Auditor risk and legal liability