ABSTRACT Many firms cite cyber risk as a primary risk factor due to the increase in cybersecurity breach (CSB) incidents. Existing research focuses on the negative, short-term impacts from CSBs, but the longer-term impact is still unknown. Our study investigates firms' levels of innovation following a CSB as an important determinant of firm growth and profitability. Examining reported breaches from 2005–2014, we find a 10 percent decline in research and development spending in the year following a CSB. Further investigation indicates that firms for which R&D is not the primary business model drive the results. We also provide evidence of a decrease in patents two years after a breach, an increase in cash holdings in the year after the breach, and a decrease in investment efficiency four years following the breach. Our aggregate results suggest that CSBs are associated with future strategic decisions involving firm-level innovation and investment decisions. Data Availability: Data are available from the public sources cited in the text.

ABSTRACT Recent research documents the improvement of Form 8-K disclosure timeliness in the post-Sarbanes-Oxley Act (SOX) era. However, it remains unclear why disclosure timeliness overall has improved, but disclosure timeliness for certain events has not improved. We examine firms' information technology (IT) management and IT governance in order to investigate their potential positive impacts on 8-K reporting timeliness. We find that, on average, IT-expert Chief Executive Officers (CEOs) and firms with board-level technology committees file Form 8-Ks in a timelier manner. Specifically, firms with IT-expert CEOs file a half-day sooner and firms with technology committees file a full-day sooner. Additional analyses show that firms with technology committees file 8-Ks in a timelier manner than firms without technology committees, even when the events are complicated or surprising. In aggregate, our evidence suggests that IT-expert CEOs and IT expertise on the board facilitates efficient IT utilization and is associated with timely disclosure. Data Availability: The data used are publicly available from the sources cited in the text.

ABSTRACT Anecdotal research suggests that management is concerned about how Data Security Breaches (DSBs) impact a firm's financial performance. We investigate: whether managers in DSB firms manipulate earnings through real earnings management (REM) and/or accrual-based earnings management (AEM); how breach type, disclosure delay, and external monitoring impact earnings management activities; and how earnings management activities influence a DSB firm's performance. Using a propensity score matched sample, results suggest that DSB firms are more likely to manipulate earnings via REM, but not AEM. Additionally, we find that DSB firms engage in REM through cutting discretionary expenses, decreasing discretionary cash spending, and reducing the cost of goods sold through overproduction. We find some evidence that firms are more likely to increase REM when DSBs involve financial information or when firms delay the DSB disclosure or have low analyst coverage. We provide evidence that REM activities lead to lower subsequent performance in DSB firms. Data Availability: The data used are publicly available from the sources cited in the text.

ABSTRACT Data security breaches have been shown in the literature to negatively affect firm operations. Auditors serve as an important, external governance mechanism with respect to a firm's overall risk management protocol. Consequently, our study examines whether auditors price breach risk into their fees and if a firm's internal governance can mitigate the potential increases in audit fees. Using a sample of breached firms ranging from 2005–2014, we adapt the Houston, Peters, and Pratt (2005) model to explore how auditors view audit risk related to breach risk. We find that breaches are associated with an increase in fees, but the result is driven by external breaches. Our evidence suggests the presence of board-level risk committees and more active audit committees may help mitigate the breach risk audit fee premium. Additional evidence suggests that both past breach disclosures as well as future disclosures are associated with audit fees.

ABSTRACT The Securities and Exchange Commission's 2009 enhanced proxy disclosure requirements and the updated Committee of Sponsoring Organizations' (COSO) Internal Control Framework have caused organizations to increase their focus on risk management and consider the impact of information technology (IT) in enterprise risk management. Our study examines whether board involvement, board expertise, and top management's risk culture affect the maturity of IT risk management practices (maturity) in firms. We find that board involvement positively influences maturity while top managers' risk-taking behavior is associated with lower maturity. Even though board expertise influences maturity, board involvement is more important in explaining maturity. Maturity is higher in firms where risk oversight lies with a board-level, rather than a management, committee. However, the maturity of ITRM practices does not differ among firms whether risk oversight lies with the overall board, or any other board committee. The findings contribute to an under-researched area in IT governance.

ABSTRACT Accounting standard setting is a high-stakes, political, and market process influenced by constituents through a public commenting mechanism. Comment letters are widely studied by researchers and the Financial Accounting Standards Board (FASB), typically manually because the letters contain unstructured data. Our study employs a topic modeling method, latent Dirichlet allocation (LDA), to overcome the difficulties posed by the unstructured data. We analyze comment letters on two exposure drafts proposed by the FASB in 2008 and 2010 regarding loss contingencies. Results show that LDA is effective in compiling information from unstructured data. LDA also enables us to identify topics and detect shift in focus of the letters responding to the two exposure drafts. The findings have practical implications for standard setters, regulators, and researchers while also contributing to the digital reporting, data analysis, economic theory of democracy, and coalition and influence theory literatures.

