Securities Disclosure Research Articles

Board gender diversity and cyber security disclosure in the Indonesian banking industry: a two-tier governance context

PurposeThis study aims to determine the effect of board gender diversity on cyber security disclosure (CSD) in the banking sector of Indonesia as a developing country that adheres to a two-tier system.Design/methodology/approachThis study uses a panel data of 47 banks listed on the Indonesia Stock Exchange from 2014 to 2021. The board gender diversity is measured by three proxies, the proportion of women on the board, BLAU Index value and the critical mass of women. The authors used generalized method of moments estimation to eliminate the simultaneous equation bias.FindingsThe results show that the women board of commissioners increases CSD, and the women of board of directors/top management team were significantly negative for CSD.Research limitations/implicationsFirst, this research was only conducted in the banking sector. The results cannot be generalized to non-financial companies. Second, there is no measurement of the quality of the board from the level of education, experience, expertise and other characteristics of diversity such as age, nationality and religion.Practical implicationsThe study has revealed the need for the government’s role in providing oversight of the presence of women on the board so that banks fully comply with Indonesia Financial Services Authority regulations. Banks should also actively launch policies regarding the presence of women on the board to give a positive effect to stakeholders that women play an important role in decision making. Banks must also adjust the composition of female commissioners with a threshold of two people to maximize their function as supervisors.Originality/valueThis is the first research conducted on the banking sector in Indonesia as a developing country that adheres to a two-tier system. The results of this study provide evidence that patriarchal culture is still dominant in Indonesia.

Determinant Factors of Cyber Security Disclosure: A Systematic Literature Review

Cyber security disclosures as risk factor disclosures are particularly important. The importance of cyber security disclosure decisions is intensified by a significant number of data breaches that occur throughout the year raising serious concerns about corporate cyber security programs. Costs of data breaches can be significant. On the other hand, research on cyber security disclosure is still rare. This study aims to identify the factors that influence cyber security disclosures. Articles from various international journals were reviewed. Literature review was conducted to find determinant factors that determine cyber security disclosures. The results show that the determinant factors of cyber security disclosures are cyber security breach/previous cyber incidents, peer breach, public attention, WFH, board size, board independence, board gender diversity, institutional shareholders, foreign shareholders, capital expenditure, intangible asset, firm’s size, firm’s growth, firm’s leverage, firm’s profitability, firm’s loss, industry, guidance, technology committee, and executive change. Based on the literature review, the authors provide suggestions for future research. This research contributes by providing a comprehensive discussion of the determinant factors of cybersecurity disclosure from various studies. The limitation of this study is that the authors only reviewed articles published in English. Future research must include articles published in multiple languages. Keywords: cyber, cybersecurity, disclosure, cybersecurity disclosure, determinants

Securities Disclosure of Scope 3 GHG Emission—Observation of U.S. Law

Securities Disclosure of Scope 3 GHG Emission—Observation of U.S. Law

정보보호최고책임자의 겸직과 정보보호 성과: 정보보호 공시 데이터를 중심으로

정보보호최고책임자의 겸직과 정보보호 성과: 정보보호 공시 데이터를 중심으로

There’s a Strong Wind a’Blowing re Security Disclosures: Lessons Learned from SolarWinds — An analysis of the significance of the SolarWinds case for companies with making security statements on websites and in public filings

Abstract For years now, we have been advising clients to be cautious about including overly broad, or overly detailed, statements in their online privacy policies, noting that the FTC has in the past interpreted such statements as being representations to the market - such that false or misleading statements made therein could constitute misrepresentations. The Securities Exchange Commission complaint last year filed against SolarWinds Corp. and Timothy G. Brown (between July 2017 and December 2020, the Vice President of Security and Architecture and head of the Information Security group, and as of January 2021, the Chief Information Security Officer, for SolarWinds Corp.) has now made it clear that the same risk applies to public statements regarding the state of security of an organization. The SEC complaint raises additional related issues, however: namely, to what extent are organizations required to detail instances of non-compliance with their security policies in their public security disclosures; and to what extent should software companies be held to a higher standard of cybersecurity disclosure. This article proves the background to the SEC complaint (I.); provides a overview of the SEC complaint’s critique of the online security statement published by SolarWinds, and the security disclosures in the securities filings of SolarWinds (II.); outlines the challenges posed by the SEC approach in the SEC complaint and the resulting blowback, in particular from chief information security officers (III.); highlights three key lessons learned from the SEC complaint (IV.); and concludes (V.) with a warning as to what this means for organizations publishing online security statements.

