Audits: preserving legal privilege when auditors request information

17 June 2022

Disclosing information to an auditor risks waiving privilege over legal advice and related material, thereby potentially exposing the material to the world at large – including class action plaintiffs.

Courts have found that disclosure of pre-existing privileged material to an auditor will not result in a waiver at large if conditions of confidentiality and privilege are maintained and it is made for the limited purpose of the audit (limited waiver).[1] When access to privileged information is requested, we recommend deploying an incremental approach where privileged material is only disclosed to the extent necessary and care is taken throughout the process to preserve privilege.

Australian companies (other than small proprietary companies and certain companies limited by guarantee) must have their accounts (or financial report) audited at the end of every financial year. In conducting this process, an auditor will often request access to a company’s legal information or documents to allow the auditor to have the comfort and assurance necessary to issue an unqualified report.

This creates competing pressures on the audit client – on the one hand, achieving an unqualified audit report and on the other, maximising the preservation of privilege. Disclosure of privileged information to an auditor might make that act of disclosure vulnerable to attack from litigants, regulators and class action plaintiffs, all of whom are increasingly seeking access to material disclosed to auditors or third parties. Although the risk of exposing the material cannot be eliminated, it can be greatly mitigated.

Legal privilege

Broadly, documents[2] will be protected by legal professional privilege in two forms:

advice privilege, where the confidential communication (or document recording the communication) was prepared for the dominant purpose of providing legal advice to the client; or
litigation privilege, where the confidential communication (or document recording the communication) was prepared for the dominant purpose of use in litigation or anticipated litigation.

Is the material privileged in the first place?

It can be easy to assume that advice prepared by lawyers in relation to a client is automatically privileged but that is not the case.

When determining whether privilege exists, courts will look to the ‘dominant purpose’ of the advice. In the context of audits, if the dominant purpose of the communication of the advice is not to provide the client with legal advice, but rather to provide advice directly to the auditor, then the document or communication will not attract privilege in the first place.

This situation can arise where auditors request in-house or external lawyers to provide information about legal matters such as by ‘solicitor’s representation letters’.[3] That information will not be privileged because the solicitor’s response is provided directly to the auditor (and therefore not for the dominant purpose of advising the client) and for the dominant purpose of the audit process.

This principle was settled in the case of 789TEN Pty Ltd v Westpac Banking Corporation Ltd[4] where the lawyers prepared an advice in relation to litigation that was on foot for provision directly to the auditors, which the court considered not to be privileged.

Is it necessary to provide privileged material to the auditor?

Under section 310 of the Corporations Act 2001 (Cth), an auditor has a right of access at all reasonable times to the books of the company and to require any officer to give the auditor information, explanations or other assistance for the purposes of the audit, so long as the request is reasonable.

Even if the material is privileged, the best protection at the outset is to not simply provide the auditor with blanket access to that material. Companies should work with the auditor to test what information the auditor will require to be able to form the necessary audit opinion before providing any privileged material. It may be that assurance can be achieved without disclosing (or only disclosing minimal) privileged information.

Waiver – privilege is only as strong as its weakest link

If it is necessary to disclose privileged material to the auditor, then it is critical to make sure that appropriate measures are in place to preserve (and not waive) privilege.

Waiver of privilege arises where there is inconsistency (informed by considerations of fairness) between the conduct of the entity entitled to the benefit of the legal advice and maintenance of the privilege.[5]

Is privilege waived by providing the material to the auditor?

Waiver of privilege can be limited so that it applies only in relation to particular persons, materials or purposes.[6] More recently, courts have specifically recognised that a limited waiver can be established in the context of disclosing privileged material to an auditor, which will not be seen as a waiver ‘at large’ – and thus will preserve privilege over the material against the rest of the world – if parties other than the auditor later seek access to the material.

