Skip to main content
Disciplines
Automotive Business IT + Informatics Construction + Real Estate Electrical Engineering + Electronics Energy + Sustainability Insurance + Risk Finance + Banking Management + Leadership Marketing + Sales Mechanical Engineering + Materials
Events
DE
EN
Books
Journals
Topic Page
Marketing
Start single access now
Access for companies
EXTENDED SEARCH
Log in
Top
Review of Accounting Studies
Published in: Review of Accounting Studies 1/2024

31-08-2022

Cyber risk and voluntary Service Organization Control (SOC) audits

Author: Jordan Schoenfeld

Published in: Review of Accounting Studies | Issue 1/2024

Log in

Activate our intelligent search to find suitable subject content or patents.

search-config
loading …

Abstract

Firms routinely manage their financial reporting systems on external cloud platforms that are susceptible to cyberattacks and data integrity issues. Therefore, the AICPA developed a special type of voluntary audit called a “Service Organization Control” audit (SOC audit) that evaluates this risk. This study conducts one of the first systematic analyses of the benefits and costs of these voluntary audits. Using hand-collected data from public firms, I find that (1) 29% of firms in the S&P 500 (representing $10.9 trillion in market value) receive these audits; (2) business-model exposure to technology predicts a firm’s decision to receive these audits; (3) the scope of these audits includes internal controls over data integrity; and (4) these audits are one of the largest predictors of the variation in audit-related fees, amounting to a $900,000 average annual increase in these fees at the firm level (by comparison, tax preparation fees average about $1.3 million). SOC audits are thus an important and concrete example of the broader social and governance mandates of new stakeholder-focused reporting frameworks, such as the SASB’s Conceptual Framework.
previous article Firm complexity and post-earnings announcement drift
next article Boardroom gender diversity reforms and institutional monitoring: global evidence

Dont have a licence yet? Then find out more about our products and how to get one now:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

inform now

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

inform now
Appendix
Available only for authorised users
Footnotes
2
One survey finds that 98% of large firms have contracts with technology service companies (Dell, 2020). Accounting information systems, loan servicing, payroll, tax processing, and data center storage are examples of business functions that firms outsource to such companies (e.g., Deloitte 2013; Hardy 2016).
 
3
Section 2 elaborates on the AICPA’s SOC audit framework, and Section 3 discusses the data-collection process. Note that SOC audit reports are separate from financial statement audit opinions.
 
4
AWS stores and processes data for many businesses through its pay-as-you-go cloud platform. Amazon’s 2018 10-K notes that AWS generated about $26 billion in revenue and $7 billion in operating income, representing about half of Amazon’s total operating income for that year.
 
5
A few firms with very large SOC audit fees even discuss these fees in their proxy statement. For example, Google’s parent company Alphabet noted that it paid $6.2 million for SOC audits in 2018. Note that audit-related fees include SOC audit fees and are distinct from any tax and technology consulting fees paid to an audit firm, which are included in other line items on the proxy statement (e.g., De Simone et al. 2015). Section 4.2 provides more detail on this point.
 
7
Note that even if shareholders are not the primary end users of SOC audits, these audits may still add value to the firm. This is a consideration for future valuation research.
 
8
Other studies on non-financial audits include Duflo et al. (2013, 2018), who examine corporate environmental audits in India.
 
10
Before 2011, audit firms often used Statement on Auditing Standards No. 70 (SAS 70), Service Organizations, as a framework for their internal control audits of a client’s customer-relevant systems. However, SAS 70 was not intended for that purpose (like SOC audit reports, SAS 70 audit reports were not systematically made public). Thus, due to the absence of a better standard, audit firms were improperly using SAS 70, and companies used phrases such as “SAS 70 certified” to indicate that their customer-relevant controls were audited (AICPA, 2011). This led the AICPA to create the SOC framework.
 
11
DeFond and Zhang (2014, p. 294) and Efendi et al. (2006) make a strong case for providing such evidence, given that we have limited research on auditors’ expertise and competencies in areas beyond financial statement audits. There is also no path to examine why public firms do or do not receive financial statement audits, because legislation explicitly mandates financial statement audits and eliminates variation in their adoption (e.g., Gerakos and Syverson 2015, 2017). This is not the case for SOC audits.
 
12
Measuring the dollar value of SOC audits using stock market reactions is currently not possible given the non-public nature of these audits and other constraints.
 
13
Given the confidential data often used in this literature (e.g., Bell et al. 2015) and the nature of my sample, it is beyond the scope of this study to explicitly test whether my findings significantly alter the inferences from prior studies.
 
