The Impact of the Type of Cybersecurity Assurance Service and Cybersecurity Incidents on Investor Perceptions and Decisions

• In Event: Big Data and Technology Issues

Abstract

In response to increased cybersecurity risk and demand for information about organizations’ cybersecurity risk management programs, the American Institute of Certified Public Accountants (AICPA) recently released a cybersecurity risk management examination service. Similar to a previous AICPA IT-related assurance service called WebTrust, cybersecurity examinations face competition from less comprehensive and costly voluntary assurance service alternatives. Research examining the failure of WebTrust shows that information users do not recognize the value of the more comprehensive assurance services relative to the less costly alternatives (Mauldin and Arunachalam 2002; Gendron and Barrett 2004). In this study, I examine the effect of the type of cybersecurity assurance service on investor perceptions and decisions. I also examine how these effects differ depending on whether a prior cybersecurity incident was reported. Contrary to the WebTrust setting, I find that investors are more willing to invest in the presence of a cybersecurity risk management examination than in the presence of a less comprehensive cybersecurity assurance service. I also find that investor perceptions of assurance quality mediate the relation between type of cybersecurity assurance service and willingness to invest.

Author

• Rebecca Renae Perols, University of South Florida