Cybersecurity in accounting research

Abstract

Purpose This paper aims to update the cybersecurity-related accounting literature by synthesizing 39 recent theoretical and empirical studies on the topic. Furthermore, the paper provides a set of categories into which the studies fit. Design/methodology/approach This is a synthesis paper that summarizes the research literature on cybersecurity, introducing knowledge from the extant research and revealing areas requiring further examination. Findings This synthesis identifies a research framework that consists of the following research themes: cybersecurity and information sharing, cybersecurity investments, internal auditing and controls related to cybersecurity, disclosure of cybersecurity activities and security threats and security breaches. Practical implications Academics, practitioners and the public would benefit from a research framework that categorizes the research topics related to cybersecurity in the accounting field. This type of analysis is vital to enhance the understanding of the academic research on cybersecurity and can be used to support the identification of new lines for future research. Originality/value This is the first literature analysis of cybersecurity in the accounting field, and it has significant implications for research and practice by detailing, for example, the benefits of and obstacles to information sharing. This synthesis also highlights the importance of the model for cybersecurity investments. Further, the review emphasizes the role of internal auditing and controls to improve cybersecurity.

Elaboration of recommendations on the development of the state internal audit system when applying the digital technologies

“…Based on the study results, the authors conclude that the degree of security/cybersecurity audit is significantly and in direct proportion related to the competence of the internal audit function in relation to risk management and control. Study [18] is considered a generalizing study on cybersecurity. The article examines cybersecurity and information exchange, investment in cybersecurity, internal audit and the control related to cybersecurity, disclosure of cybersecurity activities and threats, and security breaches.…”

Academic Research on the Role of Corporate Governance and IT Expertise in Addressing Cybersecurity Breaches: Implications for Practice, Policy, and Research

“…This directive has served as a model for similar laws passed in foreign countries and the 2018 California Consumer Privacy Act (CCPA) that took effect on January 1, 1 Research on cybersecurity has mainly focused on information sharing, investments in cybersecurity, the role of internal audit, disclosure of cybersecurity activities, and effects of security breaches. Please refer to Haapama¨ki and Sihvonen (2019), Richardson et al (2019), Walton et al (2021), and Wilkin and Chenhall (2020) 2020, in the U.S. Similar to the GDPR, the CCPA's main focus is to allow California residents more control over the collection and disclosure of personal information and requires businesses to disclose security breaches related to stolen personal information (Becerra 2020).…”

“…To date, cyber-attacks continue to increase and the success of governing bodies in addressing cybersecurity risks and security breaches is relatively unknown. 1 Although there are studies related to cybersecurity that provide research summaries in the areas of (1) cybersecurity disclosures, (2) cybersecurity investment, (3) economic consequences to cybersecurity incidents, and (4) manager and auditor responses to cybersecurity risks (Haapama¨ki and Sihvonen 2019;Richardson, Smith, and Weidenmier Watson 2019;Walton, Wheeler, Zhang, and Zhao 2021;Wilkin and Chenhall 2020), the role of IT as a governance tool to combat cyber-attacks has not been fully explored. With the aim of understanding the current and future role of governance mechanisms in managing cybersecurity risks, this paper reviews the existing cybersecurity guidelines and regulations, and summarizes the empirical research related to corporate governance, security breaches, and IT expertise in overseeing cyber risks, using a combination of words to search for relevant studies published in top peer-reviewed journals.…”

أثر جودة ومستوى التوکید على برنامج إدارة مخاطر الأمن السیبرانی على قرارات المستثمرین المصریین غیر المحترفین: دراسة تجریبیة (باللغة الانجلیزیة)

“…It can be noted that cybersecurity involves the required technologies, processes and controls that are designed in order to protect the systems, networks and data from cyber at-tacks and incidents. The effective cybersecurity program is the one that reduces the risk of cyber attacks and incidents and protects everyone from the misuse or unauthorized use of the related systems, networks and technologies (Haapama ki & Sihvonen, 2019).…”