Disclosure of IT-related risk factors in corporate filings

Abstract

This research investigates the disclosure of IT-related risk factors in U.S. public firms' periodic SEC filings. Drawing upon the Resource-Based View theory, we propose that a firm's IT capability determines the disclosure of its overall IT-related risk factors. We employ a machine learning-enhanced dictionary that captures emerging IT keywords from newly filed corporate reports to quantify the scope and specificity of such disclosures. Our findings indicate that IT capability enhances IT-related risk factor disclosures in general and specifically in response to adverse IT events, such as data breaches. We also find that disclosing IT-related risk factors reduces a firm's perceived risk and enhances its shareholder value. Our research underscores the critical yet under-researched role of IT capability in shaping disclosures of IT-related risk factors and highlights such disclosures' informational value to investors.