The criminal liability of statutory auditors and auditors in corporate frauds does not arise automatically from the position held. If you receive a notice, a request for documents, or an allegation concerning the company's financial statements, audit, or tax transactions, the first doubt is often very concrete: does the mere fact that you did not prevent the transaction suffice to attribute the offence to you? I will explain why the answer requires distinguishing precisely between the role performed, available information, effective powers, and conscious participation in the act.
I want to help you recognize the points that truly matter: what duties weigh on the board of statutory auditors and the statutory auditor, when an omission can assume criminal significance, what weight red flags carry, and why civil or disciplinary liability does not, in itself, coincide with a criminal conviction.
The position does not equal automatic criminal liability
Statutory auditors and auditors perform different tasks. The board of statutory auditors supervises compliance with the law and the bylaws, the principles of correct administration, and the concrete adequacy of organizational, administrative, and accounting structures. It also has powers of inspection, control, and requesting information from directors. These tasks explain why a statutory auditor may be involved in an investigation, but they do not allow deducing criminal liability from the appointment alone. The reference is found in articles 2403, 2403-bis, and 2406 of the civil code.
The statutory auditor expresses an opinion on the financial statements. Within the scope of statutory audit, the law also requires the verification of the regular keeping of accounts and the correct recording of management facts in the accounting records. The audit report must indicate the opinion on the financial statements and, in the prescribed cases, must justify reservations, an adverse opinion, or a disclaimer of opinion. The perimeter of the assignment and the content of the report thus become central elements for understanding what was required of that person. This is established by article 14 of legislative decree no. 39 of 2010.
Functions may overlap, but they do not merge. In some companies, the statutory audit is entrusted to the board of statutory auditors; in others, the statutory auditor and the auditor are distinct subjects. When the same person holds multiple roles, the obligations connected to each function must be reconstructed separately. A generically formulated allegation risks attributing powers or knowledge belonging to one role to the other.
When an omission can become complicity in the offence
Negligence is not always enough for criminal complicity. Incomplete control, professional error, or inadequate supervision may have civil, disciplinary, or administrative relevance. To affirm that the statutory auditor or auditor has participated in a fraud committed by directors or other subjects, however, it is necessary to demonstrate a personal contribution to the offence and the necessary mental element provided for by the contested provision.
The point is concrete knowledge of the unlawful risk. It is not sufficient to state that, due to the position held, the person should have noticed everything. Instead, it becomes relevant to establish what information was accessible, whether anomalies were perceptible with the tools of the assignment, whether clarifications had been requested, and whether the response received eliminated or maintained the suspicion. Time matters as well: a fact known after the filing of the financial statements does not automatically prove prior awareness.
Red flags must be connected to facts. An accounting anomaly, a misrepresented loss, unexplained related-party transactions, missing documents, or contradictory responses may require deeper investigation. But their presence does not replace proof of intentional participation. One must understand whether the signal was specific, repeated, understandable for that role, and such as to make inaction in the face of possible fraud unbelievable.
Case law excludes liability based solely on position. Regarding the omission-based complicity of statutory auditors in corporate and bankruptcy offences, the Court of Cassation has recalled the need for concrete symptomatic elements capable of distinguishing a merely negligent conduct from intentional participation, even if eventual. The qualification of controller, alone, does not prove contribution to the offence. This is a particularly useful criterion when the accusation is based primarily on the failure to react to the directors' conduct. See the Court of Cassation criminal review on the prerequisites of the statutory auditor's complicity.
Falsehoods in audit reports and false corporate communications
The audit report has an autonomous relevance. Article 27 of legislative decree no. 39 of 2010 governs falsehoods in reports or communications by statutory audit personnel. The rule requires false informational conduct or the concealment of information, accompanied by awareness of the falsehood, the intention to deceive recipients, and the purpose of achieving an unjust profit. Therefore, not every judgment that proves inaccurate constitutes the offence.
The contested content must be identified. An effective defense starts from the single sentence of the report, the opinion expressed, the omitted reservation, or the communication considered deceptive by the prosecution. It is necessary to distinguish between a statement on available data, a technical evaluation, and the knowingly false representation of a fact. Working papers, requests addressed to the company, responses received, and any justification for the choice not to formulate reservations are also relevant.
Damage and the type of entity affect the framework. Article 27 provides for different consequences depending on the pecuniary loss caused to recipients and the nature of the entity subject to audit. For this reason, it is incorrect to speak generically of auditor falsehood without identifying the document, the recipients, the content that would have misled them, and the concretely contested effect. The applicable text is in article 27 of legislative decree no. 39 of 2010.
The statutory auditor is not liable as an auditor merely because they control the company. If the audit assignment was entrusted to a different subject, one must avoid transferring responsibilities to the statutory auditor that presuppose the quality of a statutory audit professional. A different allegation for complicity in corporate offences remains possible, but this requires proof of its specific prerequisites and the personal contribution provided.
