Auditors’ Cybersecurity Breach Experience on Non-Breached Clients’ Audit Fees

This study investigates whether auditors’ experiences with their clients’ cybersecurity incidents affect their subsequent audit efforts with non-breached clients and help these clients reduce cybersecurity risks. Using data from the Audit Analytics Cybersecurity database and the Privacy Rights Clearinghouse, we observe that audit offices who have experiences with cybersecurity-breached clients, ceteris paribus , charge higher audit fees from non-breached clients—a phenomenon that only exists in Big 4 auditors and audit offices with IT expertise. Increased audit fees, we also find, are negatively associated with non-breached clients’ future breaches. Our findings suggest that audit offices can successfully leverage cybersecurity experiences to audit engagements. This has important implications for the Public Company Accounting Oversight Board (PCAOB) regarding how auditors can include cybersecurity risks, or specifically prior cybersecurity breaches, in their risk assessments of non-breached clients