Cyber risk and voluntary Service Organization Control (SOC) audits

Jordan Schoenfeld ()
Additional contact information
Jordan Schoenfeld: University of Utah

Review of Accounting Studies, 2024, vol. 29, issue 1, No 17, 580-620

Abstract: Abstract Firms routinely manage their financial reporting systems on external cloud platforms that are susceptible to cyberattacks and data integrity issues. Therefore, the AICPA developed a special type of voluntary audit called a “Service Organization Control” audit (SOC audit) that evaluates this risk. This study conducts one of the first systematic analyses of the benefits and costs of these voluntary audits. Using hand-collected data from public firms, I find that (1) 29% of firms in the S&P 500 (representing $10.9 trillion in market value) receive these audits; (2) business-model exposure to technology predicts a firm’s decision to receive these audits; (3) the scope of these audits includes internal controls over data integrity; and (4) these audits are one of the largest predictors of the variation in audit-related fees, amounting to a $900,000 average annual increase in these fees at the firm level (by comparison, tax preparation fees average about $1.3 million). SOC audits are thus an important and concrete example of the broader social and governance mandates of new stakeholder-focused reporting frameworks, such as the SASB’s Conceptual Framework.

Keywords: Audit; Big data; Cloud computing; CSR; ESG; Internal control (search for similar items in EconPapers)
JEL-codes: M40 M49 O33 (search for similar items in EconPapers)
Date: 2024
References: View complete reference list from CitEc
Citations:

Downloads: (external link)
http://link.springer.com/10.1007/s11142-022-09713-0 Abstract (text/html)
Access to the full text of the articles in this series is restricted.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:spr:reaccs:v:29:y:2024:i:1:d:10.1007_s11142-022-09713-0

Ordering information: This journal article can be ordered from
http://www.springer.com/accounting/journal/11142

DOI: 10.1007/s11142-022-09713-0

Access Statistics for this article

Review of Accounting Studies is currently edited by Paul Fischer

More articles in Review of Accounting Studies from Springer
Bibliographic data for series maintained by Sonal Shukla () and Springer Nature Abstracting and Indexing ().