Let me pose a hypothetical case as it relates to Sarbanes Oxley 404 compliance. Suppose that in the course of their review, the external auditors copy the compliance testing workpapers which were prepared by members of the Internal Audit staff.

After issuing an unqualified opinion, a financial scandal erupts in the company, triggering a shareholder lawsuit. During discovery, the external auditors state that they relied on the workpapers of Internal Audit. While this will not be a defense for the external auditors, the attorney tracks down the Internal Audit staff member whose initials appear on the original workpaper stating the procedures were adequate and effective. This staff member also happens to be a CPA and/or CIA.

What is the possibility that this individual staff internal auditor (not a corporate officer or Audit Director) can be named as a party to the lawsuit and be held personally liable on the basis that as a certified professional he had a higher responsibility to ensure that the information was correct. Is this something we should be considering before allowing the external auditors to copy our workpapers?

Taken from auditnet discussions