Business, Sauder School of
Management Information Systems, Division of
DSpace
UBCV
Song, Victor Xiao Peng
Master of Science - MSc
University of British Columbia
As business strategies of many firms and their value creation activities are increasingly more dependent on Information Technology (IT), risks associated with IT become one of the top concerns for corporate boards and managers. This study examines the impact of IT-related risk factor disclosure in Item 1A of the 10-K annual report on stock price crashes. We use a text-mining approach of Latent Dirichlet Allocation topic modeling to identify risk categories in risk disclosures between 2006 and 2017. IT risk emerged as one of the key risk categories. We find that IT risk disclosure increases a firm’s future stock price crash risk. We use grounded theory to further separate IT risk factor disclosures into two broad categories: IT value risk that relates to a firm’s use of and reliance on information technology for its operations to reach its goals and objectives, and cyber security risk that could lead to a loss or leak of data. We find that while the impact of cyber security risk disclosure on a firm’s future crash risk is significant, IT value risk disclosures do not have a significant impact. We also find that the readability, position, and novelty of the IT risk factor disclosure strengthen the relation between the disclosure and the firm’s stock price crash risk.
IT RISK FACTOR DISCLOSURE AND STOCK PRICE CRASHES by Victor Xiao Peng Song B.ASc., The University of British Columbia, 2015 A THESIS SUBMITTED IN PARTIAL FULFILLMENT OF THE REQUIREMENTS FOR THE DEGREE OF MASTER OF SCIENCE IN BUSINESS ADMINISTRATION in THE FACULTY OF GRADUATE AND POSTDOCTORAL STUDIES (Management Information Systems) THE UNIVERSITY OF BRITISH COLUMBIA (Vancouver) April 2020 © Victor Xiao Peng Song, 2020 ii The following individuals certify that they have read, and recommend to the Faculty of Graduate and Postdoctoral Studies for acceptance, a thesis entitled: IT RISK FACTOR DISCLOSURE AND STOCK PRICE CRASHES submitted by Victor Xiao Peng Song in partial fulfillment of the requirements for the degree of Master of Science in Business Administration in Management Information Systems Examining Committee: Dr. Hasan Cavusoglu, Associate Professor, Accounting and Information Systems Division, Sauder School of Business Co-supervisor Dr. Gene Moo Lee, Assistant Professor, Accounting and Information Systems Division, Sauder School of Business Co-supervisor Dr. Ira Yeung, Assistant Professor, Accounting and Information Systems Division, Sauder School of Business Supervisory Committee Member iii Abstract As business strategies of many firms and their value creation activities are increasingly more dependent on Information Technology (IT), risks associated with IT become one of the top concerns for corporate boards and managers. This study examines the impact of IT-related risk factor disclosure in Item 1A of the 10-K annual report on stock price crashes. We use a text-mining approach of Latent Dirichlet Allocation topic modeling to identify risk categories in risk disclosures between 2006 and 2017. IT risk emerged as one of the key risk categories. We find that IT risk disclosure increases a firm’s future stock price crash risk. We use grounded theory to further separate IT risk factor disclosures into two broad categories: IT value risk that relates to a firm’s use of and reliance on information technology for its operations to reach its goals and objectives, and cyber security risk that could lead to a loss or leak of data. We find that while the impact of cyber security risk disclosure on a firm’s future crash risk is significant, IT value risk disclosures do not have a significant impact. We also find that the readability, position, and novelty of the IT risk factor disclosure strengthen the relation between the disclosure and the firm’s stock price crash risk. iv Lay Summary This paper looks at the Risk Factor Disclosures section of firms’ annual financial reports in which companies must disclose potential business risks they are facing. Specifically, we look at IT-related risk disclosures and find that cybersecurity risk disclosures lead to an increased chance of a firm’s stock price crashing in the one-year window after disclosing such a risk. Additionally, we found that cybersecurity risk disclosures that use relatively simple language, that appear near the top of the annual report, and that are new compared to the previous year’s report, respectively, are positively correlated with the probability of a firm’s stock price crashing. This paper contributes to the literature by providing evidence that risk disclosures contain useful information rather than being generic “boilerplate” claims to avoid liabilities, and by being the first to provide a link between IT risk disclosures and long-term stock returns. v Preface This thesis is original, unpublished, independent work by the author, Victor Xiao Peng Song. vi Table of Contents Abstract ......................................................................................................................................... iii Lay Summary ............................................................................................................................... iv Preface .............................................................................................................................................v Table of Contents ......................................................................................................................... vi List of Tables .............................................................................................................................. viii List of Figures .................................................................................................................................x List of Abbreviations ................................................................................................................... xi Acknowledgements ..................................................................................................................... xii Chapter 1: Introduction ................................................................................................................1 Chapter 2: Literature Review .......................................................................................................5 2.1 Differences in Firms’ Performances ............................................................................... 5 2.2 IT Value .......................................................................................................................... 8 2.3 IT Risk and Failures ...................................................................................................... 