Pub Date : 2022-12-01DOI: 10.1016/j.accinf.2022.100577
Theophanis C. Stratopoulos , Victor Xiaoqi Wang
This paper proposes a method for estimating the expected duration of competitive advantage from emerging technology adoption for the average adopting firm. The proposed method relies on publicly available data (e.g., web search interest, news articles, book titles, and firm disclosures) and integrates elements from diffusion of innovation theory, hype cycles, and resource-based view of competitive advantage. We validate this method by applying it to two mature technologies, namely ERP and cloud computing, for which we come up with estimates consistent with findings from prior studies. Leveraging our method, researchers and professionals can use readily available data to make their own estimations. Such estimates can inform researchers in answering research questions related to duration of competitive advantage from technology adoption. They can inform professionals in making better business decisions such as forecasting the net present value of an investment in an emerging technology.
{"title":"Estimating the duration of competitive advantage from emerging technology adoption","authors":"Theophanis C. Stratopoulos , Victor Xiaoqi Wang","doi":"10.1016/j.accinf.2022.100577","DOIUrl":"10.1016/j.accinf.2022.100577","url":null,"abstract":"<div><p>This paper proposes a method for estimating the expected duration of competitive advantage from emerging technology adoption for the average adopting firm. The proposed method relies on publicly available data (e.g., web search interest, news articles, book titles, and firm disclosures) and integrates elements from diffusion of innovation theory, hype cycles, and resource-based view of competitive advantage. We validate this method by applying it to two mature technologies, namely ERP and cloud computing, for which we come up with estimates consistent with findings from prior studies. Leveraging our method, researchers and professionals can use readily available data to make their own estimations. Such estimates can inform researchers in answering research questions related to duration of competitive advantage from technology adoption. They can inform professionals in making better business decisions such as forecasting the net present value of an investment in an emerging technology<em>.</em></p></div>","PeriodicalId":47170,"journal":{"name":"International Journal of Accounting Information Systems","volume":"47 ","pages":"Article 100577"},"PeriodicalIF":4.6,"publicationDate":"2022-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133101384","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"管理学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2022-12-01DOI: 10.1016/j.accinf.2022.100575
Guido L. Geerts , Daniel E. O'Leary
This paper examines the “V-Matrix” and provides a wave theory life cycle model of organizations’ adoption of big data. The V-Matrix is based on the big data five “V’s”: Volume, Velocity, Variety, Veracity, and Value and captures and enumerates the different potential states that an organization can go through as part of its adoption and evolution towards big data. We extend the V-Matrix to a state space approach in order to provide a characterization of the adoption of big data technologies in an organization. We develop and use a wave theory of implementation to accommodate a firm’s movement through the V-Matrix. Accordingly, the V-Matrix provides a life cycle model of organizational use of the different aspects of big data. In addition, the model can help organizations’ plan for decision-making use of big data as they anticipate movement from one state to another, as they add big data capabilities. As part of this analysis, the paper examines some of the issues that occur in the different states, including synergies and other issues associated with co-occurrence of different V’s with each other. Finally, this paper integrates the V-Matrix with other data analytic life cycles and examines some of the implications of those models.
