Disclosures of cyber exposure and audit fees: Evidence from ASEAN-4 banking

Abstract

This study examines how external auditors respond to the disclosure of cyber exposures by commercial banks and how the COVID-19 pandemic period accentuates the effect of voluntary cyber risk disclosures (CRDs) on audit fees. Our study is a preliminary study analysing the CRD of the financial industry in emerging economies in the Association of Southeast Asian Nations (ASEAN). It extends Calderon and Gao’s (2021) study one step further with respect to the COVID-19 pandemic and identifies items by using manually collected keywords to extract CRDs. During the period 2015–2020, our samples are 63 listed banks in four ASEAN members (Indonesia, Malaysia, Thailand, and the Philippines — ASEAN-4) and the one-step generalized method of moments (GMM) is used. The study found that audit fees are significantly associated with CRD, including risk causes and impacts. Meanwhile, cyber risk governance disclosures affect audit fees after a one-year lag. This indicates that voluntary CRD is informative. Audit fees are also significantly affected by the interaction between CRD and COVID-19. It suggests that auditors incorporate the nature and content of client CRDs into their fee structure and directly support regulatory reporting requirements in emerging ASEAN countries to include cyber risk factors in annual bank statements.