14
Prior studies use the terms audit, assurance, and attestation to mean a broad spectrum of client engagements. For consistency, I refer to SOC engagements as SOC audits.
 
15
With the vast majority of firms in my sample not listing their SOC audit status online, a systematic analysis of a firm’s SOC audit disclosure strategy is beyond the goals of this study. This question is a potential path for subsequent research on SOC audits.
 
16
Additional details about the sample were obtained through followups with the firms receiving SOC audits. Subsample approaches are also used by researchers in other settings, including venture capital investment (e.g., Kaplan & Strömberg 2003, 2004), debt contracts (e.g., Roberts2015; Roberts & Sufi 2009; Smith & Warner 1979), shareholder contracts (e.g., Nagar & Schoenfeld2021; Schoenfeld 2020), and supplier contracts (e.g., Costello 2013; Joskow 1987). See footnote 26 for the applicability of my findings to firms outside the S&P 500 index. For additional detail on the index, see http://​us.​spindices.​com/​indices/​equity/​sp-500.
 
17
I nonetheless recompute this measure using only the business description section of the 10-K and find similar results in the subsequent analyses in terms of sign and statistical significance (the two measures are correlated at + 0.85).
 
18
By comparison, for financial statement audits at public firms, explicitly modeling the benefits and costs of these audits is more difficult because there is no variation. As a result, most studies on financial statement audits take audit adoption as given (e.g., Gerakos & Syverson2015).
 
19
The standard errors are robust to heteroscedasticity. I also find similar results when I cluster standard errors by the three-digit GICS industries. I tabulate the heteroscedasticity-robust standard errors due to the small number of GICS industries.
 
20
Note that it is not appropriate to insert all the industry-fixed effects at the same time because this would only measure the industry effects relative to the one excluded industry. In any event, the inferences are unchanged when I include all the industry-fixed effects in a single regression that suppresses the intercept and drops all the other firm-level variables.
 
21
Although case studies are relatively uncommon in audit research, they are common in other economics literatures, including the property rights literature (e.g., see the case studies in Alchian & Demsetz 1972 and Coase 1960) and the blockholder literature (e.g., see the case studies in Brav et al. 2008, 2015; Carleton et al. 1998; Holderness & Sheehan 1985; Klein & Zur 2009; and Smith1996).
 
22
I omit an indicator variable for going concern audit opinions because no firms in the sample receive these opinions. I also do not include the indicator variable for firms that are data exposed, as this would necessitate a structural path model (given that business-model data exposure is likely a correlated channel for the demand for SOC audits, e.g., Greene 2002, p. 397).
 
23
The ability to disaggregate these fees is a relatively recent innovation driven by new regulatory mandates and third-party datasets. In contrast, prior studies often aggregate all non-financial audit fees, making it difficult to disentangle the different services provided by audit firms (e.g., Frankel et al. 2002; Kinney & Libby 2002; Whisenant et al. 2003).
 
24
I also tested whether audit-related fees are systematically lower for firms that have the same audit firm perform their financial statement audit and SOC audit by including an interaction term for this effect, but I did not find a significant difference across firms. This could be due to low power, since only a few companies have different audit firms perform their financial statement audit and SOC audit.
 
25
Ge et al. (2017, Section 4) estimate this value by multiplying the difference in the percentage growth in audit fees from 2003 to 2014 for SOX 404-exempt versus non-exempt firms by the mean audit fee for SOX 404-exempt firms and then multiplying that value by 5,302, which represents the SOX 404-exempt firm-years in their 2007 to 2014 sample. One caveat is that these cost estimates are computed for firms that are smaller than the S&P 500 firms in my sample.
 
26
Recall that as of mid-2019, the S&P 500 index accounts for about 82% of total market capitalization. It is an open question as to whether firms outside the S&P 500 adopt SOC audits at a similar rate. Preliminary evidence suggests they do: based on a random sample of 50 firms in the GICS information technology industry in the Russell 2000, which comprises the 2,000 smallest public firms, about 65% of these firms receive SOC audits. This comports well with the current sample of information technology firms, of which about 62% receive SOC audits. Also, the industry-fixed effects represent the 11 GICS industries. I cannot include GICS subindustry-fixed effects due to subindustries with only one firm.
 
