The audit committee’s IT expertise and its impact on the disclosure of cybersecurity risk

Abstract

This paper examines the impact of the audit committee's IT expertise on corporate cybersecurity risk disclosure against the backdrop of increasing complexity and frequency of cyberattacks. We find that IT expertise of audit committees significantly improves the disclosure of cybersecurity risks. This effect is more pronounced in firms with less transparent financial reporting, firms with weaker governance, and firms with lower information asymmetry. Furthermore, the level of artificial intelligence adoption, the quality of internal controls, and the quality of information disclosure are potential influencing channels.