Investors’ Judgment and Decisions after a Cybersecurity Breach: Understanding the Value Relevance of Cybersecurity Risk Management Assurance

• In Event: Big Data and Technology Issues

Abstract

This study investigates how voluntary cybersecurity risk management assurance affects non-professional investors’ judgments and decisions based on whether such assurance violate or conform to users’ expectations. I predict and find that companies that engage in voluntary cybersecurity risk management assurance receive higher stock price valuations and more favorable investor assessments of management credibility. Moreover, I find that investors’ assessments of management credibility and stock price valuations are more extreme in the presence of positive and negative violations. Further analysis reveals that investors’ perceived benefits of assurance-as-insurance and perceived accountants’ cyber-expertise are important determinants of investors’ decision behavior. Further analysis also sheds light on the benefits and potential penalties associated with a firm’s in-house cyber-risk management practices. The results have implications for both regulators currently engaged in developing cybersecurity disclosure requirements and professionals providing voluntary assurance services. This study adds to the literature and theory exploring the value relevance of voluntary assurance services.

Author

• Patricia Navarro, University of Central Florida