Literature
Acemoglu, D., Makhdoumi, A., Malekian, A., & Ozdaglar, A. (2022). Too much data: Prices and inefficiencies in data markets. American Economic Journal: Microeconomics Forthcoming.
Alchian, A., & Demsetz, H. (1972). Production, information costs, and economic organization. American Economic Review, 62, 777–795.
Allee, K., & Yohn, T. (2009). The demand for financial statements in an unregulated environment: An examination of the production and use of financial statements by privately held small businesses. The Accounting Review, 84, 1–25.
Altamuro, J., & Beatty, A. (2010). How does internal control regulation affect financial reporting? Journal of Accounting and Economics, 49, 58–74.
Aobdia, D. (2015). Proprietary information spillovers and supplier choice: Evidence from auditors. Review of Accounting Studies, 20, 1504–1539.
Ashbaugh, H., LaFond, R., & Mayhew, B. W. (2003). Do nonaudit services compromise auditor independence? further evidence. The Accounting Review, 78, 611–639.
Ashbaugh-Skaife, H., Collins, D. W., & Kinney, W. R. (2007). The discovery and reporting of internal control deficiencies prior to SOX-mandated audits. Journal of Accounting and Economics, 44, 166–192.
Badertscher, B., Jorgensen, B., Katz, S., & Kinney, W. (2014). Public equity and audit pricing in the united states. Journal of Accounting Research, 52, 303–339.
Ball, R., Jayaraman, S., & Shivakumar, L. (2012). Audited financial reporting and voluntary disclosure as complements: A test of the Confirmation Hypothesis. Journal of Accounting and Economics, 53, 136–166.
Bauer, A. M. (2016). Tax avoidance and the implications of weak internal controls. Contemporary Accounting Research, 33, 449–486.
Bauer, T. D., Estep, C., & Malsch, B. (2019). One team or two? Investigating relationship quality between auditors and IT specialists: Implications for audit team identity and the audit process. Contemporary Accounting Research, 36, 2142–2177.
Bell, T., Causholli, M., & Knechel, W. R. (2015). Audit firm tenure, non-audit services, and internal assessments of audit quality. Journal of Accounting Research, 53, 461–509.
Bell, T. B., Landsman, W. R., & Shackelford, D. A. (2001). Auditors’ perceived business risk and audit fees: Analysis and evidence. Journal of Accounting Research, 39, 35–43.
Bloomfield, R., Nelson, M., & Soltes, E. (2016). Gathering data for archival, field, survey, and experimental accounting research. Journal of Accounting Research, 54, 341–395.
Brav, A., Jiang, W., Partnoy, F., & Thomas, R. (2008). Hedge fund activism, corporate governance, and firm performance. Journal of Finance, 63, 1729–1775.
Brav, A., Jiang, W., & Kim, H. (2015). The real effects of hedge fund activism: Productivity, asset allocation, and labor outcomes. Review of Financial Studies, 28, 2723–2769.
Carleton, W. T., Nelson, J. M., & Weisbach, M. S. (1998). The influence of institutions on corporate governance through private negotiations: Evidence from tIAA-CREF. Journal of Finance, 53, 1335–1362.
Carnes, R. R., Christensen, D. M., & Lamoreaux, P. T. (2019). Investor demand for internal control audits of large U.S. Companies: Evidence from a regulatory exemption for M&A transactions. The Accounting Review, 94, 71–99.
Cheng, M., Dhaliwal, D., & Zhang, Y. (2013). Does investment efficiency improve after the disclosure of material weaknesses in internal control over financial reporting? Journal of Accounting and Economics, 56, 1–18.
Chow, C. W. (1982). The demand for external auditing: Size, debt and ownership influences. The Accounting Review, 57, 272–291.
Christensen, H. B., Hail, L., & Leuz, C. (2021). Mandatory CSR and sustainability reporting: Economic analysis and literature review. Review of Accounting Studies, 26, 1176–1248.PubMedCentral
Coase, R. H. (1960). The problem of social cost. Journal of Law & Economics, 3, 1–44.
Coates, J. C., & Srinivasan, S. (2014). SOX After ten years: A multidisciplinary review. Accounting Horizons, 28, 627–671.
Costello, A. (2013). Mitigating incentive conflicts in inter-firm relationships: Evidence from long-term supply contracts. Journal of Accounting and Economics, 56, 19–39.
Davis, L. R., Ricchiute, D. N., & Trompeter, G. (1993). Audit effort, audit fees, and the provision of nonaudit services to audit clients. The Accounting Review, 68, 135–150.
