{'fraction_non_alphanumeric': 0.02404850313297749, 'fraction_numerical': 0.015026688326757949, 'mean_word_length': 5.4016713091922, 'pattern_counts': {'":': 0, '<': 2, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
The Effect of Auditor Cybersecurity Expertise on Audit Fees and Cyber Incidents.

This study focuses on local audit offices’ cybersecurity expertise and examines the effect of such expertise on non-breached clients’ audit fees and future cyber incidents. Using data on cyber incidents from the Audit Analytics cybersecurity database and the Privacy Rights Clearinghouse for the period from 2006 to 2017, we observe a positive and significant association between auditor’s cybersecurity experience and non-breached clients’ audit fees. This suggests that auditors with greater cybersecurity experience consider cyber risk before any cyber incident has occurred. In addition, we find evidence that the increased audit fees charged by cybersecurityexperienced auditors are negatively associated with non-breached clients’ future breaches and auditor’s IT capability strengthens the association. Collectively, this finding suggests that auditor’s cybersecurity experience is effective in helping clients preventing future cyber incidents and auditor’s IT capability strengthens the effectiveness. Our results remain robust after a battery of


Introduction
Cybersecurity is becoming a great concern to our society after a series of notorious cyber incidents targeting large firms. For example, Marriott International, Inc., a mega hotel chain, was involved in one of the largest data breaches in history, with information such as customer name, address, credit card number, and travel history stolen for up to 500 million customers (Telford and Timberg 2018). According to the latest Data Breach Investigations Report (Verizon 2019), 71 percent of the breaches are financial motivated that are primarily carried out by outsiders (69 percent). More than 20 percent of impacted firms sustained significant loss of revenue and business opportunities (Cisco 2017). Moreover, recent report reveals that criminals who impersonate firm executives instructed employees to make unauthorized fund transfer, a type of cyber-enabled fraud that prompts the SEC to issue an investigative report (SEC 2018c). There is also evidence that attackers steal non-public sensitive information from firms with poor cybersecurity defense for illegal trading (Berkman et al. 2019). Therefore, CEOs exhibit great concern that cybersecurity issue may impede the economic growth of their firms (WSJ 2016). In response to the growing concern of cybersecurity risks, the SEC's Division of Corporation Finance issued cybersecurity disclosure guidance in 2011 and subsequently updated it in 2018, emphasizing the obligation of publicly traded firms to disclose cyber incidents and material risks regarding cybersecurity to investors (SEC 2011(SEC , 2018a. Although the SEC initially restrained its actions against firms, the establishment of "cyber unit" of the SEC's Division of Enforcement clearly indicates that the regulator is becoming more aggressive (Berman et al. 2019).
The ever-expanding cybersecurity risk also challenges the role of external auditors in understanding client's information technology environment (Yen et al. 2018). The Center for Audit Quality (2014) issued an alert to summarize external auditors' responsibilities regarding cybersecurity. The PCAOB (2014) has also formed a panel to discuss cybersecurity issues and the potential implications for financial reporting and auditing. In subsequent years, cybersecurity remains a key issue on each year's inspection report. For example, cybersecurity risk is listed as a key area of focus on PCAOB's inspections outlook for 2019 (PCAOB 2018a). Despite that auditors have very limited role related to cybersecurity under current standards, board member of the PCAOB has been calling on auditors to broadly consider cybersecurity risks that could have a material effect on firms' financial statements, and is questioning "whether the PCAOB's auditing standards should or could require more" (PCAOB 2019a).
In this paper, we examine the spillover effect of cybersecurity experience through auditor offices. Recent studies by Li et al. (2020), Yen et al. (2018) and Smith et al. (2019) have demonstrated that cyber incidents are positively associated with subsequent audit fees, supporting the argument that auditors are broadly considering the implications of cyber incidents on firms' financial reporting practice and control environment even if there is no explicit requirement.
