Are External Auditors Concerned about Cyber Incidents? Evidence from Audit Fees
研究发现外部审计师会对网络事件做出反应，提高审计费用，尤其是对严重事件；同时，审计费用增加与后续网络事件减少相关。
SUMMARY While the importance of addressing cybersecurity is widely acknowledged, there is no explicit requirement by regulators or standard setters for auditors to do so. This paper investigates (1) whether external auditors respond to cyber incidents by charging higher audit fees, (2) whether they anticipate and price material cybersecurity risk before cyber incidents occur, and (3) whether increases in audit fees for firms experiencing a cyber incident in the current period are associated with subsequent cyber incidents. We find that only cyber incidents are associated with increases in audit fees and that the association is driven by more severe incidents. We also find that increases in audit fees are smaller for firms with prior cybersecurity risk disclosure after 2011 when the SEC issued cybersecurity disclosure guidance. Finally, larger increases in audit fees for firms experiencing cyber incidents in the current period are associated with a lower likelihood of subsequent cyber incidents.