Davis, L. R., Soo, B. S., & Trompeter, G. M. (2009). Auditor tenure and the ability to meet or beat earnings forecasts. Contemporary Accounting Research, 26, 517–548.
De Simone, L., Ege, M. S., & Stomberg, B. (2015). Internal control quality: The role of auditor-provided tax services. The Accounting Review, 90, 1469–1496.
DeFond, M. L., & Francis, J. R. (2005). Audit research after Sarbanes-Oxley. Auditing: A Journal of Practice & Theory, 24, 5–30.
DeFond, M. L., & Jiambalvo, J. (1991). Incidence and circumstances of accounting errors. The Accounting Review, 66, 643–655.
DeFond, M., & Zhang, J. (2014). A review of archival auditing research. Journal of Accounting and Economics, 58, 275–326.ADS
DeFond, M. L., Raghunandan, K., & Subramanyam, K. (2002). Do non-audit service fees impair auditor independence? evidence from going concern audit opinions. Journal of Accounting Research, 40, 1247–1274.
Dorantes, C. -A., Li, C., Peters, G. F., & Richardson, V. J. (2013). The effect of enterprise systems implementation on the firm information environment. Contemporary Accounting Research, 30, 1427–1461.
Doyle, J., Ge, W., & McVay, S. (2007). Determinants of weaknesses in internal control over financial reporting. Journal of Accounting and Economics, 44, 193–223.
Duflo, E., Greenstone, M., Pande, R., & Ryan, N. (2013). Truth-telling by third-party auditors and the response of polluting firms: Experimental evidence from India. The Quarterly Journal of Economics, 128, 1499–1545.
Duflo, E., Greenstone, M., Pande, R., & Ryan, N. (2018). The value of regulatory discretion: Estimates from environmental inspections in India. Econometrica, 86, 2123–2160.
Duguay, R., Minnis, M., & Sutherland, A. (2020). Regulatory spillovers in common audit markets. Management Science, 66, 3389–3411.
Efendi, J., Mulig, E. V., & Smith, L. M. (2006). Information technology and systems research published in major accounting academic and professional journals. Journal of Emerging Technologies in Accounting, 3, 117–128.
Feng, M., Li, C., McVay, S. E., & Skaife, H. (2015). Does ineffective internal control over financial reporting affect a firm’s operations? Evidence from firms’ inventory management. The Accounting Review, 90, 529–557.
Francis, J. R. (2006). Are auditors compromised by nonaudit services? Assessing the evidence. Contemporary Accounting Research, 23, 747–760.
Frankel, R. M., Johnson, M. F., & Nelson, K. K. (2002). The relation between auditors’ fees for nonaudit services and earnings management. The Accounting Review, 77, 71–105.
Ge, W., Koester, A., & McVay, S. (2017). Benefits and costs of Sarbanes-Oxley Section 404(b) exemption: Evidence from small firms’ internal control disclosures. Journal of Accounting and Economics, 63, 358–384.
Gerakos, J., & Syverson, C. (2015). Competition in the audit market: Policy implications. Journal of Accounting Research, 53, 725–775.
Gerakos, J., & Syverson, C. (2017). Audit firms face downward-sloping demand curves and the audit market is far from perfectly competitive. Review of Accounting Studies, 22, 1582–1594.
Gipper, B., Hail, L., & Leuz, C. (2020). On the economics of mandatory audit partner rotation and tenure: Evidence from PCAOB data. The Accounting Review, Forthcoming.
Gleason, C. A., & Mills, L. F. (2011). Do auditor-provided tax services improve the estimate of tax reserves? Contemporary Accounting Research, 28, 1484–1509.
Gow, I., Larcker, D., & Reiss, P. (2016). Causal inference in accounting research. Journal of Accounting Research, 54, 477–523.
Greene, W. (2002). Econometric analysis, 5h edn. Upper Saddle River: Pearson Education, Inc.
Haislip, J. Z., Peters, G. F., & Richardson, V. J. (2016). The effect of auditor it expertise on internal controls. International Journal of Accounting Information Systems, 20, 1–15.
Hammersley, J. S., Myers, L. A., & Shakespeare, C. (2008). Market reactions to the disclosure of internal control weaknesses and to the characteristics of those weaknesses under section 302 of the Sarbanes Oxley Act of 2002. Review of Accounting Studies, 13, 141–165.
Hardy, Q. (2016). Why the computing cloud will keep growing and growing. The New York Times, December 25, 2016.
