudice.

Out-of-court requests can be an option if they clearly identify facts, subjects, damage, and the reasons for the claim; however, negotiation does not replace attention to the limitation period. When there are multiple potential liable parties, agreements or waivers formulated in a generic way must also be avoided, because their effect depends on the concrete content and the position of the person entitled to compensation. If you want to clarify which action corresponds to the damage you have suffered, you can contact me.

Frequently Asked Questions

Can I claim compensation if the auditor signed a report without qualifications?

Yes, but the signature is not sufficient proof. You must link the report to an unfulfilled audit duty, prove that the anomaly was detectable in the relevant period, and indicate the damage that resulted from it. A report without qualifications is important, but it does not turn every subsequent loss of the company into the auditor's liability.

Can a shareholder personally claim damages for the loss of share value?

Not automatically. The reduction in the value of the shareholding often reflects damage suffered by the company. To act personally, the shareholder must identify direct and personal prejudice, distinct from the depletion of corporate assets, and explain the link between the auditor's breach and their own financial choice.

Is the auditor liable jointly and severally with the directors?

They can be held jointly and severally liable. Article 15 of Legislative Decree No. 39 of 2010 provides for joint liability with directors for damages deriving from the breach of audit duties. However, it remains necessary to prove the auditor's causal contribution: liability does not eliminate that of those who improperly drew up or managed the bookkeeping.

By when must an action against an external auditor be brought?

The period is generally five years, but its starting point differs. The audit report is relevant to the appointing company’s claim. Claims for direct damage by shareholders or third parties instead follow Article 2947 of the Civil Code, as clarified by Constitutional Court judgment No. 115 of 2024. The same starting date should therefore not be applied to every claim: the claimant, conduct, damage and any interruption of the limitation period must be identified.

Does the liability limit introduced in 2025 apply to every statutory auditor?

No, it concerns statutory auditors on boards. The new Article 2407 of the Civil Code governs members of the board of statutory auditors and includes cases where the board performs the statutory audit. An external auditor or audit firm must instead be framed primarily under Article 15 of Legislative Decree No. 39 of 2010.

Essential regulatory references

To explore the topic further, the main institutional references are Article 14 of Legislative Decree No. 39 of 2010 on the audit report, Article 15 of the same decree on liability and limitation, as well as Law No. 35 of 2025 which replaced Article 2407 of the Civil Code for statutory auditors. The applicable rule depends on the concrete engagement, the date of the facts, and the damage actually alleged.