10 2.4 Internal Control Weaknesses ........................................................................................ 12 2.5 Crash Risk ..................................................................................................................... 13 Chapter 3: Hypothesis Development ..........................................................................................14 Chapter 4: Research Model and Data Collection .....................................................................21 4.1 Data Collection ............................................................................................................. 21 4.2 LDA .............................................................................................................................. 24 4.2.1 Choosing the Number of Topics for LDA ................................................................ 25 4.2.2 LDA Robustness Check ............................................................................................ 27 4.3 Dependent and Independent Variables ......................................................................... 29 vii 4.4 Model ............................................................................................................................ 30 Chapter 5: Results and Analysis .................................................................................................32 5.1 Descriptive Statistics ..................................................................................................... 32 5.2 Effects of IT Risk Factor Disclosure ............................................................................ 32 5.3 Cybersecurity and IT Value Risk Disclosures .............................................................. 34 5.4 IT Material Weaknesses and IT Risk Factor Disclosure .............................................. 35 5.5 Effect of Readability on IT Risk Factor Disclosures .................................................... 37 5.6 Role of New IT Risk Factor Disclosures ...................................................................... 38 5.7 Effect of Order of Appearance on IT Risk Factor Disclosures ..................................... 39 5.8 Robustness Checks........................................................................................................ 40 5.8.1 Crash Risk Window .................................................................................................. 40 5.8.2 Placebo Test .............................................................................................................. 40 5.8.3 Subsample Splitting Thresholds ............................................................................... 41 Chapter 6: Limitations and Conclusion .....................................................................................42 Bibliography .................................................................................................................................44 Appendices ....................................................................................................................................49 Appendix A Crash Risk Measures ............................................................................................ 49 Appendix B Variable Definitions ............................................................................................. 51 Appendix C Tables ................................................................................................................... 54 viii List of Tables Table 1 Risk Factor Topic Labels ................................................................................................. 54 Table 2 Descriptive Statistics........................................................................................................ 55 Table 3 Effects of IT Risk Disclosure on Stock Price Crash Risk................................................ 56 Table 4 Effects of All Risk Disclosure types on Stock Price Crash Risk ..................................... 57 Table 5 Effects of IT Risk Disclosure on Stock Price Crash Risk Controlling for Total Number of Risk Factors .................................................................................................................................. 59 Table 6 Effects of IT Value Risk Disclosure and IT Security Risk Disclosure on Stock Price Crash Risk ..................................................................................................................................... 60 Table 7 Moderating Effects of IT-related Material Weaknesses on Relations between IT Risk Factor Disclosure and Stock Price Crash Risk ............................................................................. 61 Table 8 Moderating Effects of FOG Index on Relations between IT Risk Factor Disclosure and Stock Price Crash Risk.................................................................................................................. 62 Table 9 Effect of new IT Risk Factor Disclosures on Stock Price Crash Risk ............................. 63 Table 10 Moderating Effect of IT Risk Factor Rank on Relations between IT Risk Factor Disclosure and Stock Price Crash Risk ......................................................................................... 64 Table 11 Robustness Check Results for Varying Crash Risk Window Sizes on Relations between IT Risk Factor Disclosure and Stock Price Crash Risk ................................................................ 65 Table 12 Validity Check for the Effects of IT Value Risk Disclosure and IT Security Risk Disclosure on Stock Price Crash Risk .......................................................................................... 66 Table 13 Robustness Check Results for Varying Subsample Splitting Thresholds on the Moderating Effects of FOG Index on Relations between IT Risk Factor Disclosure and Stock Price Crash Risk ............................................................................................................................ 67 ix Table 14 Robustness Check Results for Varying Subsample Splitting Thresholds on the Moderating Effect of IT Risk Factor Rank on Relations between IT Risk Factor Disclosure and Stock Price Crash Risk.................................................................................................................. 69 x List of Figures Figure 1 Plot of Number of IT Cybersecurity Risk Factors and IT Value Risk Factors as a Percentage of Total IT-Related Risk Factor Disclosures .............................................................. 24 Figure 2 Plot of Model Selection Parameters against Number of Topics ..................................... 27 Figure 3 Confusion matrix for measuring the performance of LDA in classifying IT risk factors....................................................................................................................................................... 