Harp, N. L., & Barnes, B. G. (2018). Internal control weaknesses and acquisition performance. The Accounting Review, 93, 235–258.
Hay, D. C., Knechel, W. R., & Wong, N. (2006). Audit fees: A meta-analysis of the effect of supply and demand attributes. Contemporary Accounting Research, 23, 141–191.
Holderness, C. G., & Sheehan, D. P. (1985). Raiders or saviors? The evidence on six controversial investors. Journal of Financial Economics, 14, 555.
Iliev, P. (2010). The effect of SOX section 404: Costs, earnings quality, and stock prices. The Journal of Finance, 65, 1163–1196.
Johnson, W. B., & Lys, T. (1990). The market for audit services: Evidence from voluntary auditor changes. Journal of Accounting and Economics, 12, 281–308.
Joskow, P. (1987). Contract duration and relationship-specific investments: Empirical evidence from coal markets. American Economic Review, 77, 168–185.
Kaplan, S., & Strömberg, P. (2003). Financial contracting theory meets the real world: An empirical analysis of venture capital contracts. Review of Economic Studies, 70, 281–315.
Kaplan, S., & Strömberg, P. (2004). Characteristics, contracts, and actions: Evidence from venture capitalist analyses. Journal of Finance, 59, 2177–2210.
Kinney, W. R., & Libby, R. (2002). Discussion of the relation between auditors’ fees for nonaudit services and earnings management. The Accounting Review, 77, 107–114.
Kinney, W. R., & McDaniel, L. S. (1989). Characteristics of firms correcting previously reported quarterly earnings. Journal of Accounting and Economics, 11, 71–93.
Kinney, W. R., Palmrose, Z. -V., & Scholz, S. (2004). Auditor independence, non-audit services, and restatements: Was the U.S. Government Right? Journal of Accounting Research, 42, 561–588.
Klein, A., & Zur, E. (2009). Entrepreneurial shareholder activism: Hedge funds and other private investors. Journal of Finance, 64, 187–229.
Knechel, R., & Salterio, S. (2016). Auditing: Assurance and risk. Routledge.
Knechel, W. R., & Willenborg, M. (2016). Economics-based auditing research published in JAR. Journal of Accounting Research Virtual Issue.
Knechel, W. R., Krishnan, G. V., Pevzner, M., Shefchik, L. B., & Velury, U. K. (2013). Audit quality: Insights from the academic literature. AUDITING: A Journal of Practice & Theory, 32, 385–421.
Koh, K., Rajgopal, S., & Srinivasan, S. (2013). Non-audit services and financial reporting quality: Evidence from 1978 to 1980. Review of Accounting Studies, 18, 1–33.
Kowaleski, Z. T., Mayhew, B. W., & Tegeler, A. C. (2018). The impact of consulting services on audit quality: An experimental approach. Journal of Accounting Research, 56, 673–711.
Kreps, D. (1990). A course in microeconomic theory. Princeton University Press.
Larcker, D. F., & Rusticus, T. O. (2010). On the use of instrumental variables in accounting research. Journal of Accounting and Economics, 49, 186–205.
Lennox, C. S., & Pittman, J. A. (2011). Voluntary audits versus mandatory audits. The Accounting Review, 86, 1655–1678.
Leuz, C. (2018). Evidence-based policymaking: Promise, challenges and opportunities for accounting and financial markets research. Accounting and Business Research, 48, 582–608.
Leuz, C., & Wysocki, P. (2016). The economics of disclosure and financial reporting regulation: Evidence and suggestions for future research. Journal of Accounting Research, 54, 525–622.
Lim, C. -Y., & Tan, H. -T. (2008). Non-audit service fees and audit quality: The impact of auditor specialization. Journal of Accounting Research, 46, 199–246.
Lisowsky, P., & Minnis, M. (2020). The silent majority: Private U.S. firms and financial reporting choices. Journal of Accounting Research, 58, 547–588.
Lisowsky, P., Minnis, M., & Sutherland, A. (2017). Economic growth and financial statement verification. Journal of Accounting Research, 55, 745–794.
Loughran, T., & McDonald, B. (2016). Textual analysis in accounting and finance: A survey. Journal of Accounting Research, 54, 1187–1230.
Minnis, M. (2011). The value of financial statement verification in debt financing: Evidence from private U.S. Firms. Journal of Accounting Research, 49, 457–506.
Minutti-Meza, M. (2013). Does auditor industry specialization improve audit quality? Journal of Accounting Research, 51, 779–817.
Minutti-Meza, M. (2014). Issues in examining the effect of auditor litigation on audit fees. Journal of Accounting Research, 52, 341–356.
