For someone who is conducting a security audit. Can the security auditor be liable for any security breaches?

  • 1
    An auditor or a tester? Auditors shouldnt be doing anything to compromise or test the system, if they spuriously give you a clean bill of health and you are subsequently compromised then depending on the scenario will depend on the if they can be held liable, I would guess that holding them liable in most cases would be very difficult however. As for security/pen testers, if they go outwith the agreed scope and break something then yes they could be held liable. Commented Jul 28, 2017 at 11:24
  • Mainly the role of an auditor, where the audited company has met every criteria, but has then gone on to be breached. Even though there is no such thing as a breach proof IT infrastructure. Commented Jul 28, 2017 at 11:34
  • 1
    That is a matter of agreement/contract between the auditor and the hardware/software owner. We can't answer it.
    – user13695
    Commented Jul 28, 2017 at 12:12
  • No, otherwise it will become a profitable business for some people who hire the services.
    – mootmoot
    Commented Jul 28, 2017 at 13:48
  • Thank you for your responses. As this is a new area for me. Commented Jul 28, 2017 at 13:58

2 Answers 2


Professionally competent auditors having exercised due care generally cannot be held liable for a security breach due to undiscovered vulnerabilities

The main reasons for this are explained below.

Reasonable assurance vs. absolute assurance

An inherent limitation of any audit is that assurances they provide are reasonable and not absolute based on the evidence gathered by the auditor. It is not possible to achieve absolute assurance. As long as auditors follow professional audit guidelines and properly document their work, they are ordinarily protected. It would be not be feasible for an auditor to guarantee absolute assurance in that all security vulnerabilities will be found, due to constraining factors such as audit resources allocated, management cooperation etc.

The same can be said for security controls in that such controls only mitigate but not completely eliminate risks, otherwise defined as an threat exploiting a vulnerability. The extent to which risk mitigation is achieved is mainly a function of how well the control is designed and operating. I said mainly in the previous sentence because even if a particular security control (example: Segregation of Duties) is both designed and operating effectively, human collusion or management override can render the security control ineffective.

Management Control over security controls

A security audit (or any audit) cannot by itself prove anything other than an audit was done. The main reason is that security controls, as a subset of the internal controls of a company, is overseen and owned by management of that company. Auditors, as external independent actors, cannot attest to security controls not subscribed to by management. Therefore, auditors may only attest to the assertions of company management management, and if necessary security controls to achieve particular principles are missing or inadequate, should qualify their opinion issued to management. It is management who ultimately can decide to secure an organization, not the security auditor.


Short answer is no they cant for standards such as ISO 27001 etc. PCI on the other hand can have penalties and that is why assessment organisations are prescribed minimum insurance coverage.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .