An attorney letter in an audit is a formal inquiry the company sends to its outside legal counsel, at the auditor’s request, asking the lawyers to confirm or supplement what management has said about lawsuits, threatened claims, and other legal exposures that could affect the financial statements. Auditing standards treat this inquiry as the primary way to corroborate legal-risk disclosures, because the lawyers actually handling the matters are the only outside professionals positioned to judge how they might come out.1Public Company Accounting Oversight Board. AS 2505 – Inquiry of a Client’s Lawyer Concerning Litigation, Claims, and Assessments The letter narrowly lifts the attorney-client privilege so the auditor can see enough about pending and potential legal matters to judge whether the financial statements handle them correctly. It matters to everyone in the process. A weak or missing response can force the auditor to modify the audit opinion.
Why the Letter Exists
Auditors are not lawyers. They can read board minutes, look at legal invoices, and press management with questions, but they cannot independently judge whether a lawsuit is likely to succeed or what a settlement might cost. That judgment belongs to the attorneys running the matter. The auditing standards recognize the gap and require the auditor to have management send a formal inquiry to every law firm that provided legal services during the audit period.2Public Company Accounting Oversight Board. AU Section 337 – Inquiry of a Client’s Lawyer Concerning Litigation, Claims, and Assessments
The accounting rule driving the letter is ASC 450, which governs how a company accounts for loss contingencies. If a loss is probable and can be reasonably estimated, the company records it on the balance sheet. If it is only reasonably possible (more than remote but less than likely), the company keeps it off the balance sheet but describes it in the footnotes, including an estimated range of loss or a statement that no estimate can be made. Losses classified as remote need neither accrual nor disclosure.
Which bucket a matter lands in changes the numbers. A single word shift, from “reasonably possible” to “probable,” can move a large contingency from a footnote onto the face of the balance sheet, reducing reported earnings. Management makes the accounting call, but the underlying legal judgment has to come from counsel. Without that corroboration, the auditor has no reliable basis to sign off on how contingent liabilities are reported.
What the Letter Asks About
The specimen letter in the auditing standards covers three categories.1Public Company Accounting Oversight Board. AS 2505 – Inquiry of a Client’s Lawyer Concerning Litigation, Claims, and Assessments
- Pending or threatened litigation. Active lawsuits and situations where a potential claimant has signaled an intent to sue. Management provides a description of each matter, how the company is responding, and its evaluation of the likely outcome and any range of loss. The attorney is asked to confirm, disagree, or flag omissions.
- Unasserted claims. Potential claims no one has formally filed yet. The inquiry only asks the attorney to comment on unasserted claims that management has independently determined are probable to be asserted and, if asserted, would have at least a reasonable possibility of an unfavorable outcome. The letter does not ask the attorney to go looking for claims management hasn’t identified.
- Unpaid legal fees. The attorney confirms outstanding legal bills, which the company should have recorded as a short-term liability.
Because each inquiry is directed at a specific firm, it only covers matters that firm has handled. A company using four different firms for different types of work needs four separate letters, and the auditor is responsible for making sure every material engagement is covered.
What the Attorney’s Response Should Contain
For each pending or threatened matter, the response should describe what the case is about, how far along it is, how the company is responding, and the attorney’s evaluation of the likelihood of an unfavorable outcome along with an estimate of loss or a range where one can be made.1Public Company Accounting Oversight Board. AS 2505 – Inquiry of a Client’s Lawyer Concerning Litigation, Claims, and Assessments The response should also flag any matter management left off its list, or state that the list is complete.
For unasserted claims, the scope is narrower. The attorney only comments on matters management has specifically identified and asked about. The American Bar Association’s Statement of Policy discourages attorneys from volunteering information on unasserted claims management hasn’t flagged, because doing so could reveal a client confidence the attorney is ethically bound to protect.3Public Company Accounting Oversight Board. AU Section 337C – Exhibit II – American Bar Association Statement of Policy Regarding Lawyers Responses to Auditors Requests for Information With unasserted claims, the attorney’s role is to confirm or challenge management’s assessment that assertion is probable and that an unfavorable outcome is reasonably possible.
Responses often carry limitations. An attorney might state they have only reviewed matters above a certain dollar threshold, or that they can express no opinion on a particular matter’s outcome. Those limitations matter, because they affect how much reliance the auditor can place on the response.
The Substantive Attention Limit
The ABA policy limits the attorney’s response to matters the lawyer has given “substantive attention” through legal consultation or representation.3Public Company Accounting Oversight Board. AU Section 337C – Exhibit II – American Bar Association Statement of Policy Regarding Lawyers Responses to Auditors Requests for Information The lawyer is not expected to review every transaction the company has ever undertaken looking for unrecognized legal exposure. A firm that handles only employment matters cannot speak to environmental exposure, and its silence on environmental issues is not evidence that no such exposure exists.
Firms with multiple attorneys are expected to make reasonable internal inquiries to identify relevant matters handled anywhere in the firm during the audit period, but that internal check is a practical effort, not a guarantee of completeness. The auditor compensates by sending letters to every firm the company engaged and by independently reviewing legal invoices, board minutes, and correspondence for signs of matters that didn’t surface through the letters.2Public Company Accounting Oversight Board. AU Section 337 – Inquiry of a Client’s Lawyer Concerning Litigation, Claims, and Assessments
Who Does What
The division of labor is sharper than most people expect.
Management identifies every relevant legal matter, working from internal legal department records, outside counsel invoices, board minutes, and correspondence that references actual or potential disputes. Management then compiles the list, drafts the inquiry letter, and signs it. The signature, typically from the CFO or general counsel, is what authorizes the attorney to release confidential information to the auditor.2Public Company Accounting Oversight Board. AU Section 337 – Inquiry of a Client’s Lawyer Concerning Litigation, Claims, and Assessments
The auditor makes sure the list is complete and the letter asks the right questions, usually by providing a template that tracks the specimen format in the standards.1Public Company Accounting Oversight Board. AS 2505 – Inquiry of a Client’s Lawyer Concerning Litigation, Claims, and Assessments The auditor also independently tests the list by reviewing legal expense accounts, reading board minutes for any discussion of litigation risk, and examining internal correspondence. Any significant legal expenditure that doesn’t appear on management’s list becomes a follow-up item.
The attorney’s response goes directly to the auditor, not through management. That direct channel preserves the independence of the evidence; if management could filter the response, the auditor could not rely on its completeness.
Management also has to provide a separate written representation, either in the inquiry letter itself or through the management representation letter, confirming that it has disclosed all unasserted claims the attorney has identified as probable to be asserted and requiring disclosure under ASC 450.2Public Company Accounting Oversight Board. AU Section 337 – Inquiry of a Client’s Lawyer Concerning Litigation, Claims, and Assessments
Privilege Risks and Why Responses Can Look Guarded
The tension at the heart of the process is privilege. Every disclosure the lawyer makes to the auditor risks waiving attorney-client privilege over the underlying communication. The ABA’s Statement of Policy exists to manage that tension, and it explains why some responses read as frustratingly vague.
The risk is real. Disclosing the substance of a confidential client communication to a third party can destroy privilege not just for that statement but potentially for all communications on the same subject.3Public Company Accounting Oversight Board. AU Section 337C – Exhibit II – American Bar Association Statement of Policy Regarding Lawyers Responses to Auditors Requests for Information Anything shared with auditors can land in workpapers, and workpapers can be subpoenaed by regulators or opposing counsel. A detailed attorney assessment of a pending claim can end up being used against the client in that very case.
The ABA policy draws a firm line. For asserted claims, the attorney is the best source and disclosure is appropriate. For unasserted claims, disclosure should be minimal: management should only ask the attorney to comment when management has independently concluded that assertion is probable and that an unfavorable outcome would be reasonably possible and material. The attorney then confirms or challenges the assessment without volunteering extra confidential information. If the attorney becomes aware of an unasserted claim that should be disclosed under ASC 450, the attorney’s professional obligation is to advise the client to make that disclosure, rather than acting as gatekeeper between the client and the auditor.
Timing and Update Letters
The response covers matters through a specific “effective date,” and that date should sit as close to the auditor’s report date as is practical. Aligning the effective date with the expected report date usually avoids the need for follow-up.4Public Company Accounting Oversight Board. Inquiry of a Client’s Lawyer Concerning Litigation, Claims, and Assessments – Auditing Interpretations of AS 2505
When the initial response is dated well before the report date, because fieldwork wrapped up early or the report was delayed, the auditor requests an “update” or “bring-down” letter in which the attorney reports any changes to loss contingencies between the original response date and a more current date.5American Bar Association. Statement on Updates to Audit Response Letters Companies have to evaluate subsequent events through the date the financial statements are issued, and the update letter gives the auditor corroborating evidence for subsequent-events disclosures about legal matters.
If the attorney’s response does not state an effective date, the auditor treats the date of the response itself as the effective date.4Public Company Accounting Oversight Board. Inquiry of a Client’s Lawyer Concerning Litigation, Claims, and Assessments – Auditing Interpretations of AS 2505
When the Response Falls Short
This is where most of the real-world friction lives. A lawyer refuses to estimate a loss. A response calls a material matter “highly uncertain” without classifying it as probable, reasonably possible, or remote. A firm never responds. Each of these limits the evidence available to the auditor, and the standards dictate consequences.
An outright refusal is the most serious. The PCAOB standard treats a lawyer’s refusal to furnish the requested information as a scope limitation sufficient to preclude an unqualified audit opinion.1Public Company Accounting Oversight Board. AS 2505 – Inquiry of a Client’s Lawyer Concerning Litigation, Claims, and Assessments The auditor cannot simply fall back on management’s own assessment; independent corroboration is the whole point of the letter.
Refusal is different from inability. A lawyer who says “I cannot predict the outcome of this specific case at this stage of discovery” is exercising professional judgment, not stonewalling. The auditor evaluates that response in context; if the matter is immaterial, the inability to estimate may not affect the opinion at all.
Where a scope limitation is material but not pervasive, the auditor issues a qualified opinion, stating that the financial statements are fairly presented except for the matter affected. Where the limitation is material and pervasive, the auditor issues a disclaimer of opinion, refusing to express any opinion on the financial statements because the missing evidence is too significant to overcome.6Public Company Accounting Oversight Board. PCAOB Auditing Standards – AS 3105 Departures from Unqualified Opinions and Other Reporting Circumstances
Before reaching either outcome, the auditor should try to resolve the problem. Sometimes the issue is a communication gap rather than a substantive disagreement. A lawyer confused by unfamiliar accounting language may hesitate to respond, and a short conversation about what the auditor actually needs can break the logjam. The auditor might also meet with the attorney and management together to clarify the professional constraints on both sides. If the limitation remains unresolved, the auditor must communicate the issue in writing to the audit committee, explaining the scope limitation and its likely effect on the opinion.
Which Standard Applies
The auditing standard governing this process depends on whether the company is publicly traded. For public companies, the PCAOB’s AS 2505, derived from the earlier AU Section 337, applies.1Public Company Accounting Oversight Board. AS 2505 – Inquiry of a Client’s Lawyer Concerning Litigation, Claims, and Assessments For nonpublic companies audited under AICPA standards, the equivalent requirement is AU-C Section 501. The substance of both is nearly identical: both require the inquiry, both rely on the ABA Statement of Policy, and both treat a lawyer’s refusal to respond as a scope limitation. Anyone drafting or responding to one of these letters should still know which standard governs the audit.