However, it is ex-ante not clear (1) whether auditors are simply responding to a negative event for satisfying regulator's expectation or are systematically considering cybersecurity risks, and (2) whether the experience of responding to cyber incidents can be leveraged to engagements for other clients. To that end, this study investigates the existence of cybersecurity experience spillover by testing the association between cybersecurity experience and audit fees of non-breached clients, and the usefulness of cybersecurity experience by testing the association between increases in audit fees by cyber-experienced auditor office and the likelihood of future cyber incidents for nonbreached clients.
We capture auditor office's cybersecurity experience by using the extent that auditors are exposed to cyber incidents during their audit engagements in the past three years. By utilizing cyber incident data from the Audit Analytics cybersecurity database and the Privacy Rights Clearinghouse, we demonstrate that non-breached clients of cybersecurity-experienced auditor offices would have higher audit fees than clients of auditor offices without cybersecurity experience. Furthermore, the increased audit fees by cybersecurity-experienced auditor offices are associated with lower likelihood of subsequent cyber incidents, providing evidence that cybersecurity experience can successfully be transferred to non-breached clients to improve their cybersecurity risk management. In addition, auditor office's IT capability strengthens the association between audit fee increases for clients of cybersecurity-experienced auditor office and the likelihood of subsequent cyber incidents, revealing that the transfer of cybersecurity experience is contingent on auditor office's IT capability. Our results remain robust after a battery of sensitivity results.
The findings of this study provide several contributions to the literature. First, this paper contributes to the audit expertise literature. Prior studies have documented various types of audit expertise, including industry expertise (e.g., Ferguson et al. 2003;Chin and Chi 2009;Bae et al. 2018), multinational expertise (Gunn and Michas 2018), and IT expertise (Haislip et al. 2016). We enrich the audit expertise literature by identifying auditor cybersecurity expertise, which is developed through audit engagements of breached clients. We empirically demonstrate that such experience can be leveraged to other non-breached clients to improve their cybersecurity risk management and prevent future incidents. To our best knowledge, ours is the first study to investigate auditor cybersecurity expertise and its spillover effect to other audit engagements.
Second, different from prior literature (Lawrence et al. 2018;Smith et al. 2019;Li et al. 2020) that document auditor's responses to existing cyber incidents and its effect on future breaches of breached firms, our findings provide evidence that auditors with greater cybersecurity experience take cybersecurity risk into consideration before cyber incidents occur to clients. Also, the increased audit fees charged by cybersecurity-experienced auditors is associated with lower likelihood of future breaches. This suggests that actions taken by cybersecurity-experienced auditors are effective in preventing future cyber breaches. Therefore, this paper also extends the literature by highlighting auditors' role on firms' information security management.
Third, the findings of our study indicate that auditor with IT expertise is more capable of leveraging its cybersecurity experience in helping clients preventing future incidents. This adds value to the extant IT capability literature that identities firm's IT capability as an important factor in addressing cyber risks (e.g., Kwon et al. 2013;Higgs et al. 2016). Our findings that IT capability facilitates auditors to develop cybersecurity knowledge and to address cyber risks in audit engagements suggests that improving IT capability of audit firms is valuable. To the extent that current research primarily focuses on client firm's IT capability, results in this paper highlight the importance of shifting our attention to auditor's IT skills as well.
Finally, this paper provides timely insights to regulators. The PCAOB has identified cybersecurity threat as a topic of growing concern that warrants attention of public firms and auditors, and has highlighted the importance of cybersecurity risk assessment (PCAOB 2018a(PCAOB , 2018b. Then board members of the PCAOB stated in multiple occasions that auditor must consider any cybersecurity risks no matter whether or not a cyber-incident has occurred (PCAOB 2019a, 2019b). Our findings comfort, at least partially, regulators' concern by providing evidence that auditors with cybersecurity experience consider non-breached clients' cybersecurity risk and their responses are effectively eliminating cybersecurity risk.
