For someone who is conducting a security audit. Can the security auditor be liable for any security breaches?
Professionally competent auditors having exercised due care generally cannot be held liable for a security breach due to undiscovered vulnerabilities
The main reasons for this are explained below.
Reasonable assurance vs. absolute assurance
An inherent limitation of any audit is that assurances they provide are reasonable and not absolute based on the evidence gathered by the auditor. It is not possible to achieve absolute assurance. As long as auditors follow professional audit guidelines and properly document their work, they are ordinarily protected. It would be not be feasible for an auditor to guarantee absolute assurance in that all security vulnerabilities will be found, due to constraining factors such as audit resources allocated, management cooperation etc.
The same can be said for security controls in that such controls only mitigate but not completely eliminate risks, otherwise defined as an threat exploiting a vulnerability. The extent to which risk mitigation is achieved is mainly a function of how well the control is designed and operating. I said mainly in the previous sentence because even if a particular security control (example: Segregation of Duties) is both designed and operating effectively, human collusion or management override can render the security control ineffective.
Management Control over security controls
A security audit (or any audit) cannot by itself prove anything other than an audit was done. The main reason is that security controls, as a subset of the internal controls of a company, is overseen and owned by management of that company. Auditors, as external independent actors, cannot attest to security controls not subscribed to by management. Therefore, auditors may only attest to the assertions of company management management, and if necessary security controls to achieve particular principles are missing or inadequate, should qualify their opinion issued to management. It is management who ultimately can decide to secure an organization, not the security auditor.
Short answer is no they cant for standards such as ISO 27001 etc. PCI on the other hand can have penalties and that is why assessment organisations are prescribed minimum insurance coverage.