Cybersecurity risks disclosure and implied audit risks: Evidence from audit fees

This study examines the association between companies' cybersecurity risk disclosures and audit fees. Based on a sample from 2005 to 2018, we find that companies' audit fees are not only influenced by the content (number of words), but also by the language (readability and litigious language) disclosed in their cybersecurity risk disclosures. We extend prior studies and find that audit firms assess audit risks not just by evaluating actual cyber breach incidents, but also the cybersecurity risks disclosures more generally. The implication is that the auditor incorporates into their risk assessments, and accordingly their fee structures, the nature and content of cybersecurity risk disclosures. In general, more readable disclosures can reduce audit fees and perhaps other monitoring costs incurred by SEC registrants.