Mullainathan, S. (2019). Biased algorithms are easier to fix than biased people. The New York Times, December 6, 2019.
Nagar, V., & Schoenfeld, J. (2021). Shareholder monitoring and discretionary disclosure. Journal of Accounting and Economics, 72, 1–22.
Ogneva, M., Subramanyam, K. R., & Raghunandan, K. (2007). Internal control weakness and cost of equity: Evidence from SOX section 404 disclosures. The Accounting Review, 82, 1255–1297.
Palmrose, Z. -V. (1986). The effect of nonaudit services on the pricing of audit services: Further evidence. Journal of Accounting Research, 24, 405–411.
Rajgopal, S., Srinivasan, S., & Zheng, X. (2021). Measuring audit quality. Review of Accounting Studies, 26, 559–619.
Rice, S., & Weber, D. (2012). How effective is internal control reporting under SOX 404? Determinants of the (non-)disclosure of existing material weaknesses. Journal of Accounting Research, 50, 811–843.
Roberts, M. R. (2015). The role of dynamic renegotiation and asymmetric information in financial contracting. Journal of Financial Economics, 116, 61–81.
Roberts, M. R., & Sufi, A. (2009). Control rights and capital structure: An empirical investigation. Journal of Finance, 64, 1657–1695.
Roychowdhury, S., Shroff, N., & Verdi, R. S. (2019). The effects of financial reporting and disclosure on corporate investment: A review. Journal of Accounting and Economics, 68, 1–27.
Samuelson, P. A. (1948). Consumption theory in terms of revealed preference. Economica, 15, 243–253.
Schoenfeld, J. (2017). The effect of voluntary disclosure on stock liquidity: New evidence from index funds. Journal of Accounting and Economics, 63, 51–74.
Schoenfeld, J. (2020). Contracts between firms and shareholders. Journal of Accounting Research, 58, 383–427.
Schroeder, J. H., & Shepardson, M. L. (2016). Do SOX 404 control audits and management assessments improve overall internal control system quality? The Accounting Review, 91, 1513–1541.
Shear, M. D., Perlroth, N., & Krauss, C. (2021). Colonial pipeline paid roughly $5 million in ransom to hackers. The New York Times, May 13, 2021.
Shipman, J. E., Swanquist, Q. T., & Whited, R. L. (2017). Propensity score matching in accounting research. The Accounting Review, 92, 213–244.
Simunic, D. A. (1980). The pricing of audit services: Theory and evidence. Journal of Accounting Research, 18, 161–190.
Simunic, D. A. (1984). Auditing, consulting, and auditor independence. Journal of Accounting Research, 22, 679–702.
Smith, M. (1996). Shareholder activism by institutional investors: Evidence from calPERS. Journal of Finance, 51, 227–252.
Smith, C., & Warner, J. (1979). On financial contracting: An analysis of bond covenants. Journal of Financial Economics, 7, 117–161.
Watts, R. L., & Zimmerman, J. L. (1983). Agency problems, auditing, and the theory of the firm: Some evidence. The Journal of Law and Economics, 26, 613–633.
Whisenant, S., Sankaraguruswamy, S., & Raghunandan, K. (2003). Evidence on the joint determination of audit and Non-Audit fees. Journal of Accounting Research, 41, 721–744.
Yoon, K., Hoogduin, L., & Zhang, L. (2015). Big data as complementary audit evidence. Accounting Horizons, 29, 431–438.
Zhang, I. X. (2007). Economic consequences of the Sarbanes–Oxley Act of 2002. Journal of Accounting and Economics, 44, 74–115.
Zhu, C. (2019). Big data as a governance mechanism. Review of Financial Studies, 32, 2021–2061.
Metadata
Title
Cyber risk and voluntary Service Organization Control (SOC) audits
Author
Jordan Schoenfeld
Publication date
31-08-2022
Publisher
Springer US
Published in
Review of Accounting Studies / Issue 1/2024
Print ISSN: 1380-6653
Electronic ISSN: 1573-7136
DOI
https://doi.org/10.1007/s11142-022-09713-0

Other articles of this Issue 1/2024

Review of Accounting Studies 1/2024 Go to the issue

OriginalPaper

How pervasive is corporate fraud?

OriginalPaper

When attention is away, analysts misplay: distraction and analyst forecast performance

OriginalPaper

The role of external regulators in mergers and acquisitions: evidence from SEC comment letters

OriginalPaper

Firm innovation and covenant tightness

OriginalPaper

The asymmetric mispricing information in analysts’ target prices

OriginalPaper

Overprecise forecasts