The remainder of the study is organized as follows. The next section introduces the research background and develops hypothesis. The third section describes the research design and sample selection. Primary results and robustness tests are reported in the fourth section. The last section concludes this paper.

2.1
Background and literature review The digital economy has made cybersecurity a top priority on regulator's agenda. The Division of Corporation Finance, a branch of the SEC that is responsible for the oversight of disclosure practices, issued a disclosure guidance that highlights the Division's view on disclosure requirement related to cybersecurity. Realizing that the prior guidance is non-authoritative, the commission itself further provided guidance in 2018 to expand and interpret the 2011 cybersecurity disclosure guidance (SEC 2018a(SEC , 2018d, with the intention to promote more transparent disclosure about cybersecurity risks and incidents to investors and to deter potential insider trading activities resulting from material, non-public cybersecurity information (EY 2018).
Till today, the PCAOB has not yet issued any legislative rulings specific for cybersecurity, but is closely monitoring how engagement teams evaluate the risks of material misstatement and associated control issues following a cyber incident (PCAOB 2015(PCAOB , 2016. PCAOB's inspection outlook for 2019 also placed cybersecurity risks as one of the top 10 key areas of inspection focus (PCAOB 2018a). Kathleen M. Hamm, the then board member of the PCAOB, has urged auditors to "understand the methods used by the company to prevent and detect cyber-incidents that could have a material effect on the financial statements" (PCAOB 2019b).
Academic research on cybersecurity in the accounting and finance domain can be broadly categorized into three types. The first stream of research focuses on the economic consequence of cybersecurity breaches. Early studies that examine market reaction to publicly announced data breaches tend to find a negative impact (e.g., Campbell et al. 2003;Goel and Shawky 2009;Hinz et al. 2015). Ettredge and Richardson (2003) and Hinz et al. (2015) reveals that there exist spillover effects of data breaches. Share prices of firms in the same industry or similar firms are also negatively influenced. However, some research work fails to find such association (e.g., Hilary et al. 2016;Richardson et al. 2019). Both Gordon et al. (2011) and Richardson et al. (2019) argue that the inconsistent results can be explained by difference in sample, selection criteria, and research method. In addition to examining market valuation, a limited but growing number of studies are investigating the impact of cyber incidents on audit engagement. Lawrence et al. (2018) reveal that data breaches are positively associated with subsequent audit fees, restatement, SEC comment letters, and ICFR. Smith et al. (2019) find that increase in audit fees are driven only by data breaches that are initiated externally, and that the audit committees and board-level risk committees can mitigate the fee premium. Yen et al. (2018) suggests that the association between audit fees and cyber incidents are moderated by characteristics of the audit firm, including industry expertise, tenure, and whether the audit firm is one of the big 4. A more recent study by Li et al.
(2020) systematically evaluates auditor's effort in addressing cybersecurity risks and reports that auditors price cybersecurity risks ex-ante, respond to severe cyber incidents ex-post, and that such effort is negatively associated with subsequent cyber incidents.
The second stream of research concentrates on the mitigation of cybersecurity risks. Kwon et al. (2013) shows that the involvement of IT executives in the top management team and the relative pay status of IT executives can enhance firm's IT governance and are negatively associated with cyber incidents. Similarly, Zafar et al. (2016) finds that placing CIO in the top management team can help firms better recover from the economic consequence of cyber incidents. Higgs et al. (2016) reports that firms with board-level technology committee are more likely to be breached, but the association is driving by relatively younger committees. In addition, the presence of technology committee can mitigate the negative market reaction following cyber incidents. Several studies particularly focus on the role of internal auditors in mitigating cybersecurity risks. By conducting interviews, Steinbart et al. (2012) concludes that the nature of relationship between internal audit function and information systems security function differs at different firms. The study is further extended by Steinbart et al. (2013), which shows that a good relationship between these two functions improves the perceived effectiveness of firm's cybersecurity management program. Using a unique dataset, Steinbart et al. (2018) empirically demonstrates that a good relationship between these two functions has a positive impact on the number of security incidents detected both before and after these incidents cause harm to the firm, suggesting that firms should cultivate a collaborative relationship between these two functions as an effective to improve cybersecurity.
