Using a panel data from 2005-2020, I am trying to measure (1) if auditors charge more fees to the clients following a data breach and (2) if the level of response varys over time.

I came up with the following model, but I am not sure using the interaction variable (Breach $\times$ Year Dummy) is the right choice.

$$ Y = B_0 + B_1 \times Breach + B_2 \times (Breach \times Year Dummy) + Controls + Year_{FE} + Industry_{FE} + Error $$


  • $Y$ = Natural log of audit fees charged to a firm $i$ in year $t$
  • $Breach$ = 1 if a firm reported a data breach in year t, 0 otherwise
  • $Breach \times Year Dummy$ = Year-specific effect variable
  • $Controls$ = A group of control variables such as firm size, profitability, etc.
  • $Year_{FE}$ = Year-fixed effect
  • $Industry_{FE}$ = Industry-fixed effect

In my understanding,

  • $B_1(Breach)$ measures the effect of data breach on audit fees
  • $B_2(Breach \times Year Dummy)$ measures if the effect of $B_1$ changes over time or if there is any "year-specific" effect

Nonetheless, I cannot confirm if it is the right model for measuring the year-specific effect. I looked over Wooldridge (2016) but could not find a similar model.

Could anyone help me correcting it please? Am I doing it right? If not, what would be the right model? Many thanks in advance.

I think this post is relevant:

Wooldridge (2016, p. 437, Example 14.2)

  • $\begingroup$ Welcome. Adjusting for “year specific” effects is not the same thing as assessing whether the effect of the data breach on the breached firms is changing over time. Remember, the year dummies already account for the time shocks affecting all firms. $\endgroup$ Commented Jun 5, 2022 at 21:00
  • $\begingroup$ Thank you so much for your comment! If the year dummies are already taking care of the time shocks, does that mean the interaction term in the model basically meaningless? I am sorry for my lack of knowledge in this topic. Could you suggest any better approach to measure the "year specific" effects? $\endgroup$
    – Jin Lee
    Commented Jun 5, 2022 at 21:12
  • 1
    $\begingroup$ It depends upon what you want. Do you want to estimate “year specific” effects? Do you want to estimate firm-year effects? Industry-year effects? Is there an example in Wooldridge’s textbook? Let’s try to be very clear about what you want, and we can point you in the right direction :) $\endgroup$ Commented Jun 6, 2022 at 3:58
  • $\begingroup$ Thank you for your help again : ) My question is - if auditors charge higher audit fees to their clients with data breach (B1 is positive and significant), does the magnitude of B1 vary by year? For example, in some years, they charge much higher fees, but they don't in other years. So I think I want to get "year-specific" effects. I will add more context in the main post. $\endgroup$
    – Jin Lee
    Commented Jun 6, 2022 at 22:56
  • $\begingroup$ Alternatively you can let time act smoothly but nonlinearly: use splines and let spline(Year) interact with the dummy variable Breach so that you estimate one curve for Breach = 0 and another for Breach = 1. $\endgroup$
    – dipetkov
    Commented Jun 7, 2022 at 0:01

1 Answer 1


Let's rewrite your specification as follows,

$$ ln(F_{it}) = \delta B_{it} + \eta_g + \lambda_t + \epsilon_{it}, $$

where $F_{it}$ is total fees paid to external auditors by firm $i$ in year $t$. The parameters $\eta_g$ and $\lambda_t$ denote industry and year fixed effects, respectively. Firms are grouped by sub-industry, so they nest within the $g$ industries. The variable $B_{it}$ is, in essence, a dichotomous treatment variable representing a firm's "exposure" to a data breach. It's "turning on" (i.e., switching from 0 to 1) when firm $i$ experiences a breach in year $t$, 0 otherwise. According to your definition, we have data before and after the breach, and the timing of the breach varies across firms.

Firms may also experience industry-specific shocks. In such a setting, I suggest estimating the following,

$$ ln(F_{it}) = \delta B_{it} + \nu_{gt} + \epsilon_{it}, $$

where the parameter $\nu_{gt}$ is an industry-year fixed effect, which is computing counterfactual time trends for the industry-year pairs. This allows different industries to have different trends. Note also that we may suspect the industry, year, and industry-year effects to be correlated with other right-hand side variables, so it seems appropriate to estimate $\nu_{gt}$ directly. In practice, estimating $\nu_{gt}$ is akin to including a series of industry $\times$ year interactions.

$\beta_1$(Breach) measures the effect of the data breach on audit fees.


The coefficient on the breach dummy is estimating the causal effect of the data breach on audit fees for those firms actually experiencing a data breach.

$\beta_2$(Breach*Year) measures if the effect of $\beta_1$ changes over time or if there is any "year-specific" effect.

Not quite.

To estimate how the effects vary with time since exposure, you should create separate dummies to allow the effects to vary by year. The model would look like the following,

$$ ln(F_{it}) = \sum^{-q}_{\tau = 0} \delta_{\tau} B_{i,t-\tau} + \nu_{gt} + \epsilon_{it}, $$

where we have an arbitrary number of $q$ lags of the breach dummy on the right-hand side. Maybe audit fees increase immediately following a breach, but they don't really persist beyond a few years. In that case, we should expect to see the coefficients on the $\delta_{\tau}$'s wane with the passing of time.

To estimate this in practice, you must create separate breach dummies for each year after the event. Say a firm is breached in 2009. The first lag of the breach variable (i.e., $B_{i,t-1}$) for this particular firm is a dummy that switches on in 2010, 0 otherwise. Likewise, the second lag of the breach variable (i.e., $B_{i,t-2}$) is a dummy that switches on in 2011, 0 otherwise. This is how we investigate whether the effect is varying over time.

But let's talk terminology for a second. It appears you're conflating "time-varying" effects with "year-specific" effects in general. The "year-specific" effects are the year fixed effects. They adjust for the common time shocks. In other words, they represent those yearly macro-shocks that affect all firms in all industries.

Nonetheless, I cannot confirm if it is the right model for measuring the year-specific effect.

The lags of the breach dummy (i.e., $B_{it}$, $B_{i,t-1}$, $B_{i,t-2}$, etc.) investigate "time-varying" effects. The parameter $\nu_{gt}$ is estimating "year-specific" effects, but we're allowing the year-specific effects to vary by industry.

The post you reference departs from your question in a fundamental way. It's addressing the issue of including "time-constant" regressors in a fixed effects model. If you acquired firm level regressors, then include them. The breach indicator is $i$- and $t$-subscripted; it varies over time and across firms. Even if the breach indicator was just a time-constant factor over the sample period, it's still estimable in this setting.

Maybe you want to include time-constant regressors at the level of one of the fixed effects. Say you want to adjust for industry-specific characteristics. Well, the model cannot distinguish between those time-constant, industry level regressors and the industry fixed effects. To get around this, I suggest interacting those fixed industry level variables with the year dummies and look at their effects over time. I will let you review this post for a deeper dive into this discussion.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.