The Stock Market and Audit Market Effects of a Big 4 Security Breach

Abstract

This research provides insights into how audit clients and investors respond to a breach of confidential client data by an audit firm. Specifically, on September 25, 2017, Deloitte & Touche (a.k.a., Deloitte), an international Big 4 audit firm, reported that its systems had sustained a six month long cyber-attack lasting from October 2016 to March 2017 (Hopkins 2017). We examine whether Deloitte’s reputation was impacted. We find that Deloitte’s audit clients at the time of the breach did not experience a change in audit fees, nor were they more likely to dismiss Deloitte. However, Deloitte experienced a decrease in the number of new audit clients after the breach announcement as well as decreased first year audit fees for new clients. A negative market reaction was only found for clients that dismissed Deloitte. Thus, Deloitte’s reputation appears to be only tarnished for companies searching for a new auditor.