ABSTRACT The eXtensible Business Reporting Language (XBRL) represents an electronic reporting standard that has gained global prominence. Yet, almost all XBRL academic research has focused on the Securities and Exchange Commission's mandate with little attention to international regulator XBRL mandates and how the consequent implementations have directly impacted the accounting profession. Accordingly, our field study describes India's Ministry of Corporate Affairs' (MCA) XBRL implementation. The MCA scenario is unique, because it is the first mandatory XBRL implementation that also requires accountant certification, thus increasing the demands placed on accountants. We first report the MCA's underlying motivations and summarize their perceived benefits. Next, we examine the taxonomy and relevant documentation, investigate a sample of 15 filings, and conduct semi-structured interviews with certifying accountants of the 15 filings. Our analysis shows 219 errors post-certification, 190 from company secretaries, which can be classified into four categories and nine subcategories. Additionally, results indicate confusion with regard to XBRL validation, architectural flaws in the taxonomy and a consequent lack of taxonomy understanding, no additional procedures undertaken when certifying accountants detect errors, and a lack of incentive to provide quality certification. In light of the extant literature, we suggest the MCA change its focus from document-level certification to data-level assurance. Our findings serve to advance the evolving XBRL assurance research. Data Availability: Data used are proprietary.

ABSTRACT After several high-profile data security breaches (e.g., Target Corporation, Michaels Stores, Inc., The Home Depot), corporate boards are prioritizing the oversight of Information Technology (IT) risk. Firms are also increasingly faced with disclosure decisions regarding IT security breaches. This study proposes that firms can use the creation of a board-level technology committee as part of the firm's information technology governance (ITG) to signal the firm's ability to detect and respond to security breaches. Using reported security breaches during the time period 2005–2014, results indicate that firms with technology committees are more likely to have reported breaches in a given year than are firms without the committee. Further analysis suggests that this positive association is driven by relatively young technology committees and external source breaches. Specifically, as a technology committee becomes more established, its firm is not as likely to be breached. To obtain further evidence on the perceived value of a technology committee, this study uses a returns analysis and finds that the presence of a technology committee mitigates the negative abnormal stock returns arising from external breaches. Findings add to the evolving ITG literature, as well to the signaling theory and disclosure literatures.

ABSTRACT The Securities and Exchange Commission's enhanced disclosure rule on risk oversight, state laws requiring public disclosure of compromised customer information, and high-profile customer information breaches have caused Information Technology (IT) risk management practices to be a major concern for boards of directors and management. The Committee of Sponsoring Organizations of the Treadway Commission's (COSO) Enterprise Risk Management (ERM) framework emphasizes the importance of the board's oversight role while also bringing attention to the firm's reporting structure. Consequently, our study examines whether the maturity of IT risk management practices depends on Chief Information Officer (CIO) reporting structure and Chief Executive Officer (CEO)/Chairman duality. We develop a scale to measure strategic and operational maturity under the larger auspice of IT risk management and distribute a survey to high-level IT professionals. Our survey also captures the reporting structure of their firms. Consistent with our hypothesis, we find that the maturity of strategic IT risk management practices are higher when the CIO reports directly to the CEO. However, contrary to expectations, we do not find that operational risk management is more mature when the CIO reports to the Chief Financial Officer (CFO). Instead, operational risk management is higher when the CIO reports to the CEO. For public firms, the maturity of IT risk management practices are higher when the CEO is also the chairman of the board of directors. As C-level officers may have asymmetric access to the board, understanding reporting structures may inform firms, regulators, and interested stakeholders on how well IT risk is managed and factors that affect IT governance.

ABSTRACT U.S. adoption of eXtensible Business Reporting Language (XBRL)-enabled technology has been slow. Prior experimental evidence suggests that even when XBRL-enabled technology is available, almost 50 percent of participants do not use it. This study informs AIS researchers on the state of XBRL-enabled technology by using an exclusive choice experimental design to examine (1) which reporting technology nonprofessional investors will choose to complete a financial analysis task (XBRL-enabled, portable document file, or spreadsheet), and (2) why they choose the specific technology. Findings indicate that 66 percent of nonprofessional investors chose XBRL-enabled technology, while 34 percent chose spreadsheets. Participants who chose the former perceived that it reduces the time to complete the task (i.e., increases task efficiency), while participants who chose the latter indicated their choice was driven by prior technology experience. Study results have implications for the Securities and Exchange Commission (SEC), researchers examining nonprofessional investor behavior, user choice literature, and XBRL-enabled technology adoption.