Tax offences: the corporate role does not replace the author of the tax return
A tax offence requires a personal connection to the fact. Tax allegations may concern, among other things, fraudulent returns, unfaithful returns, omitted returns, or invoices and other documents relating to nonexistent transactions. The legal framework is gathered in legislative decree no. 74 of 2000. The fact that a statutory auditor or auditor examined accounting data does not prove, without additional elements, that they formed, submitted, or shared an unlawful tax return.
The allegation of complicity must explain the contribution. The prosecution may argue that a professional favored the unlawful act through active conduct, a certification, a communication, or a conscious omission. In each hypothesis, the attributed behavior, its relationship with the tax offence, and the elements from which the will to contribute to tax evasion would be deduced must be identified. A generic fiduciary relationship with the directors is not enough to bridge these proofs.
Tax divergences are not all frauds. A tax adjustment, a different classification of an expense, or an error in the return may have fiscal and administrative consequences without automatically demonstrating fraudulent conduct or the controller's complicity. It is decisive to separate the level of tax assessment from the criminal one: they sometimes coincide in the examined facts, but have different prerequisites and proofs.
How to set up a defense without confusing planes
The defense must reconstruct a role, not just contest the accusation. The starting point is to precisely define the assignment: period in office, attributed powers, companies involved, delegations, participation in meetings, and actually available documents. This allows verifying whether the charge concerns a fact that occurred during the assignment and whether the required conduct truly fell within the duties of the statutory auditor or auditor.
Dates often change the evaluation. The formation of the financial statements, the filing of the report, the emergence of the anomaly, requests for clarifications, and any initiatives by the control body must be placed in time. A verbalized dissent, a documented request, or a timely report do not automatically cancel every profile of liability, but they can clarify that there was no adherence to the conduct of others.
Documents must be preserved, not reconstructed afterwards. Minutes, professional correspondence, working papers, requests for information, responses from directors, and versions of the financial statements are useful when they allow verifying what was known and what initiatives were undertaken. One must not modify, delete, or create documents to adapt them to the allegation. If you have received an act or fear an investigation, you can contact me to frame the contested role and relevant documents in compliance with defensive guarantees.
Civil liability does not resolve criminal liability, and vice versa
The two planes have different prerequisites. The civil liability of the statutory auditor concerns damages caused by the violation of duties connected to the position; criminal liability instead requires the ascertainment of the offence and the mental element required by the single rule. The amendment to article 2407 of the civil code, which entered into force in 2025, now also governs limits on the compensatory liability of statutory auditors outside of cases of intent. However, it does not transform those limits into a rule on criminal imputation.
The same affair can produce different issues. The company, shareholders, or creditors may discuss damages; the tax authority may carry out an assessment; the public prosecutor may hypothesize a corporate or tax offence. The facts may overlap, but one cannot deduce a criminal conviction from the mere existence of a claim for damages nor, conversely, exclude every civil profile because a criminal allegation is missing. The text of article 2407 of the civil code reformed by law no. 35 of 2025 helps distinguish the compensatory issue from the criminal one.
The qualification of the charge guides choices. Before assuming it is a "corporate fraud," one must read the rule indicated in the act and identify the contested fact. A falsehood in the audit report, complicity in false corporate communications, and complicity in a tax offence require different analyses, because subjects, conducts, relevant documents, and the psychological element to be proven change.
Frequently Asked Questions
Can I be investigated just because I was a statutory auditor of the company?
No, the position alone is not enough. The investigation may concern you because the board of statutory auditors has supervisory duties, but criminal liability requires the ascertainment of personal conduct connected to the offence and the required mental element. The period in office, exercisable powers, information received, and concretely adopted initiatives matter.
Does a dissent minute shield me from any liability?
Dissent is an important element, not an absolute guarantee. It can demonstrate that you did not adhere to the decision and that you reported a criticality. However, it must be specific, consistent with known facts, and accompanied by the initiatives that the role required in that situation. A merely formal dissent may not clarify a subsequent omission.
What are red flags for a statutory auditor or auditor?
They are anomalies that may require deeper investigation. They may concern contradictory data, undocumented transactions, hard-to-recover receivables, irregular records, or unverified responses from directors. However, there is no list that makes every anomaly proof of intent: their clarity, gravity, repetition, and cognizability in the concrete case must be evaluated.
Does a tax assessment also prove the auditor's offence?
No, the two assessments do not coincide. A tax adjustment may be an element to examine, but it does not automatically prove either the tax offence or the auditor's complicity. For the latter, a concrete contribution to the unlawful conduct and the necessary elements to attribute intent and will required by the allegation must emerge.
Which documents are most useful to clarify my position?
Documents that fix times and available information are most useful. Minutes, reports, requests for clarifications, directors' responses, working papers, professional communications, and versions of the financial statements can be relevant. They must be preserved in their integrity: they must not be modified, artificially selected, or retroactively produced to adapt them to the investigation.