The third stream of research centers on the disclosure of cybersecurity-related issues. Early empirical work by Gordon et al. (2006) provides evidence that voluntary disclosure of information security activities increased over 100 percent after the passage of SOX. A follow-up study by Gordon et al. (2010) demonstrates the market positively value the voluntary disclosure concerning information security. Specifically, disclosures of proactive security activities have the largest positive impact on market valuation, followed by the disclosure of security vulnerabilities. Wang et al. (2013) reveals that firms which voluntarily disclosed risk-mitigation themes are negatively associated with the likelihood of future data breaches, suggesting that firms disclosing countermeasures are indeed taking actions to address cybersecurity risks. A subsequent study by Li et al. (2018) examines the usefulness of cybersecurity-related risk factor disclosures and finds that both the presence and length of risk factor disclosures concerning cybersecurity in the Item 1A section of firm's annual reports are related to future reported cyber incidents, but the association between the presence of such risk factor disclosures and future incidents disappears after the passage of cybersecurity disclosure guidance, implying that the disclosure guidance may encourage firms with low cybersecurity risks to make such disclosures. Ettredge et al. (2018) identifies that firms mentioning the existence of trade secrets are more likely to be breached than other firms, especially for younger firms, firms with fewer employees, and firms in less concentrated industries. Amir et al. (2018) reports that managers will only disclose an existing cyber incident when investors are quite confident that an attack has happened. Furthermore, they find that withholding cyber incidents are severely punished by the market when the incident is subsequently discovered by sources other than the breached firms, while directly disclosing cyberattacks are associated with a substantially lower decline of market value. Berkman et al. (2018) develops a measure to capture the extent and relevance of disclosure regarding cybersecurity, and empirically demonstrates that cybersecurity awareness is positively valued by the market. Finally, with weak cybersecurity controls, indicating that weak cybersecurity risk mitigation may be exploited by attackers to gain unfair advantage in the financial market.

Hypothesis development
Our first hypothesis attempts to link the association between auditor cybersecurity experience and audit fees of non-breached clients. We argue that audit fees for non-breached clients would be higher when the auditor office has cybersecurity experience because (1) auditor offices with cybersecurity experience have incentives to charge a fee premium for being expertise on addressing cybersecurity risks, and because (2) cybersecurity-experienced offices are likely to expand their audit procedure to assess and reduce cybersecurity risks due to reputational concerns.
With respect to the first incentive, auditor offices can accumulate deep knowledge of cybersecurity risks and the proper response to those risks when their clients fall the victim of such attacks. For example, after an incident occurs, auditors need to understand the internal and external environment of cybersecurity, evaluate the potential access points into information systems, and identify firm's common practices that prevent and detect unamortized access to systems and information assets (PCAOB 2019b). Generally, audit firms modified their audit approaches or procedures to address the potential impact on relevant controls and the data generated by the company's IT systems and some audit offices have also established a group of cybersecurity experts to serve as specialist to address cybersecurity risks (PCAOB 2019d). The time and effort by the auditor office to understand the determinants and consequences of cyber incidents are arguably valuable for other clients as well because malicious hackers usually employ the same or similar methods to target different firms (PCAOB 2019c). Although it is likely that audit firms have internal trainings regarding how to respond to cybersecurity risks and incidents after the SEC and PCAOB repeatedly emphasized cyber threats (e.g., SEC 2018a; PCAOB 2019d), prior research has documented that offices primarily develop their expertise in directly serving clients.
