When assessing audit risk, should auditors consider the type and number of third parties that may ultimately rely on the client’s financial statements? Should auditors insist that audit engagement letters identify the third parties to whom the client intends to distribute the audited financial statements? Would this practice eliminate auditors’ legal liability to nonprivity parties not mentioned in engagement letters?