{"title":"V-Matrix: A wave theory of value creation for big data","authors":"Guido L. Geerts , Daniel E. O'Leary","doi":"10.1016/j.accinf.2022.100575","DOIUrl":"10.1016/j.accinf.2022.100575","url":null,"abstract":"<div><p>This paper examines the “V-Matrix” and provides a wave theory life cycle model of organizations’ adoption of big data. The V-Matrix is based on the big data five “V’s”: Volume, Velocity, Variety, Veracity, and Value and captures and enumerates the different potential states that an organization can go through as part of its adoption and evolution towards big data. We extend the V-Matrix to a state space approach in order to provide a characterization of the adoption of big data technologies in an organization. We develop and use a wave theory of implementation to accommodate a firm’s movement through the V-Matrix. Accordingly, the V-Matrix provides a life cycle model of organizational use of the different aspects of big data. In addition, the model can help organizations’ plan for decision-making use of big data as they anticipate movement from one state to another, as they add big data capabilities. As part of this analysis, the paper examines some of the issues that occur in the different states, including synergies and other issues associated with co-occurrence of different V’s with each other. Finally, this paper integrates the V-Matrix with other data analytic life cycles and examines some of the implications of those models.</p></div>","PeriodicalId":47170,"journal":{"name":"International Journal of Accounting Information Systems","volume":"47 ","pages":"Article 100575"},"PeriodicalIF":4.6,"publicationDate":"2022-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128645977","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"管理学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2022-12-01DOI: 10.1016/j.accinf.2022.100574
Jongkyum Kim , Jee-Hae Lim , Kyunghee Yoon
Using 86,891 tweets, from the official corporate Twitter accounts of 715 unique firms, this study examines whether and how managers strategically attract and distract investors’ attention from corporate news through Twitter. We find that firms with good earnings news use Twitter to post more earnings-related information directly, whereas firms with bad earnings news post more non-earnings-related information on Twitter. We further find that depending on earnings performance firms strategically choose the format of tweets (qualitative or quantitative) and the tone of earnings tweets (positive or negative) to attract investors’ attention to good news or distract investors’ attention from bad news. Our results are robust to difference-in-differences (DID), alternative sample periods, and different variable specifications. Our findings provide empirical evidence for investors and regulators regarding current practices in corporate information on Twitter.
{"title":"How do the content, format, and tone of Twitter-based corporate disclosure vary depending on earnings performance?","authors":"Jongkyum Kim , Jee-Hae Lim , Kyunghee Yoon","doi":"10.1016/j.accinf.2022.100574","DOIUrl":"10.1016/j.accinf.2022.100574","url":null,"abstract":"<div><p>Using 86,891 tweets, from the official corporate Twitter accounts of 715 unique firms, this study examines whether and how managers strategically attract and distract investors’ attention from corporate news through Twitter. We find that firms with good earnings news use Twitter to post more earnings-related information directly, whereas firms with bad earnings news post more non-earnings-related information on Twitter. We further find that depending on earnings performance firms strategically choose the format of tweets (qualitative or quantitative) and the tone of earnings tweets (positive or negative) to attract investors’ attention to good news or distract investors’ attention from bad news. Our results are robust to difference-in-differences (DID), alternative sample periods, and different variable specifications. Our findings provide empirical evidence for investors and regulators regarding current practices in corporate information on Twitter.</p></div>","PeriodicalId":47170,"journal":{"name":"International Journal of Accounting Information Systems","volume":"47 ","pages":"Article 100574"},"PeriodicalIF":4.6,"publicationDate":"2022-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131778244","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"管理学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Enterprise resource planning (ERP) is critical to an organization’s success. However, the factors that contribute to the success and usage of these ERP systems have received little attention. This study developed and validation of an improved DeLone-McLean IS success model. Additionally, we examined the factors which influence ERP system usage, employee satisfaction, information quality, service quality, and system quality, as well as the factors that influence the system’s overall success. The proposed model is based on a mixed-methods case study (MM-CS). The results show that the proposed model significantly measures the success of an ERP system. The organizational climate, the information quality, the system quality, and the service quality all have an impact on the usage of an ERP system. The proposed model also shows that the use of an ERP system, training and learning, and the three information (IS) quality constructs are all significant predictors of user satisfaction. The results also indicate that gender and years of ICT use on the path of ERP users have a moderating effect on the relationship between teamwork & support and use.