기업의 정보보호 수준과 감사노력과의 관련성에 관한 연구

[Purpose]Recently, the importance of information protection has been emerged with the increasing number of cases of cyber security incidents toward companies. In this study, we examine whether there is relevant implication to the input of additional audit efforts from the auditor’s point of view, whose work includes checking additional efforts invested by companies to improve the level of information protection by linking them with internal control risks. [Methodology]A regression analysis was conducted based on a sample constructed from TS2000 and the information security disclosure portal sites. [Findings]Results of the study show that there is a positive (＋) relationship between the level of information protection (investment amount, manpower) and audit effort (fee, hour). In addition, there is a positive (＋) relationship between information protection investment per person and audit effort, but the higher amount of information protection investment among the amount of technology investment might influence relationship, which reminded us of the need to appropriately consider the size of investment and the size of manpower in information security. [Implications]This study contributes by suggesting that it is possible to study the accounting aspect in the field of information protection and, at the same time, contributes to the expansion of related literature. In addition, by selecting information protection rather than external intrusion (hacking) as a substitute for cyber security, it is differentiated from previous studies by showing that it is possible to identify a relatively small sample to conduct empirical tests. However, since the mandatory information security disclosure system is in its infancy and the sample was selected based on compulsory disclosure and voluntary disclosure, it did not cover the entire industry and various sizes of companies, so care must be taken in interpreting the results.

Blockchain‐based IoT architecture to secure healthcare system using identity‐based encryption

AbstractNowadays, blockchain and Internet of Things (IoT) are two emerging areas of the Information Technology (IT) sector. These two emerging areas are used in various fields, such as supply chain, logistics and automotive industry. Due to the low processing power and storage space of IoT devices, users' medical information is usually saved in a centralized third party like a clinical repository or a cloud computing environment. Thus, in many cases, users lose control of their medical information, which can result in security disclosure and a single‐point impediment. So, an advanced solution is required to improve the data sharing process, while restricting it in terms of security. Blockchain technology with IoT can significantly affect the healthcare industry by improving its efficiency, security and transparency, as well as can provide more business opportunities. The efficient sharing of Electronic Health Record (EHR) can improve the treatment process, diagnosis accuracy, security and privacy. This article proposes a blockchain‐based IoT architecture to provide enhanced security of healthcare data by using Identity‐Based Encryption (IBE) algorithm. Here, the smart contract defines all the basic operations of the healthcare system, which can be beneficial to all stakeholders. Many experiments are executed to evaluate the efficiency of the proposed scheme. The results show that the proposed scheme is better than the existing renowned schemes.

