| Abstract: | Cybersecurity has become a topic of great interest since 2010. Accounting issues surrounding cybersecurity governance, management, and disclosure have gained attention from accounting standard setters, large accounting firms, and professional associations, but only a limited number of studies have looked at cybersecurity disclosure. In this study, we examine whether the content of cybersecurity disclosures of Canadian firms comprising the S&P/TSX 60 index is aligned with best practices—that is, financial regulators' guidelines in that matter. A content analysis was performed of documents issued between January 2017 and mid‐2018, consisting of recent annual information forms (AIFs), annual and quarterly management's discussion and analysis (MD&As), proxy circulars, material change reports, and news releases. To assess the nature and extent of cybersecurity disclosure, we developed a scoring grid featuring 40 items based on financial regulators' guidelines. Results show that cybersecurity disclosure levels are low. Companies vary widely in the amount of detail they provide, and the information is often not company‐specific. The variations among industrial sectors involve the categories related to cybersecurity risk, cybersecurity risk mitigation, and other items. Most of the companies provided cybersecurity disclosures in the annual MD&A, and several reiterated some disclosure items in the AIF and proxy circular. The results of this study highlight some areas where cybersecurity disclosures have evolved and others where they could be improved. They suggest that some firms strive to avoid boilerplate language and be more company‐specific. The findings also suggest that financial regulators could issue more stringent requirements. |
