Does Client Cyber-Breach Have Reputational Consequences for the Local Audit Office?

Abstract

SYNOPSIS We examine whether the public disclosure of a client cyber-breach hurts the reputation of the engagement office of the incumbent auditor. Prior research suggests that alleged client misconduct (even if unrelated to accounting) can hurt the auditor's reputation and bargaining position vis-à-vis other clients. In contrast, in a client cyber-breach, the client is the victim of misconduct rather than perpetrator of the misconduct. Still, for the 100 largest breaches during 2005–2018, we find evidence of a loss in the perceived value of the audit for the non-breach clients of that local audit office. For our sample of all breaches during 2005–2018, our results indicate a decline in the bargaining position for the incumbent audit office. We contribute to the literature by documenting that the negative effects of a cyber-breach are not limited to the breached client but spillover to the local audit office.