Англійська правнича мова: труднощі та шляхи їх подолання

Abstract. This article is devoted to the study of legal English and its main characteristics. Legal language is the language used by legal professionals in their professional activity. That fact that historically legal English developed separately from the plain English made it difficult for understanding by laypeople. People find the traditional legal writing in such documents as jury instructions, security disclosures, credit card agreements, apartment leases, cell phone contract, promissory note etc. Even native English speakers often complain that they cannot fully understand the documents written to give them information. The understanding of legal English has been a problem for centuries. It was the cause why the plain English movement arose in the 1970s. The purpose of the movement was to simplify the legal writing, make it simple and clear for average people. This problem arises not only for those people whose native language is English. Nonnative speakers also struggle with the complexity of English legal writing. Ukrainian legal professionals that engaged in the area of international, business or corporate law, have to draft documents in English. Sometimes that could be a real problem because unlike English and American legal schools, the majority of ours don't provide the separate course of English legal writing. The purpose of this article is to give practical advice to Ukrainian lawyers and interpreters, how, taking into account the peculiarities of legal English discourse, to draft documents in clear, simple and understandable way. Results of research. A lot of English and American scientists, lawyers as well as linguists, devoted their studies to the plain English movement. Analysis of their works shows that four major factors had influenced on the development of legal English: historical, sociological, political and jurisprudential. Owing to them legal English is full of words of foreign origin, archaisms, argots and terms of art. These factors also caused the frequent usage of formal words, common usage of common words with uncommon meaning, deliberate ambiguity in legal writing. The studies of legal writing by lawyers have focused basically on vocabulary. Linguists in their researchers have identified some other features: overly complex sentences, passives, nominalizations, multiple negations, archaisms and jargon, inappropriate document design. Described ways of simplifying legal English are quite easy to use. Taking into account tips mentioned in the article, legal professionals will be able to draft documents that will be clear and understandable for general public.

Crowdsourcing System using Blockchain Technology

Crowdsourcing frameworks have been receiving a lot of enthusiastic acceptance these days, and there has been a rise in significant raise in concern as well. Crowdsourcing frameworks are excellent tools that can coordinate the human insights of specific instances, and organizations together globally and help comprehend and collaborate intricate chore. Notwithstanding, these central structures subject to the inadequacies of the trusted standard like standard financial foundations. For example, single motivation behind dissatisfaction, higher organizations cost, and security disclosure. An idea is to use a shared structure for crowdsourcing basis blockchain, wherein the work of the requester is directed by the swarm of workers without relying on central freely supporting systems or foretold customers that are inclined to organizations with enrolling certifiable characters. In thought, the proposed framework design would permit Users to enroll, post, or get an endeavor securely. The design would likewise furnish clients with undeniable degree of protection, and security, and the proposed system additionally has low administration costs. By extending the adaptability and adaptability of publicly supporting the reason for existing is to show the crowdsourcing logic with intelligent contract. As per this structure, a requester needs to deposit the venture money, while posting task. The stored deposited amount is escrowed with the framework, and on the concurred task fruition, the laborer will get the undertaking amount from the escrow. Because of this system, a requester won't need to pay more than what an assignment merits, as indicated by a rule unveiled when errand is posted; and every laborer will unquestionably get an installment dependent on the rules.

The American Advantage in Civil Procedure? An Autopsy of the Deutsche Telekom Litigation

This article examines the influence of civil procedure on the legal framework that supports securities markets in the U.S. and in Germany, two very different legal systems. It does so by way of comparing parallel shareholder actions against Deutsche Telekom for securities disclosure violations arising out of the same facts and allegations – the first set of actions filed in federal district court in Manhattan, the second filed in district court in Frankfurt, Germany.Deutsche Telekom was accused in both actions of misrepresenting the value of its real-estate holdings in its financial disclosures and for failing to disclose negotiations for the acquisition of the U.S. Company VoiceStream in its July 2000 offering prospectus.But the cases proceeded very differently and produced dramatically different outcomes. Within five years, and after full discovery, the U.S. class action plaintiffs negotiated a $120 million settlement with the Deutsche Telekom defendants. Meanwhile, the parallel claims by German shareholders, the first of which were filed in 2001, were ultimately dismissed by the German courts in 2012. Until now the German shareholders have received nothing, even after the German Bundestag had adopted a new and unprecedented aggregate litigation mechanism in late 2004 (dubbed “the Deutsche Telekom law”) to afford thousands of complaining German shareholders a reasonable mechanism for pursuing a just and speedier resolution of their claims against the DT defendants.The article also engages claims about the importance of litigation discovery for corporate and securities laws advanced by Michael Halberstam and Erica Gorga in Litigation Discovery and Corporate Governance: The Missing Story About “The Genius of American Corporate Law” 63 Emory Law Review 1383 (2014).