{"title":"Development and validation of an improved DeLone-McLean IS success model - application to the evaluation of a tax administration ERP","authors":"Godwin Banafo Akrong , Shao Yunfei , Ebenezer Owusu","doi":"10.1016/j.accinf.2022.100579","DOIUrl":"10.1016/j.accinf.2022.100579","url":null,"abstract":"<div><p>Enterprise resource planning (ERP) is critical to an organization’s success. However, the factors that contribute to the success and usage of these ERP systems have received little attention. This study developed and validation of an improved DeLone-McLean IS success model. Additionally, we examined the factors which influence ERP system usage, employee satisfaction, information quality, service quality, and system quality, as well as the factors that influence the system’s overall success. The proposed model is based on a mixed-methods case study (MM-CS). The results show that the proposed model significantly measures the success of an ERP system. The organizational climate, the information quality, the system quality, and the service quality all have an impact on the usage of an ERP system. The proposed model also shows that the use of an ERP system, training and learning, and the three information (IS) quality constructs are all significant predictors of user satisfaction. The results also indicate that gender and years of ICT use on the path of ERP users have a moderating effect on the relationship between teamwork & support and use.</p></div>","PeriodicalId":47170,"journal":{"name":"International Journal of Accounting Information Systems","volume":"47 ","pages":"Article 100579"},"PeriodicalIF":4.6,"publicationDate":"2022-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129449374","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"管理学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2022-12-01DOI: 10.1016/j.accinf.2022.100576
So Young Jun , Dong Sung Kim , Suk Yoon Jung , Sang Gyung Jun , Jong Woo Kim
We propose an intermediate-term stock investment strategy based on fundamental analysis and machine learning. The approach uses predictors from the Earnings Power Index (EPI) as input variables derived from cross-sectional and time-series data from a company’s financial statements. The analytical methods of machine learning allow us to validate the link between financial factors and excess returns directly. We then select stocks for which returns are likely to increase at the time of the next disclosed financial statement. To verify the proposed approach’s usefulness, we use company data listed publicly on the Korean stock market from 2013 to 2019. We examine the profitability of trading strategy based on ten machine-learning techniques by forming long, short, and hedge portfolios with three different measures. As a result, most portfolios, including EPI-related variables, present positive returns regardless of the period. Especially, the neural network of the two layers with sigmoid function presents the best performance for the period of 3 months and 6 months, respectively. Our results show that incorporating machine learning is useful for mid-term stock investment. Further research into the possible convergence of financial statement analysis and machine-learning techniques is warranted.
{"title":"Stock investment strategy combining earnings power index and machine learning","authors":"So Young Jun , Dong Sung Kim , Suk Yoon Jung , Sang Gyung Jun , Jong Woo Kim","doi":"10.1016/j.accinf.2022.100576","DOIUrl":"10.1016/j.accinf.2022.100576","url":null,"abstract":"<div><p>We propose an intermediate-term stock investment strategy based on fundamental analysis and machine learning. The approach uses predictors from the Earnings Power Index (EPI) as input variables derived from cross-sectional and time-series data from a company’s financial statements. The analytical methods of machine learning allow us to validate the link between financial factors and excess returns directly. We then select stocks for which returns are likely to increase at the time of the next disclosed financial statement. To verify the proposed approach’s usefulness, we use company data listed publicly on the Korean stock market from 2013 to 2019. We examine the profitability of trading strategy based on ten machine-learning techniques by forming long, short, and hedge portfolios with three different measures. As a result, most portfolios, including EPI-related variables, present positive returns regardless of the period. Especially, the neural network of the two layers with sigmoid function presents the best performance for the period of 3 months and 6 months, respectively. Our results show that incorporating machine learning is useful for mid-term stock investment. Further research into the possible convergence of financial statement analysis and machine-learning techniques is warranted.</p></div>","PeriodicalId":47170,"journal":{"name":"International Journal of Accounting Information Systems","volume":"47 ","pages":"Article 100576"},"PeriodicalIF":4.6,"publicationDate":"2022-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134422923","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"管理学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2022-09-01DOI: 10.1016/j.accinf.2022.100572
Chanyuan (Abigail) Zhang , Soohyun Cho , Miklos Vasarhelyi
Artificial Intelligence (AI) and Machine Learning (ML) are gaining increasing attention regarding their potential applications in auditing. One major challenge of their adoption in auditing is the lack of explainability of their results. As AI/ML matures, so do techniques that can enhance the interpretability of AI, a.k.a., Explainable Artificial Intelligence (XAI). This paper introduces XAI techniques to auditing practitioners and researchers. We discuss how different XAI techniques can be used to meet the requirements of audit documentation and audit evidence standards. Furthermore, we demonstrate popular XAI techniques, especially Local Interpretable Model-agnostic Explanations (LIME) and Shapley Additive exPlanations (SHAP), using an auditing task of assessing the risk of material misstatement. This paper contributes to accounting information systems research and practice by introducing XAI techniques to enhance the transparency and interpretability of AI applications applied to auditing tasks.