In the case of In the matter of Northern Energy Corporation Limited,[7] the NSW Supreme Court found that, while each case will turn upon its facts, disclosure of confidential legal advice to a company’s auditor will not result in waiver of the confidential legal advice beyond the auditor where conditions of confidentiality and privilege are maintained and where the advice is disclosed for the limited purpose of the audit.[8]

In that case, the company had retained the auditor and the auditor had agreed to maintain confidentiality of the material, the company disclosed legal advice (which it had previously obtained from external lawyers) to the auditor for the purpose of the audit, and privilege and confidentiality had been maintained in respect of the advice. As such – the waiver of privilege was limited as between the auditor and company, and not any wider.[9]

As to what was disclosed - the auditor received both pre-existing privileged documents, and oral briefings (from the solicitor for the audit client) concerning privileged advice previously provided to the audit client and a file note prepared of that oral briefing. The rule in 789TEN Pty Ltd v Westpac Banking Corporation Ltd did not apply- as nothing new was created for the auditor. The contents of the pre-existing legal advice to the client were disclosed to the auditor.

Is privilege waived if the auditor refers to the advice in their report?

Once the privileged material has been disclosed to the auditor, there is a further risk of the privilege being waived (or the otherwise confidential information becoming public) as a result of the auditor referring to the advice in the auditor’s report.

While reference to the mere existence of the privileged material will not constitute waiver, the question is whether the substance, gist or contents of the advice are relied upon or “laid open to necessary scrutiny” such that there is an inconsistency between the company’s conduct and the maintenance of privilege.[10] If the substance or gist has been disclosed, then privilege may be waived.

It is important that the auditor’s report does not disclose the contents of the legal advice, or matters such as what the legal considerations were, what legal conclusions were reached, or whether legal advice was obtained in-house or externally.[11]

Preserving privilege – how to proceed?

When disclosing confidential material to an auditor, companies should take a careful incremental approach to disclosing that information.

That approach should have the aim of allowing the auditor to achieve the assurance required without disclosing to them (or only disclosing the minimum necessary) privileged information.

Where privileged information will be disclosed, companies should adopt careful and clear measures including entering into an express written agreement with the auditor (in addition to the audit engagement terms) which clearly records, in particular:

that the auditor is under obligations of confidentiality;
the limited purpose for which the material is being disclosed;
that the auditor will secure the material (or notes about its contents) within its audit files and workpapers in a fashion consistent with the preservation of privilege;[12]
a recognition that the audit client does not waive privilege over the material;
that neither the contents of the documents nor the information contained in them will be disclosed in the auditor’s report; and
if permitted by legislation,[13]that the audit firm will notify the audit client if any third party or regulator seeks access to those documents and shall:
- identify to the regulatory body that the audit client asserts a claim for legal professional privilege over those documents; and
- provide the audit client an opportunity to assert a claim of legal professional privilege over those documents.

_[1]_{In the matter of Northern Energy Corporation Limited [2020] NSWSC 1073.}

_{[2] Whilst the cases and evidence Acts speak of communications, it is accepted that this also applies to documents created for the purpose of seeking or receiving the legal advice or submission to the lawyers to assist them in their task.}

_{[3] A template letter is contained in Australian Auditing Standard ASA502 at page 16.}

_{[4] [2005] NSWSC 123 (appeal dismissed in Westpac Banking Corporation v 789Ten Pty Ltd (2005) [2005] NSWCA 321).}

_{[5] Mann v Carnell (1999) 201 CLR 1.}

_{[6] Goldberg v Ng (1995) 185 CLR 83.}

_{[7] [2020] NSWSC 1073.}

_{[8] In the matter of Northern Energy Corporation Limited [2020] NSWSC 1073 at [70] and [83].}

_{[9] In the matter of Northern Energy Corporation Limited [2020] NSWSC 1073 at [74]-[83].}

_{[10] DSE (Holdings) Pty Ltd v InterTAN Inc (2003) 135 FCR 151 at [61]; In the matter of Northern Energy Corporation Limited [2020] NSWSC 1073 at [57] and [84].}

_{[11] In the matter of Northern Energy Corporation Limited [2020] NSWSC 1073 at [84].}

_{[12] If possible consider a prohibition on auditor file notes of any oral briefing being kept on the file. Auditors have obligations to maintain appropriate evidence which supports their audit work – so this may not be possible. In such a case, an express obligation should be agreed that the audit team will clearly mark that record on its face as being legally privileged, and on what basis. Clearly marked documents can be easily identified in any subsequent privilege review. Attempts to access the documents may occur many years later when the importance of the legal advice and the steps taken to carefully protect it have faded from memory.}

_{[13] Investigations conducted by some regulators expressly prohibit the recipient of a notice to produce materials to disclose the existence of that notice, or the nature of the document sought to any third party.}

Authors