Концептуальні засади функціонування обліково-аналітичного забезпечення управління економічною безпекою підприємств

Competitive positions and indicators of efficiency of business structures of various organizational and legal forms are connected with the level of their economic security. Economic security is the set of principles, tools and forms of protection against threats of internal and external environment for the purpose of receiving the maximum profit and minimizing influence of risks of business activity. Among the complex of components of economic security management of agricultural enterprises, an important place is given to accounting and analytical support, through which causal links between economic life and management decisions. The effectiveness of management decisions of managers of various levels to strengthen the level of economic security of enterprises depends on timely, relevant and reliable information about the availability and movement of assets and sources of their formation. The article is devoted to substantiation of conceptual bases of functioning of accounting and analytical support of economic security management of the enterprises. Conceptual bases of functioning of accounting and analytical support of economic security management of the enterprises which are based on transformation and achievement of synergy of the purpose, principles, tasks, methodology, methodical support and modification of functional orientation to achieve the expected results as to maximum strengthening of economic security of the business entities have been developed and provide for separation of accounting and analytical and management modules and provide for gradual rethinking and deepening of the subject of accounting, which is not limited only to the technical reflection of business transactions, but also by building security-oriented accounting policy and disclosure of economic security in the integrated reporting is the determining information driver of risk management and strategic development of the agricultural enterprises. It has been proved that the core of the functioning of accounting and analytical support of economic security management of the agricultural enterprises is the security modification of the accounting objects.

Testing good securities disclosure: Tales of the reasonable investor

The reasonable investor test has developed in Australia both in the law of misleading and deceptive conduct in relation to securities and in the enquiry into the materiality of information in the stock market context. The former involves the question of whether a reasonable investor would have been influenced by misleading conduct, whereas the latter involves the question of whether a reasonable investor or person would expect that information would have caused investors to trade or otherwise act (the two issues can clearly be related). The test raises various issues including how it applies to a diverse class and whether it is interchangeable with a market test (the writer argues it is not). The test also exists in the United States and has been raised, but then specifically rejected, by the courts in Ireland. The development of behavioural law and economics leads to the question of whether the test can, or should, be modified in view of the allegedly non-rational attributes of investors. The author argues that the test has sufficient flexibility to accommodate such attributes in appropriate cases.

Not Everything is About Investors: The Case for Mandatory Stakeholder Disclosure

Corporations are constantly required to disclose information, but only the federal securities laws impose generalized public disclosure obligations that offer a holistic overview of corporate operations. Though these disclosures are intended to benefit investors, they are accessible by anyone, and thus have long been relied upon by regulators, competitors, employees, and local communities to provide a working portrait of the country’s economic life. Today, that system is breaking down. Congress and the SEC have made it easier for companies to raise capital without becoming subject to the securities disclosure system, allowing modern businesses to grow to enormous proportions while leaving the public in the dark about their operations. Meanwhile, the governmentally-conferred informational advantage of large investors allows them to tilt managers’ behavior in their favor, at the expense of consumers, employees, and other corporate stakeholders. As a result, securities disclosures do not provide the comprehensive picture necessary to maintain social control over corporate behavior. This Article recommends that we explicitly acknowledge the importance of disclosure for noninvestor audiences, and discuss the feasibility of designing a disclosure system geared to their interests. In so doing, this Article excavates the historical pedigree of proposals for stakeholder-oriented disclosure. Both in the Progressive Era, and again during the 1970s, efforts to create generalized corporate disclosure obligations were commonplace. In each era, however, they were redirected towards investor audiences, in the expectation that investors would serve as a proxy for the broader society. As this Article establishes, that compromise is no longer tenable.

