Statutory Auditor and Management Decisions: How Far Can the Statutory Auditor Go?
One of the situations that most frequently raises doubts in the practice of the statutory audit function relates to the boundary between properly carrying out oversight and supervisory duties and, at the same time, preserving independence from decisions that belong to management.
What happens, for example, when management adopts a decision that does not appear to violate the law or the bylaws, but that could represent a significant risk to the company's financial sustainability? Can the statutory auditor question it? Should the auditor warn about its possible consequences? At what point could an observation become undue interference in management?
On this matter, Opinion No. 0097 of May 19, 2026, issued by the Colombian Technical Council of Public Accountancy (Consejo Técnico de la Contaduría Pública – CTCP), sets out several elements for understanding this boundary.
The first point that must be clear is that the statutory auditor does not replace management. Decisions related to strategy, operations, allocation of resources, investments, contracting or, in general, the management of the company fall to the administrators within the scope of their authority and responsibilities.
For this reason, it is not the statutory auditor's role to determine whether a management decision is the most convenient, efficient or timely one from a business standpoint.
In other words, the statutory audit function should not become a body that approves or disapproves management's decisions.
This is essential to preserving one of the core elements of the profession: independence.
Does this mean the statutory auditor must remain silent?
No.
This is precisely one of the most relevant points in the Technical Council's Opinion.
The fact that the statutory auditor cannot intervene in management does not mean the auditor should refrain from communicating the risks identified in the course of their work.
The CTCP states that, in exercising their oversight and assurance functions, the statutory auditor must timely communicate to the appropriate bodies any situations, circumstances or deficiencies identified that could represent significant risks to the entity.
For example, a management decision may not directly constitute a violation of the law or the bylaws, but it could have significant effects on:
- Financial information.
- The internal control system.
- Liquidity or financial sustainability.
- The going-concern assumption.
- Exposure to certain risks.
- The reliability of processes and controls.
In these cases, communicating the identified risk does not amount to co-management.
Overseeing Is Not Managing
This distinction can be summarized in one simple idea:
The statutory auditor may warn about a risk but must not make the decision that belongs to management.
The Statutory Auditor's Duty to Communicate
Article 207 of the Colombian Commercial Code establishes, among the statutory auditor's duties, the obligation to give timely, written notice to the shareholders' meeting, the board of directors or the manager, as applicable, of any irregularities occurring in the operation of the company and the conduct of its business.
This duty becomes especially important when, in the course of their work, the statutory auditor identifies situations that require the attention of the governing bodies.
In addition, the Assurance Standards apply – particularly ISA 260, on communication with those charged with governance, and ISA 265, on communicating deficiencies in internal control.
Communication should therefore not be seen as a secondary activity of the statutory audit function; it is an integral part of the auditor's professional responsibility.
What Should the Statutory Auditor Communicate?
Not every management decision must be the subject of a communication from the statutory auditor. The criterion should relate to what is identified in the course of the auditor's duties and that may be relevant to the entity.
Among other matters, the following may be subject to communication:
- Significant risks: identified situations that could have a significant impact on the entity.
- Internal control deficiencies: situations in which the controls designed or implemented are not adequate or are not operating effectively.
- Effects on financial information: facts that could affect the integrity, reasonableness or reliability of the financial information.
- Going-concern related situations: circumstances that could create significant uncertainty about the entity's ability to continue operating.
- Irregularities: situations that could represent legal or bylaw non-compliance, or irregularities in the operation of the company.
The key is that the communication must arise from the exercise of the statutory auditor's own duties, not from an intention to direct the company.
Proper Communication Also Protects Independence
There is a mistaken idea that maintaining independence means limiting oneself exclusively to verifying figures and issuing an opinion.
In reality, independence does not prevent the statutory auditor from raising observations, communicating risks or pointing out weaknesses. On the contrary, doing so properly is part of the auditor's professional responsibility.
What must be avoided is allowing the communication to turn into a management instruction.
The Role of Corporate Governance
The Opinion also highlights the importance of the company's governing bodies.
An effective communication from the statutory auditor must reach those who have the responsibility and authority to analyze it and make the corresponding decisions.
This means that the statutory auditor's work does not necessarily end with identifying a situation. It is essential that there be timely, sufficiently documented communication directed to the appropriate body, so that management and corporate governance can evaluate the actions they consider appropriate.
In this way, the control model is strengthened and each party's responsibility remains clearly delimited.
A Balance Between Oversight and Independence
On one hand, the statutory auditor cannot become a manager or take on the responsibility of deciding what is convenient for the company.
Nor can the auditor interpret independence as a reason to remain silent in the face of significant risks identified in the course of their work.
The auditor's responsibility is to observe, evaluate, identify, communicate and, when appropriate, report, within the scope of their professional duties.
Management, for its part, retains responsibility for making business decisions and bearing the consequences that follow from them.
What Should Companies and Statutory Auditors Keep in Mind?
This Opinion is an opportunity to review how communication is being carried out among the statutory audit function, management and the governing bodies.
For companies, it is advisable to have mechanisms in place to receive, analyze and follow up on the observations raised by the statutory auditor.
For statutory auditors, it is essential that communications be properly supported, timely, and clearly distinguish between a professional risk or observation and a recommendation that could be interpreted as a management decision.
Ultimately, a statutory audit function that communicates risks in a timely manner is not managing the company. It is fulfilling one of its essential duties: contributing, from an independent position, to strengthening control, transparency and sound decision-making by those responsible for governance and management.
The statutory auditor does not decide on behalf of management, but neither should the auditor remain indifferent to the risks identified in the course of their work.
True professional independence does not mean staying silent, but rather communicating objectively, in a timely manner and with proper support, matters that fall within the auditor's role, without taking on responsibilities that belong to management.
Within this balance lies one of the greatest challenges of modern statutory auditing: exercising effective oversight, generating value through timely communications and, at the same time, preserving with absolute clarity the independence and limits of the auditor's professional role.
Prepared by: María Angélica Mora – Senior Auditor.
THIS DOCUMENT REFLECTS THE OPINION OF OUR FIRM. TAX AUTHORITIES MAY NOT AGREE WITH OUR POSITION. IF YOU WOULD LIKE TO EXPLORE THIS TOPIC FURTHER OR REQUIRE SPECIALIZED ADVICE ON THE MATTER, PLEASE DO NOT HESITATE TO CONTACT US – WE ARE HERE TO HELP.
