A company that has never appointed a statutory auditor (commissaire aux comptes) may bring a liability claim against the statutory auditor of another company. The commercial chamber holds that a third party to the audit engagement has an interest in bringing a claim for compensation for its personal damage, on the basis of tortious liability, where it attributes that damage to a fault or negligence of the professional in the performance of their duties.
The essentials
- A company that is a third party to the audit engagement may bring a liability claim against a statutory auditor in order to obtain compensation for its personal damage.
- The absence of any engagement given to the statutory auditor does not deprive that company of the right to bring a claim: it relies on tortious liability.
- The solution combines Article 31 of the French Code of Civil Procedure and Article L. 822-17, now L. 821-37, of the French Commercial Code, which makes the statutory auditor liable to the audited entity as well as to third parties.
- Being able to bring a claim does not mean winning it: the fault, the personal damage and the link between the two still have to be established before the court.
- Within a group, each company retains its own right to bring a claim for the damage it personally suffers.
Who could bring a claim against the statutory auditors?
The commercial chamber partially quashes the court of appeal's decision: two companies that had given no engagement to the statutory auditors could nevertheless bring a claim against them. The decision (Com., 11 March 2026, No. 24-21.457) cites Article 31 of the French Code of Civil Procedure and Article L. 822-17, now L. 821-37, of the French Commercial Code. The first opens the claim to those with a legitimate interest; the second governs the liability of the statutory auditor.
Seven companies within the same group brought proceedings against an audit firm and a statutory auditor who is a natural person, seeking damages. Five of them had given them an audit engagement: their accounts were approved without qualification for the financial years 2008 to 2020. The two other companies in the group had no statutory auditor. One claimed to be the direct victim of misappropriations not detected by the auditors. The other relied on the impairment of the accuracy of its own accounts and on its inability to recover the sums owed to it.
The statutory auditors raised a plea of inadmissibility (fin de non-recevoir) based on the lack of standing (qualité à agir) and of interest in bringing a claim of those two companies. The decision under appeal (CA Lyon, 19 September 2024, No. 23/04474) declared their claims inadmissible, on the ground that they had given them no statutory audit engagement.
The commercial chamber rejects that reasoning. Under the provision cited, "statutory auditors are liable, both to the person or the entity and to third parties, for the harmful consequences of the faults and negligence committed by them in the performance of their duties" (free translation). The quashing is partial and the case goes back to the court of appeal in Lyon, differently constituted.
It follows from the combination of those provisions that a third party has an interest in bringing a liability claim against a statutory auditor in order to seek, on the basis of tortious liability, compensation for its personal damage allegedly caused by the fault or negligence of that statutory auditor in the performance of their duties.
What consequences for a company that has not been audited?
A company may seek to hold liable a statutory auditor who has never certified its accounts, provided that it relies on damage that is personal to it. The contractual link is no longer the filter for entry. What matters is the specific damage the company says it has suffered as a result of a fault or negligence committed by the professional in the performance of their duties.
The distinction between the two bases of liability explains the solution. The audited entity brings its claim on the basis of the engagement it has given. The third party, for its part, relies on tortious liability, which compensates damage caused outside any contract. This second basis remains open to a group company whose accounts fell outside the scope of the audit.
That opening dispenses with nothing on the merits. The third-party company will have to establish the statutory auditor's fault or negligence, the reality of its own damage and the link between the two. Within a group, the exercise requires the damage to be individualised: a loss suffered by one company is not automatically the same as that of the other entities within the scope.
Interest in bringing a claim: what is settled and what remains open
The decision settles a question of admissibility, not the liability of the statutory auditors. It confirms that the statutory auditor's liability towards third parties is tortious and that it requires no engagement. It does not say that the professionals concerned committed a fault, nor that the claimant companies will obtain compensation.
The quashing concerns only the inadmissibility of the claims of the two companies that were not audited. The court hearing the remitted case will have to examine those claims on the merits. The commercial chamber also dismissed the third ground of appeal without a specially reasoned decision, pursuant to Article 1014, paragraph 2, of the French Code of Civil Procedure.
One part of the decision under appeal survives: the court of appeal had held that the claims of the five audited companies were time-barred for the financial years 2008 to 2017. It held that liability claims against statutory auditors are subject to a three-year limitation period (prescription) running from the harmful event or, if that event has been concealed, from its discovery. It added that mere negligence by the auditor does not amount to concealment.
How to prepare a claim against a statutory auditor?
Preparation turns on individualising each company's damage, entity by entity. A global claim brought in the name of a group invites debate on the specific damage of each claimant. The court of appeal's reasoning shows that the absence of an engagement primarily serves as a defence argument: the decision discussed here neutralises its effect on admissibility, without neutralising the debate on the merits.
Three lines structure the file. The first is the description of the work actually carried out by the statutory auditor and of its scope. The second is proof of the fault or negligence, having regard to the standards of care expected of the professional. The third is the chain of causation between that breach and the loss relied on by the claimant company.
The question of time deserves particular attention. Liability claims are, in principle, confined within time limits whose starting point depends on the harmful event and, where applicable, on its discovery. Precisely dating the discovery of the anomalies, and keeping the documents that establish it, often determines the rest of the litigation.
Points to check before bringing a liability claim
- Identify, for each company concerned, the damage that is personal to it and the accounting entries that evidence it.
- Reconstruct the exact scope of the engagements given to the statutory auditor and the financial years covered by the certification.
- Place the discovery of the anomalies in time and document that date with dated materials.
- Distinguish, in the argument, what relates to the right to bring a claim and what relates to proving the fault and the causal link.
Frequently Asked Questions
Can a company with no statutory auditor sue the auditor of another group company?
Yes. Under the decision of 11 March 2026, a third party to the relationship between the audited entity and the statutory auditor has an interest in bringing a claim against that auditor. It must seek, on the basis of tortious liability, compensation for the personal damage caused by a fault or negligence of the professional in the performance of their duties. The absence of an engagement therefore no longer closes the courtroom door.
Is a contract with the statutory auditor required to hold that auditor liable?
No, a contract is not a condition of the right to bring a claim. The French Commercial Code makes the statutory auditor liable both to the person or entity audited and to third parties for the harmful consequences of their faults and negligence. A company that has given the auditor no engagement therefore proceeds in tort and must rely on damage of its own.
Does being declared admissible guarantee an award of damages?
No. The decision rules only on the admissibility of the claim, not on its merits. After the partial quashing, the case returns to the Lyon court of appeal, differently constituted, which will examine the claims. The company bringing the claim will still have to establish the statutory auditor's fault or negligence, the reality of its personal damage and the causal link between that breach and that loss.
How can damage personal to one group company be distinguished from the rest?
Proof runs through the accounting individualisation of the damage. Each company must isolate what it has lost: a debt that has become irrecoverable, distorted entries in its own books, a cost wrongly borne. A single global figure presented on behalf of a set of entities is open to criticism, because a group has no legal personality. In principle, only the company that personally suffers the damage may claim compensation for it.
What documents should be gathered before suing an accounting professional?
Start with the documents that define the engagement: the engagement letter, the reports, the certified accounts, the scope and the financial years covered. Next, gather the material establishing the anomaly and its extent, in particular any audit or expert reports produced after its discovery. Finally, keep every dated document showing when the facts came to light: that date often governs the debate on time limits.