Biometric Presentation Attack Detection: Beyond the Visible Spectrum

The increased need for unattended authentication in multiple scenarios has motivated a wide deployment of biometric systems in the last few years. This has in turn led to the disclosure of security concerns specifically related to biometric systems. Among them, Presentation Attacks (PAs, i.e., attempts to log into the system with a fake biometric characteristic or presentation attack instrument) pose a severe threat to the security of the system: any person could eventually fabricate or order a gummy finger or face mask to impersonate someone else. The biometrics community has thus made a considerable effort to the development of automatic Presentation Attack Detection (PAD) mechanisms, for instance through the international LivDet competitions. In this context, we present a novel fingerprint PAD scheme based on $i)$ a new capture device able to acquire images within the short wave infrared (SWIR) spectrum, and $ii)$ an in-depth analysis of several state-of-the-art techniques based on both handcrafted and deep learning features. The approach is evaluated on a database comprising over 4700 samples, stemming from 562 different subjects and 35 different presentation attack instrument (PAI) species. The results show the soundness of the proposed approach with a detection equal error rate (D-EER) as low as 1.36\% even in a realistic scenario where five different PAI species are considered only for testing purposes (i.e., unknown attacks).

Securities Disclosure As Soundbite: The Case of CEO Pay Ratios

This Article analyzes the history, design, and effectiveness of the highly controversial CEO pay ratio disclosure rule, which went into effect in 2018. Based on a regulatory mandate contained in the Dodd-Frank Act of 2010, the rule requires public companies to disclose the ratio between CEO pay and median worker pay as part of their annual filings with the Securities and Exchange Commission (SEC). The seven-year rulemaking process was politically contentious and generated a level of public engagement that was virtually unprecedented in the long history of the SEC disclosure regime. The SEC sought to minimize compliance costs by providing firms with maximum methodological flexibility, expressly foregoing any effort to ensure data comparability across firms. The sizable pay gaps highlighted by the newly reported pay ratios attracted extensive attention from the media and various non-corporate constituencies, fueling public outrage, motivating new proposed legislation, and reinforcing concerns over pay inequity and economic inequality. At the same time, the pay ratio’s role in investor decisionmaking remains uncertain. We suggest that the pay ratio disclosure rule represents a unique approach to disclosure, which we term disclosure-as-soundbite. This approach is characterized by (1) high public salience — the pay ratio is superficially intuitive and resonates with the public to an extent much greater than other disclosure, and (2) low informational integrity — the pay ratio is a relative outlier in terms of certain baseline characteristics of disclosure, meaning that the information is lacking in accuracy, difficult to interpret, and incomplete. We find that in its current formulation, the rule is ineffectual and potentially counterproductive when viewed as a means of generating useful and reliable information for investors, or influencing firm behavior on matters of worker and executive compensation. The pay ratio is more successful in fomenting or contributing to public discourse on broader societal matters relating to pay inequity and economic inequality, though the quality of the underlying information likely limits the quality of the discourse. Given the low probability of legislative action in this area in the near term, we propose that the SEC should seek to improve the rule’s informational integrity by mandating a narrative disclosure approach that provides information about median worker pay and the resulting pay ratio with more context, nuance, and explanation. This would be consistent with the format of existing disclosure requirements relating to executive compensation, and it would represent a positive move away from the disclosure-as-soundbite approach. A related and broader question about the need for disclosure of non-executive compensation and human capital management practices deserves further academic study.

How Cheap is Corporate Talk?

When companies face adverse proposed rules, they may want to convince regulators that the proposed rules are unworkable and should be changed while, at the same time, reassuring investors that the rules will be manageable. These conflicting incentives may lead to inconsistent messages in regulatory comments and securities disclosures, fueling a perception that corporate submissions to regulators are cheap talk. Despite this perception, there has been no empirical study comparing statements to these two audiences. This project performs such a study, taking the example of comments submitted on the Environmental Protection Agency's Renewable Fuel Standard. This standard provides an ideal case study because controversial annual rulemakings have created a rich dataset of company comments that can be compared to contemporaneous security disclosures from the same companies. The empirical study demonstrates that oil companies do send inconsistent messages to their two audiences — warning regulators and reassuring investors. The article suggests that regulators use this methodology to assess the sincerity of industry warnings about the cost of regulation. Private and public enforcers of security disclosure laws should also use this method to identify companies that are hiding regulatory risks. Finally, now that a company's comments can be compared with its securities disclosures, corporate counsel should align company statements to avoid securities litigation and enhance the company's credibility in each forum.