That is, indirect experience such as training and education is less effective than direct experience that is gained from interacting a breached client (Solomon et al. 1999;Zacks et al. 1982;Hasher and Zacks 1979). Therefore, auditor offices whose clients has experienced cyber incidents are likely to be expertise in addressing cybersecurity risks than other auditor offices. Since the auditing pricing literature indicates that office-level industry expertise generates an audit premium (Ferguson et al. 2003;Francis et al. 2005), it is thus reasonable to conjecture that auditor office's cybersecurity experience will result in fee premium in a similar way. attention to other clients' cybersecurity risk and exert additional efforts to address such risk, leading to an increase in audit fees.
It is arguable that audit fees are not solely determined by auditors but reflect a negotiation between the management and the auditor (Abbott et al. 2003). In fact, anecdotal evidence suggests that auditors have difficulty raising audit fees due to intense completion for new clients (Richardson et al. 2019). However, as SEC has repeatedly emphasized cybersecurity (SEC 2011(SEC , 2018b(SEC , 2018a, firms are under greater pressure complying with SEC's cybersecurity disclosure guidance and also urgently demand assistance in evaluating cybersecurity controls 2 . Since auditors are more capable of identifying control issues than managers (Bedard and Graham 2011), their expertise may help the manager to improve the preparedness for cyberattacks (Li et al. 2020), it is therefore understandable that increase in audit fees resulting from cybersecurity risk evaluation would be acceptable for managers.
Despite the above arguments that would suggest a positive association between cybersecurity experience and audit fees of non-breached clients, Richardson et al. (2019) pointed out that these risks have long been known and thus have already been priced into audit fees regardless of cybersecurity experience. Furthermore, Yen et al. (2018) argues that industry expertise can help auditors better assess cybersecurity risks and evaluate cybersecurity management processes with less effort, which implies that we would expect a negative association.
Therefore, we introduce our first hypothesis in the alternative form: H1: Ceteris paribus, audit fees would be higher for non-breached clients of audit offices with cybersecurity experience than for those clients of audit offices without cybersecurity experience.
The second hypothesis focuses on the value relevance of increased audit fees for cybersecurity experience. That is, whether the increase in audit fees for non-breached clients of cyber-experienced auditor offices is associated with lower likelihood of future cyber incidents. Li et al. (2020) find that raise in audit fees for breached firm is associated with fewer subsequent incidents for the same breached firm, suggesting that the additional fees charged by auditors at least partially reflect audit effort that could address cybersecurity risks. However, it is ex-ante not clear whether the experience of directly responding to cyber incidents can be successfully transferred to engagements for other clients. Auditing literature has provided ample evidence that there is spillover effect of audit quality among clients of the same auditor offices (Li et al. 2015). Francis and Michas (2013) present that the audit failure for one client could be indicative of audit failure for other clients within the office. In other words, auditor office could serve as an effective channel, through which similar-quality audits spillover to other client firms within the same office due to similar office-level auditing procedure, quality-control standard, cognitive style, tolerance for aggressive accounting practices, and other unobserved factors (Francis and Michas 2013;Krishnan 2005).
Specific to cybersecurity, auditor offices are likely to train their employees with cyberspecific knowledge after interacting with breached clients, which can be used in other engagements.
We therefore expect that: H2: Ceteris paribus, increase in audit fees for clients of cybersecurity-experienced audit office is negatively associated with the likelihood of future cyber incidents.
Our last hypothesis concentrates on the effect of auditor office's IT capability on the transfer of cybersecurity experience. Auditor's IT capability is defined as auditor's expertise in firm's financial reporting environments that heavily dependent on IT (Haislip et al. 2016). Prior studies consistently find that client's IT capability is an important factor in addressing cyber risks.
For example, firms are less likely to experience cyber incidents when there is a CIO position in the firm, when the IT manager has greater power, and when there are more established technology committees (Kwon et al. 2013;Higgs et al. 2016). In addition, IT ability of a peer firm can moderate the contagion effect of a cyber incident (Kashmiri et al. 2017). To our context, auditors with greater IT knowledge including the understanding of information security will better assess client's control systems, especially IT-related elements. Given cyber breaches are inherently related to firms' IT related controls, we expect that auditor offices with better IT capability to be more successful in applying knowledge of interacting with breached clients to other non-breached clients. This leads to our third hypothesis: H3: Ceteris paribus, the association between increase in audit fees for clients of cybersecurityexperienced auditor office and the likelihood of future cyber incidents is moderated by auditor office's IT capability.