{"title":"Explainable Artificial Intelligence (XAI) in auditing","authors":"Chanyuan (Abigail) Zhang , Soohyun Cho , Miklos Vasarhelyi","doi":"10.1016/j.accinf.2022.100572","DOIUrl":"10.1016/j.accinf.2022.100572","url":null,"abstract":"<div><p>Artificial Intelligence (AI) and Machine Learning (ML) are gaining increasing attention regarding their potential applications in auditing. One major challenge of their adoption in auditing is the lack of explainability of their results. As AI/ML matures, so do techniques that can enhance the interpretability of AI, a.k.a., Explainable Artificial Intelligence (XAI). This paper introduces XAI techniques to auditing practitioners and researchers. We discuss how different XAI techniques can be used to meet the requirements of audit documentation and audit evidence standards. Furthermore, we demonstrate popular XAI techniques, especially Local Interpretable Model-agnostic Explanations (LIME) and Shapley Additive exPlanations (SHAP), using an auditing task of assessing the risk of material misstatement. This paper contributes to accounting information systems research and practice by introducing XAI techniques to enhance the transparency and interpretability of AI applications applied to auditing tasks.</p></div>","PeriodicalId":47170,"journal":{"name":"International Journal of Accounting Information Systems","volume":"46 ","pages":"Article 100572"},"PeriodicalIF":4.6,"publicationDate":"2022-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125170651","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"管理学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2022-09-01DOI: 10.1016/j.accinf.2022.100571
Heejae Lee , Lu Zhang , Qi Liu , Miklos Vasarhelyi
Business transaction data includes numeric values of the transactions and the date/time when the transactions are recorded, and textual data such as descriptions. Understanding the textual information of business transactions is also important since this information captures the nature of transactions in a qualitative manner. This study proposes a text visual analysis approach for auditing. We argue that combining text analysis and data visualization can improve the efficiency of audit data analytics for textual data in the organization's accounting information system. We provide a demonstration of the proposed method using a year-around general ledger data set. We use data visualization software Orange and Tableau for the demonstration. The proposed method can be used to understand a client's business and identify abnormal or unusual transactions from not only quantitative information but also qualitative information.
{"title":"Text Visual Analysis in Auditing: Data Analytics for Journal Entries Testing","authors":"Heejae Lee , Lu Zhang , Qi Liu , Miklos Vasarhelyi","doi":"10.1016/j.accinf.2022.100571","DOIUrl":"10.1016/j.accinf.2022.100571","url":null,"abstract":"<div><p>Business transaction data includes numeric values of the transactions and the date/time when the transactions are recorded, and textual data such as descriptions. Understanding the textual information of business transactions is also important since this information captures the nature of transactions in a qualitative manner. This study proposes a text visual analysis approach for auditing. We argue that combining text analysis and data visualization can improve the efficiency of audit data analytics for textual data in the organization's accounting information system. We provide a demonstration of the proposed method using a year-around general ledger data set. We use data visualization software Orange and Tableau for the demonstration. The proposed method can be used to understand a client's business and identify abnormal or unusual transactions from not only quantitative information but also qualitative information.</p></div>","PeriodicalId":47170,"journal":{"name":"International Journal of Accounting Information Systems","volume":"46 ","pages":"Article 100571"},"PeriodicalIF":4.6,"publicationDate":"2022-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132924399","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"管理学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2022-09-01DOI: 10.1016/j.accinf.2022.100569
Sheng-Feng Hsieh , Gerard Brennan
Many entities are progressively engaged in crypto asset transactions. The distinct nature of crypto assets from typical financial instruments makes it more challenging for external auditors to provide reasonable assurance on financial statements encompassing material crypto asset activities and transactions. To provide more specific guidance in crypto asset-related audits, this paper aims to (1) identify various participants in the crypto asset ecosystem and illustrate their relationship with the audited entity, (2) identify and elaborate the new challenges and risks for financial statement audits related to the crypto asset ecosystem, and (3) summarize issues to be considered in crypto asset-related audits in an audit framework. The dynamically evolving crypto asset ecosystem not only brings challenges and risks but also new assurance opportunities to the auditing profession after identifying and addressing those critical issues.
