CYBERSECURITY RISK DISCLOSURE IN ANNUAL REPORTS: A CONCEPTUAL FRAMEWORK WITH INSIGHTS FROM MALAYSIA

Abstract

As firms become increasingly dependent on digital technologies, cybersecurity has emerged as a critical governance and reporting issue. Consequently, stakeholders are demanding more transparent and decision-useful cybersecurity risk disclosure (CRD). Although regulatory expectations for cybersecurity reporting have increased, prior studies indicate that CRD remains largely boilerplate, inconsistent, and insufficient for stakeholder decision-making. Moreover, limited research has developed an integrated theoretical framework explaining the factors that influence the quality of CRD, particularly in emerging markets. This study proposes an integrated conceptual framework that explains how governance mechanism, regulatory pressures, and proprietary cost considerations jointly influence the quality of cybersecurity risk disclosure. Drawing on signalling theory, proprietary cost theory, and corporate governance theory, the proposed framework examines how board cybersecurity expertise, regulatory enforcement, and proprietary cost consideration shape firms’ cybersecurity disclosure decisions. The model represents firm's selective disclosure of cybersecurity information, providing testable propositions for future empirical work. Malaysia provides a distinctive research context because of its concentrated ownership structure, varying levels of board cybersecurity expertise, and evolving regulatory expectations under Bursa Malaysia and the Malaysian Code of Conduct Governance (MCCG). The proposed framework extends the accounting and information systems literature by providing a theoretically grounded basis for examining cybersecurity risk disclosure risk disclosure quality in emerging markets and offers testable propositions for future empirical research.