Investors’ perceptions of the cybersecurity risk management reporting framework

Abstract

Purpose The purpose of this paper is to propose a research model to examine the perception of non-professional investors toward the cybersecurity reporting framework developed by the American Institute of Certified Public Accountants (AICPA). Design/methodology/approach The proposed hypotheses were tested using structural equation modeling with data collected from Amazon's Mechanical Turk platform. Findings The findings conclude that investors' perceived benefits of the cybersecurity risk framework are positively related to investment intention. Information quality and cybersecurity awareness also positively influence perceived benefits of the risk framework and investment intention. Practical implications Findings of this study are relevant to both regulatory bodies and firms because non-professional investors’ perceptions of the benefits of the AICPA’s reporting framework are unveiled. Originality/value Findings from this research help to provide a more in-depth understanding of the impact of various factors on investor’s decision-making process and also significant insights into the non-professional investor’s attitude toward the AICPA’s framework.

Risk reporting in financial crises: a tale of two countries

“…Furthermore, the time lag effect of operating leverage as a proxy for operational risk suggests that investors follow this type of risk and update their beliefs about the operational risk profile of the company. In addition, the results further support the importance of operating leverage and operational risk disclosures in affecting firm performance consistent with prior literature (Lev, 1974; Heinle and Smith, 2017; Yang et al , 2020).…”

“…Thus, more research on the quality of risk information disclosure is warranted. Moreover, the matched sample is limited to one sector (manufacturing) in two countries (Canada and Germany) potentially limiting the generalization of the findings while offering new research opportunities in further examining firm and industry cases using more interpretive and qualitative research methods (Yang et al , 2020).…”

“…In addition, few studies have unpacked aggregate risk disclosures to further examine the role and relative importance of certain risk categories such as operational risk and business risks particularly in non-financial sectors. Recent work has shifted focus to these issues by examining, for example, sustainability and environmental risk disclosures and cyber security risks (Hossain and Farooque, 2019; Yang et al , 2020).…”

“…However, little is still known about the drivers and effects of disaggregated risk disclosures such as operational and business risk disclosures, particularly across firms and national boundaries (Hogan and Lodhia, 2011; Hossain and Farooque, 2019). This information asymmetry in non-financial risk exposure, management and disclosure is important to address because operational and business risks may explain and predict subsequent financial problems and exacerbate financial risks which are more readily quantifiable and verifiable given detailed regulation on financial risk disclosure (Heinle and Smith, 2017; Lev, 1974; Yang et al , 2020).…”

أثر جودة ومستوى التوکید على برنامج إدارة مخاطر الأمن السیبرانی على قرارات المستثمرین المصریین غیر المحترفین: دراسة تجریبیة (باللغة الانجلیزیة)

“…In addition, Yang et al (2020) developed a research model of investors' perception of the cybersecurity risk management reporting framework. They hypothesized that information quality and cybersecurity awareness will have a positive impact on the perceived benefits of the risk management program and that trust mediates this relationship and that the investors' perceived benefits will have a positive impact on their intention to invest.…”