{"title":"Issues, risks, and challenges for auditing crypto asset transactions","authors":"Sheng-Feng Hsieh , Gerard Brennan","doi":"10.1016/j.accinf.2022.100569","DOIUrl":"10.1016/j.accinf.2022.100569","url":null,"abstract":"<div><p>Many entities are progressively engaged in crypto asset transactions. The distinct nature of crypto assets from typical financial instruments makes it more challenging for external auditors to provide reasonable assurance on financial statements encompassing material crypto asset activities and transactions. To provide more specific guidance in crypto asset-related audits, this paper aims to (1) identify various participants in the crypto asset ecosystem and illustrate their relationship with the audited entity, (2) identify and elaborate the new challenges and risks for financial statement audits related to the crypto asset ecosystem, and (3) summarize issues to be considered in crypto asset-related audits in an audit framework. The dynamically evolving crypto asset ecosystem not only brings challenges and risks but also new assurance opportunities to the auditing profession after identifying and addressing those critical issues.</p></div>","PeriodicalId":47170,"journal":{"name":"International Journal of Accounting Information Systems","volume":"46 ","pages":"Article 100569"},"PeriodicalIF":4.6,"publicationDate":"2022-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122916351","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"管理学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2022-09-01DOI: 10.1016/j.accinf.2022.100570
Guangyue Zhang, Hilal Atasoy, Miklos A. Vasarhelyi
This paper presents a framework for proactive and intelligent continuous control monitoring (CCM) that helps management gain higher assurance over business processes and alleviate information overload. We adopt a design science approach towards systematically developing CCM artifacts, including operation and internal control violation display and multidimensional anomaly detection. We illustrate the design with an implementation project whereby a CPA firm, the firm's healthcare sector client, and the research team work together to improve the assurance provided by payroll reviews. This study contributes to the CCM literature by envisioning that interactive data visualization and machine learning technologies can alleviate information overload for management in CCM. Second, we provide real-world evidence on the improvement brought to economic and behavioral aspects of the control monitoring process compared to the traditional approach. We show that emerging technologies substantially improve the efficiency and effectiveness of risk assessment, anomaly detection, and loss prevention. We also contribute to control monitoring practice by providing guidance on artifact development and application for practitioners to follow.
{"title":"Continuous monitoring with machine learning and interactive data visualization: An application to a healthcare payroll process","authors":"Guangyue Zhang, Hilal Atasoy, Miklos A. Vasarhelyi","doi":"10.1016/j.accinf.2022.100570","DOIUrl":"10.1016/j.accinf.2022.100570","url":null,"abstract":"<div><p>This paper presents a framework for proactive and intelligent continuous control monitoring (CCM) that helps management gain higher assurance over business processes and alleviate information overload. We adopt a design science approach towards systematically developing CCM artifacts, including operation and internal control violation display and multidimensional anomaly detection. We illustrate the design with an implementation project whereby a CPA firm, the firm's healthcare sector client, and the research team work together to improve the assurance provided by payroll reviews. This study contributes to the CCM literature by envisioning that interactive data visualization and machine learning technologies can alleviate information overload for management in CCM. Second, we provide real-world evidence on the improvement brought to economic and behavioral aspects of the control monitoring process compared to the traditional approach. We show that emerging technologies substantially improve the efficiency and effectiveness of risk assessment, anomaly detection, and loss prevention. We also contribute to control monitoring practice by providing guidance on artifact development and application for practitioners to follow.</p></div>","PeriodicalId":47170,"journal":{"name":"International Journal of Accounting Information Systems","volume":"46 ","pages":"Article 100570"},"PeriodicalIF":4.6,"publicationDate":"2022-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133447879","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"管理学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2022-09-01DOI: 10.1016/j.accinf.2022.100568
Benjamin Blakely , Jim Kurtenbach , Lovila Nowak
A number of institutions make reports available regarding the types, impacts, or origins of cybersecurity breaches. The information content of cyber breach reports is examined in light of Principle 15 of the 2017 Committee on Sponsoring Organizations Enterprise Risk Management (COSO ERM) information security control framework to understand the degree to which cyber breach reports reflect the established COSO internal control framework. This study utilizes the COSO ERM internal control framework to examine whether current cyber breach reports contain information that may influence a firm’s ability to assess substantial change within its industry due to external forces (COSO ERM Principle 15). As such, this study focuses on data breaches, a special type of cyber incident, which may result in the loss of confidential information. Cyber decision makers rely on this type of information to calibrate information security programs to ensure coverage of relevant threats and the efficient use of available funds. These reports may be used for the purposes of cybersecurity risk assessment and strategic planning. We compare, contrast, and analyzie the reports to identify their utility in such contexts. We also provide an overview of the current cybersecurity reporting environment and suggest revisions to US national cyber policy with the intent of increasing the benefit to reporters and consumers of the data.
