SUMMARY As cybersecurity risk and disclosure requirements increase, companies are looking to audit practitioners to provide System and Organization Controls (SOC) for Cybersecurity assurance services. Companies can choose to use the same firm as their financial statement auditor (joint provisioning) or a separate assurance provider. This article summarizes a study examining the effects of joint or separate provisioning of this service and cybersecurity incidents on investors’ perceptions of audit quality and investment decisions (Perols and Murthy 2021). The study finds that when the service is jointly provisioned, the negative signal of a subsequent cybersecurity incident can reverse investors’ positive perceptions of auditor competence, increase investors’ sensitivity to potential independence impairments, and result in lower perceptions of audit quality. Overall, the study finds that investors can be less willing to invest in a company when the service is jointly compared to separately provisioned. This article highlights implications for companies, practitioners, and regulators.
Read full abstract