Model specification
Since auditors are required to assess the nature and extent of the incident for breached firms and evaluate its impact on firm's operations and financial performance (PCAOB 2019), auditor office with more clients experiencing cyber incidents would accumulate greater expertise on cybersecurity. Therefore, we proxy auditor's cybersecurity experience by using the extent that auditors are exposed to cyber breaches during their audit engagements following the logic that auditor industry expertise is developed through audits within an industry (e.g., Ferguson et al. 2003;Chin and Chi 2009). In addition, suggested by prior literature that IT-related capability may be developed over time and auditors' IT expertise is measured using the previous three years' experience (Haislip et al. 2016;Huang et al. 2018), we define auditor cybersecurity experience as the total number of times that clients of an audit office experienced cyber incidents in the previous three years, scaled by the total number of clients of that audit office 3 .
In addition, we capture auditor cybersecurity experience at the local office level for two reasons. First, prior literature has well documented that the office-level characteristics including audit quality and expertise exhibit significant variation. Second, the local office has significant autonomy and is largely responsible for personnel assignments, audit engagements administering, and many other strategic functions. This is also consistent with recent literature that focuses on audit quality and audit expertise at the local office level ( (2) Our focus is the interaction term CyberExp*∆ . A negative coefficient would suggest that higher audit fees charged by auditors with cybersecurity experience are associated with a lower likelihood of future cyber incidents, demonstrating the spillover effect of experience in cybersecurity. Appendix A presents detailed definitions of all variables.

Sample selection
The cyber incident data is obtained from the Audit Analytics cybersecurity observations audited by auditors without cyber-incident experience. Table 1 presents the sample selection process.
(Insert Table 1 here)  (Insert Table 3 here) Table 4 presents the test of H2 regarding the likelihood of future breaches. The interaction term CyberExp*∆ is significantly negative (p<0.05), indicating that increased audit fees charged by auditors with more cybersecurity experience are negatively associated with cyber breaches in the following year. This suggest that auditor's cybersecurity experience is effective on preventing future breaches, supporting our second hypothesis.
(Insert Table 4 here) Third hypothesis measures the moderating effect of auditor IT expertise. We follow Haislip et al. (2016) to proxy auditor IT expertise using the InformationWeek database, which identifies clients' IT capability (e.g., Santhanam and Hartono 2003;Chae et al. 2014;Huang et al. 2018).
Because with more clients having greater IT capability, auditors are exposed to more IT integrated systems and have a greater understanding of IT through the clients that they audit. Specifically, auditor IT expertise, ITExp, is the total number of clients who are identified as high-IT-capability firms, scaled by the total number of clients of each local office per year. Table 5 presents the moderating effect of auditor IT capability on future breaches. The interaction term CyberExp* ∆ *ITExp is negative and significant (p<0.05), demonstrating that auditor with IT expertise is more capable of leveraging its cybersecurity experience in helping clients preventing future incidents. The results support our third hypothesis. Collectively, the results of Table 5 imply that auditor's IT expertise is the driving force for the spillover of cybersecurity experience. Although we don't expect any moderating effect on the association of cybersecurity expertise and audit fees, untabulated results show a positive but non-significant coefficient on CyberExp*ITExp, implying that cybersecurity-experienced auditors raise audit fees at similar levels regardless of their IT expertise.
(Insert Table 5  However, the moderating effect of auditor IT expertise is only marginally significant (p=0.14).
Overall, the results using PSM sample are weaker in statistical significance but mainly consistent with our main models.

Alternative measures
Instead of measuring auditor cybersecurity experience based on the number of clients who had cyber incidents, we use alternative proxy based on total audit fees of clients who had cyber incidents in past three years, scaled by total audit fees for each audit office. Untabulated results are robust to our main findings.
