Are External Auditors Concerned About Cyber Incidents? Evidence from Audit Fees

While the importance of addressing cybersecurity risks and cyber incidents is widely acknowledged, there is no explicit requirement by regulators or audit standard setters for auditors to do so. This paper investigates 1) whether external auditors respond to cyber incidents by charging higher audit fees, 2) whether they anticipate and price material cybersecurity risk before cyber incidents occur, and 3) whether increases in audit fees for firms experiencing a cyber incident in the current period are associated with subsequent cyber incidents. We define cyber incidents as cyber-attacks that are initiated by hackers as distinct from various other information security and privacy breaches where the consequences are far less severe than those resulting from attacks by hackers. We find that only cyber incidents are associated with increases in audit fees and that the association is driven by more severe incidents. We also provide some evidence that increases in audit fees are smaller for firms with prior cybersecurity risk disclosure after 2011 when the SEC issued cybersecurity disclosure guidance. Finally, larger increases in audit fees for firms experiencing cyber incidents in the current period are associated with a lower likelihood of subsequent cyber incidents