The smartness paradox: the moderating effect of brand quality reputation on consumers' reactions to RFID-based smart fitting rooms

With the growing prevalence among retailers to create a unique shopping experience, RFID-based smart fitting rooms are gaining popularity. These RFID-based smart fitting rooms tend to gather consumer data for a better personalized experience. Drawing from cue congruity and cue scope literature, this research explores the impact of RFID-based smart fitting rooms on consumer perceptions of the shopping experience, privacy, and purchase intentions. Results from two studies indicate that RFID-based smart fitting rooms will only have a positive effect for brands with high-quality reputations. However, in the presence of Federal Trade Commission (FTC) data security disclosure, consumers react favorably towards RFID-based smart fitting rooms regardless of brand quality reputation. The findings indicate that perceived shopping satisfaction and perceived privacy will mediate these effects on purchase intention. The authors discuss implications of the findings, especially about the effective reach of RFID-based smart fitting rooms for brands with varying quality reputations.

Russian Capital Markets and Shareholder Litigation: Quo Vadis?

This Article examines Russian securities law, case law, and market data. To an international observer, Russian capital markets and securities law may appear ostensibly ordinary, albeit placed within an unstable socioeconomic milieu. Securities law and disclosure rules seem somewhat similar to those in the U.S., whereas corporate law provisions are an amalgam of U.S.-U.K.-West European principles. At the same time, a number of hidden trends affect capital markets, the heart of any economy. Those trends upend this fluid Westernized amalgam and may even be linked to the communist past of the country. The capital market portico is typically propped up by robust market infrastructure, public enforcement, private actions, and disclosure rules. Reporting rules enable investors and regulators to act upon the information and improve market monitoring. Out of the four elements, it appears that only the Russian reporting requirements are of adequate quality. Does this single pillar provide sufficient support to the Russian capital markets? It is unlikely that without better shareholder monitoring and more efficient market infrastructure, the mandatory disclosure regime will single-handedly prop up the capital market machinery. The Article urges Russian policymakers to take, first, a more pro-shareholder and pro-plaintiff view on private litigation, public enforcement, and corporate governance, and, second, a more pro-private-exchange policy stance.

Securities Disclosure Reform

The adverse impact of the current securities disclosure regime on small entrepreneurial and start-up firms, as well as on innovation, job creation, and economic growth is substantial. Moreover, disclosure requirements have become so voluminous that they obfuscate rather than inform. This paper outlines a program of interim reforms to improve the existing disclosure regime. It recommends specific changes to Regulation A, crowdfunding, Regulation D, and the regulation of small public companies and of secondary markets to improve the current regulatory environment. This paper also outlines a program of fundamental reform that would dramatically simplify the existing disclosure regime to the benefit of both investors and issuers. This proposal would replace the current 14 disclosure categories with three disclosure regimes—public, quasi-public, and private—and disclosure under the first two categories would be scaled based on either public float or the number of beneficial shareholders.

Selective Trading of Available-for-Sale Securities: Evidence from U.S. Commercial Banks

This paper examines the selective trading of available-for-sale (AFS) securities by U.S. banks after the implementation of fair value accounting under Statement of Financial Accounting Standards No. 115, Accounting Standards Codification Topic 320. Our findings suggest firms still engage in earnings management through selective selling of AFS securities despite the mandatory disclosure of unrealized security holding gains and losses in their financial statements. Such activities do not appear to be driven by the lack of reliability of the fair value measure. Instead, the degree of earnings management varies significantly with the reporting format of unrealized AFS security holding gains and losses. We find evidence of earnings management among banks that choose to report unrealized holding gains and losses in the statement of shareholders’ equity. By contrast, we find no such evidence among banks disclosing unrealized holding gains and losses in the income statement.