Although we believe that auditor cybersecurity experience may be developed over time and it is measured based on three years' experience, we calculate alternative measures based on one-or two-year experience and rerun our models. Generally, we observe statistically weaker but similar results, which consistent with our expectation that auditor's cybersecurity experience is accumulated over time.

Concluding Remark
Cybersecurity threat is a topic of growing concern among public companies, investors, regulators, auditors, and others. This study focuses on auditor's cybersecurity experience at the local office level and examines the effect of such experience on audit engagements. Using data on cyber incidents from the Audit Analytics cybersecurity database and the Privacy Rights Clearinghouse for the period from 2006 to 2017, we measures auditor cybersecurity experience as the total number of times that clients of an audit office experienced cyber incidents in the previous three years, scaled by the total number of clients of that audit office. Then, we observe a positive and significant association between auditor's cybersecurity experience and non-breached clients' audit fees. This suggests that auditors with greater cybersecurity experience consider cyber risk before any cyber incident has occurred. In addition, our findings provide evidence that the increased audit fees charged by cybersecurity-experienced auditors are negatively associated with future breaches, implying that such experience is effective in helping clients preventing future incidents. Finally, auditor's IT capability strengthens the association between audit fee increases for clients of cybersecurity-experienced auditor office and the likelihood of subsequent cyber incidents. This finding suggests that auditor's IT expertise is the driving force for the spillover of cybersecurity experience.
Our study is subject to several limitations. First, since we consider only publicly available cyber incidents, our sample size for cyber incidents is small. It is possible that some cyber breaches are not disclosed to the public or not are not discovered by the victim itself. Additional cyber breaches dataset might be helpful to supplement our findings. Second, although we believe that auditors accumulate experience through prior audit engagements and charge higher audit fees due to their cybersecurity expertise, our empirical study cannot completely rule our other reasons.
Other type of research such as interview or case study may help us build a comprehensive understating.

Variable Definition Audit office level variables
The total number of times that clients of an audit office experienced cyber incidents in the previous three years, scaled by the total number of clients of the audit office of year t. The nature log of total number of clients audited by the audit office of year t. The total number of clients for an audit office divided by the total number of clients for all offices in the MSA in year t.
Indicator variable equal to 1 if the audit office is the MSA-level industry expert on an audit engagement in year t, and 0 otherwise. A MSA industry expert charges the largest amount of total audit fees within an industry-year in the same MSA. Industries are classified at the two-digit SIC level.
Indicator variable equal to 1 if the audit office's IT capability is higher than the median value in year t, and 0 otherwise. Audit office's IT capability is the total number of clients listed on InformationWeek500 of an audit office, scaled by the total number of clients of the audit office.

Firm level variables
The nature log of audit fees. The nature log of total assets. ℎ The one-year growth rate of sales. The book value divided by market value. The operating income after depreciation scaled by total assets. The sum of inventories and accounts receivable divided by total assets. The number of business segments.
Indicator variable equal to 1 if the firm has foreign operations, and 0 otherwise. Indicator variable equal to 1 if the firm reports merger activities, and 0 otherwise. Indicator variable equal to 1 if the firm reports special items, and 0 otherwise. An indicator variable that equals to 1 if the firm has net loss, and 0 otherwise. The total liabilities divided by total assets. The current assets minus inventories scaled by total assets. Indicator variable equal to 1 if the auditor issue a going-concern opinion in year t, and 0 otherwise. Indicator variable equal to 1 if the firm reports a restatement in year t or year t+1, and 0 otherwise. Indicator variable equal to 1 if the firm has at least one weakness in internal controls in year t, and 0 otherwise. 4 Indicator variable equal to 1 if the firm is audited by a Big4 auditor in year t, and 0 otherwise.
Indicator variable equal to 1 if it is an initial-year audit, and 0 otherwise.