Are External Auditors Concerned about Cyber Incidents? Evidence from Audit Fees

TLDR

While the importance of addressing cybersecurity is widely acknowledged, there is no explicit regulatory or standard‑setting requirement for auditors to do so. This study examines whether external auditors adjust audit fees in response to cyber incidents, price material cybersecurity risk before incidents, and whether fee increases for current‑period incidents predict future incidents. Audit fees increase only after cyber incidents, particularly severe ones; the increase is smaller for firms with prior cybersecurity disclosure after 2011, and larger fee hikes for current‑period incidents are associated with a lower likelihood of subsequent incidents.

Abstract

SUMMARY While the importance of addressing cybersecurity is widely acknowledged, there is no explicit requirement by regulators or standard setters for auditors to do so. This paper investigates (1) whether external auditors respond to cyber incidents by charging higher audit fees, (2) whether they anticipate and price material cybersecurity risk before cyber incidents occur, and (3) whether increases in audit fees for firms experiencing a cyber incident in the current period are associated with subsequent cyber incidents. We find that only cyber incidents are associated with increases in audit fees and that the association is driven by more severe incidents. We also find that increases in audit fees are smaller for firms with prior cybersecurity risk disclosure after 2011 when the SEC issued cybersecurity disclosure guidance. Finally, larger increases in audit fees for firms experiencing cyber incidents in the current period are associated with a lower likelihood of subsequent cyber incidents.