The impact of customer firm data breaches on the audit fees of their suppliers

Abstract

This study investigates whether audit risks that accompany data breaches of major customer firms can spillover into the supply chain and affect audit fees of their suppliers. Based on the economic bond that exists between supplier firms and their major customers, we predict that data breach incidents of customer firms will lead to higher audit fees for their respective suppliers. Consistent with customer breaches increasing the audit risk to the supplier, we observe a positive association between breach disclosures made by major customers and audit fees of the supplier firm. This association exists for both internal and external data breaches. We further find that audit fees are increasing with the number of major customers disclosing a breach in a given year. Our results are robust to both a matched sample design and a difference-in-difference approach. Interestingly, we find that while supplier auditors appear to price the risks associated with customer breaches, the breaches do not appear to affect audit quality. The findings of this study are timely and relevant to academics, practitioners, and regulators as supply chains continue to become larger and more complex.