Cybersecurity Disclosure by the Companies on the S&P/TSX 60 Index

Abstract

Cybersecurity has become a topic of great interest since 2010. Accounting issues surrounding cybersecurity governance, management, and disclosure have gained attention from accounting standard setters, large accounting firms, and professional associations, but only a limited number of studies have looked at cybersecurity disclosure. In this study, we examine whether the content of cybersecurity disclosures of Canadian firms comprising the S&P/TSX 60 index is aligned with best practices—that is, financial regulators' guidelines in that matter. A content analysis was performed of documents issued between January 2017 and mid‐2018, consisting of recent annual information forms (AIFs), annual and quarterly management's discussion and analysis (MD&As), proxy circulars, material change reports, and news releases. To assess the nature and extent of cybersecurity disclosure, we developed a scoring grid featuring 40 items based on financial regulators' guidelines. Results show that cybersecurity disclosure levels are low. Companies vary widely in the amount of detail they provide, and the information is often not company‐specific. The variations among industrial sectors involve the categories related to cybersecurity risk, cybersecurity risk mitigation, and other items. Most of the companies provided cybersecurity disclosures in the annual MD&A, and several reiterated some disclosure items in the AIF and proxy circular. The results of this study highlight some areas where cybersecurity disclosures have evolved and others where they could be improved. They suggest that some firms strive to avoid boilerplate language and be more company‐specific. The findings also suggest that financial regulators could issue more stringent requirements.

Voluntary cybersecurity disclosure in the banking industry of Bangladesh: does board composition matter?

“…Following the SEC's footsteps, Canadian Securities Administrator (CSA) emphasized the cybersecurity issued a notice in 2016 to the issuers, registrants and regulated entities guiding CSD (Radu and Smaili, 2021). Based on a content analysis of various Canadian companies' disclosures (e.g., annual information forms, annual and quarterly MD&A), Héroux and Fortin (2020) demonstrated that level of CSD is low, and the information is often generic.…”

“…The sample period starts from 2014 as the concept of CSD is relatively new in the global context. Prior studies (e.g., Gao et al, 2020;Héroux and Fortin, 2020;Radu and Smaili, 2021) noted that CSD as a reporting practice became more pronounced between 2016 to 2018. 3 Also, as evidenced by Mazumder and Sobhan (2021), the focus on cyber risk governance and disclosures in Bangladesh got significant momentum after the BB heist in 2016.…”

“…In order to examine the relationship between CSD and board composition, a multiple linear regression model is used. The study estimates the following fixed-effect (year) regression model for testing the hypotheses framed in this study 4 : 𝐶𝑆𝐷 , = 𝛼 + 𝛽 𝐵𝑆𝐼𝑍𝐸 , + 𝛽 𝐵𝐼𝑁𝐷 , + 𝛽 𝐵𝐺𝐷𝐼𝑉 , + 𝛾 𝑆𝐼𝑍𝐸 , + 𝛾 𝐺𝑅𝑂𝑊𝑇𝐻 , + 𝛾 𝑃𝑅𝑂𝐹𝐼𝑇 , + 𝛾 𝐿𝐸𝑉 , + 𝛾 𝐼𝑁𝑆𝑇 , + 𝛾 𝐹𝑂𝑅𝐸𝐼𝐺𝑁 , + 𝛾 𝐼𝑆𝐿𝐴𝑀 + 𝛿 𝑌𝑒𝑎𝑟 + 𝜀 , 3 Although the US SEC provided indicative guidance on the CSD in 2011, interpretive and detailed guidance was issued on February 21, 2018 to promote explicit and robust CSD (Gao et al, 2020;Héroux and Fortin, 2020). The guidance reinforces and carries more weight than the guidance provided in 2011 (EY, 2018).…”

“…In recent years, regulatory bodies in the USA and Canada also highlighted the importance of cybersecurity disclosures and provided detailed guidance (Gao et al, 2020;Héroux and Fortin, 2020;Radu and Smaili, 2021). As part of their oversight responsibilities, board members are expected to become more engaged and take a proactive role to understand and manage cybersecurity risks throughout their company (EY, 2018(EY, , 2021Mohan et al, 2021;Radu and Smaili, 2021).…”

أثر الإفصاح عن تقریر إدارة مخاطر الأمن السیبرانی على قرار الاستثمار بأسهم الشركات المقیدة بالبورصة المصریة: دراسة تجریبیة

“…‫رل‬ ‫بتصيلبحتصث‬ ‫ا‬ ‫لنالبح‬ ‫ي‬ ‫يلبح‬ ‫ت‬ (Hilary et al, 2016;Berkman et al, 2018;Frank et al, 2019;Heroux & Anne, 2020;Kelton & Pennington, 2020;Badawy,…”