This study is focused on education as to the current structure of breach reporting based upon our review and synthesis of publicly-available breach reports.
In this study, we review nine (9) reports that meet four (4) criteria. We relate these criteria to the framework provided by COSO ERM Principle 15 by analyzing and placing the criteria into a taxonomy developed for this purpose. We analyze the degree to which the reports are complementary, reflect potential improvements of internal controls, and provide recommendations for ways in which these types of reports might be used by practitioners, while highlighting potential limitations. Our findings indicate that the sample reports contain little information that may be incorporated to improve the risk profile of an entity. We provide recommendations to improve the information content and timeliness of breach reports.
{"title":"Exploring the information content of cyber breach reports and the relationship to internal controls","authors":"Benjamin Blakely , Jim Kurtenbach , Lovila Nowak","doi":"10.1016/j.accinf.2022.100568","DOIUrl":"10.1016/j.accinf.2022.100568","url":null,"abstract":"<div><p>A number of institutions make reports available regarding the types, impacts, or origins of cybersecurity breaches. The information content of cyber breach reports is examined in light of Principle 15 of the 2017 Committee on Sponsoring Organizations Enterprise Risk Management (COSO ERM) information security control framework to understand the degree to which cyber breach reports reflect the established COSO internal control framework. This study utilizes the COSO ERM internal control framework to examine whether current cyber breach reports contain information that may influence a firm’s ability to assess substantial change within its industry due to external forces (COSO ERM Principle 15). As such, this study focuses on data breaches, a special type of cyber incident, which may result in the loss of confidential information. Cyber decision makers rely on this type of information to calibrate information security programs to ensure coverage of relevant threats and the efficient use of available funds. These reports may be used for the purposes of cybersecurity risk assessment and strategic planning. We compare, contrast, and analyzie the reports to identify their utility in such contexts. We also provide an overview of the current cybersecurity reporting environment and suggest revisions to US national cyber policy with the intent of increasing the benefit to reporters and consumers of the data.</p><p>This study is focused on education as to the current structure of breach reporting based upon our review and synthesis of publicly-available breach reports.</p><p>In this study, we review nine (9) reports that meet four (4) criteria. We relate these criteria to the framework provided by COSO ERM Principle 15 by analyzing and placing the criteria into a taxonomy developed for this purpose. We analyze the degree to which the reports are complementary, reflect potential improvements of internal controls, and provide recommendations for ways in which these types of reports might be used by practitioners, while highlighting potential limitations. Our findings indicate that the sample reports contain little information that may be incorporated to improve the risk profile of an entity. We provide recommendations to improve the information content and timeliness of breach reports.</p></div>","PeriodicalId":47170,"journal":{"name":"International Journal of Accounting Information Systems","volume":"46 ","pages":"Article 100568"},"PeriodicalIF":4.6,"publicationDate":"2022-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124890723","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":3,"RegionCategory":"管理学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}