28 xi List of Abbreviations DOM Document Object Model EDGAR Electronic Data Gathering, Analysis, and Retrieval system ICMW Internal control material weakness LDA Latent Dirichlet allocation SEC Securities and Exchange Commission SOX Sarbanes-Oxley Act of 2002 SOX 404 Section 404 of Sarbanes-Oxley Act xii Acknowledgements I am forever grateful to my supervisors Dr. Hasan Cavusoglu and Dr. Gene Moo Lee who have provided excellent guidance and indispensable advice throughout my time as a graduate researcher. I also thank my family who has supported me financially and emotionally in this endeavor. Finally, thank you to my friends and fellow colleagues in the Robert H. Lee graduate school for their support and being the occasional sounding board for ideas.1 Chapter 1: Introduction Long considered as a strategic asset for organizations, information technology (IT) has become essential for the success of the firm and even for its survival. Today, IT plays a significant strategic and operational role in businesses. It is, therefore, the key responsibility of the firm to manage the risks associated with information systems (IS) to minimize their negative consequences to the firm (Benaroch & Chernobai, 2017; Huseyin Cavusoglu, Mishra, & Raghunathan, 2004; Masli, Richardson, Weidenmier Watson, & Zmud, 2016). A contemporary example of the strategic benefits and risks associated with the usage of IT systems is the recent disclosure of severe security vulnerabilities found in Intel processors (CPUs). Intel has dominated the server and high performance compute market thanks to the superior performance of their CPUs over competitors, and as a result firms build their IT infrastructure primarily using Intel CPUs. However, a series of critical security vulnerabilities were found in Intel CPUs in 20171 and 20192 that reduced CPU performance by 16%3. This has wide-ranging implications for firms as they would need to deal with degraded performance in their IT systems that were previously at a performance advantage due to using Intel CPUs. As publicly traded firms are required to disclose their IT risks along with the other risks that they are exposed to in their annual financial filings with the SEC, the question then arises as to whether these risk disclosures are important, and what the long-term impacts of these disclosures are to the firm. 1 https://meltdownattack.com 2 https://mdsattacks.com 3 https://www.phoronix.com/scan.php?page=article&item=mds-zombieload-mit 2 A considerable amount of research has examined the relation between IT failure events and its immediate market effects. For example, (Huseyin Cavusoglu et al., 2004) found that a cybersecurity breach costs a target firm on average $1.65 billion per announcement. (Bharadwaj, Keil, & Mähring, 2009) found that IT failures results in a 2% drop in stock prices over a two-day window. Viewing IT failure as a strategic weakness, Goldstein, Chernobai, & Benaroch (2011) also found a negative stock price relation to the IT failures. On the contrary, Gordon, Smith, & Loeb (2010) found that information security announcements actually increase a firm’s stock prices, arguing that such disclosures signal active involvement by the firm in securing their IT assets. However, to the best of our knowledge, there is no existing study in the IS literature that looks at the long-term effect of IT risk disclosures on the firm. Risk factor disclosures can hint at future firm performance degradations, but IT risk disclosure literature is sparse. Wang et al. (2012) looks at information security risk factors and the realization of data breaches, but their dataset is limited to hand-collected cybersecurity breach announcements in major media outlets and they do not look into the market impact of the risk disclosure itself. Furthermore, cybersecurity risks are not the only information technology related risks that a firm is exposed to. Yet, the existing literature predominantly focuses on cybersecurity. This paper aims to contribute to the risk factor disclosure literature as well as fill in the knowledge gap concerning long-term effects of IT-related risks. Our primary research question is whether IT-related risk factor disclosures affect a firm’s stock price crash risk, a long-term stock return measure. And if so, do cyber and other IT-related risks differ in their impact? We use 3 topic modeling techniques to identify IT risk disclosures in Item 1A in 10-K filings and use the resource weaknesses perspective from strategic management literature as a theoretical guide to categorize the IT risk disclosures into IT value and IT cybersecurity risk disclosures. We also examine the role of IT-related internal control material weaknesses (ICMW) in magnifying the market impact of IT risk factor disclosures. Borrowing techniques from the textual analysis literature, we examine how the readability, ordering, and novelty of IT risk factors moderate their relations to the firm’s stock price crash risk. We found that, consistent with our main hypothesis, IT risk factor disclosures do have an effect on the long-term stock price crash risk of the company. IT cybersecurity risk factors in particular were found to have a positive relation with the crash risk, but IT value risk factors did not. This pattern is consistent in the presence of various moderating factors. In line with previous work (Li, 2008), we found that readability affects the impact of IT risk factor disclosures. We also found that the order of appearance matters in disclosing IT risk factors, to the extent that investors will only respond to IT risks that were listed closer to the top of the Item 1A section. Similarly, we found that investors only respond to IT risks that were not already disclosed in the previous year’s annual report indicating that the newness of the content of IT risk disclosures is important. We received mixed results for our IT material weakness analysis. We could not statistically reject the null hypothesis that IT related ICMWs could not amplify the effect of IT risk factors on a firm’s stock price crash risk. This paper contributes to several literatures. First, we contribute to the IS literature by providing empirical evidence that IT-related risk disclosures have a measurable negative effect on a 4 company’s stock price. We also contribute by proposing two types of IT-related risk, IT value risk and IT cybersecurity risk, and show that they have different effects on long-term stock returns. Furthermore, we are the first to link IT risk disclosures to the long-term stock performance of a company, when other studies looking at market reaction have previously only focused on the short term stock price (e.g. Goldstein, Chernobai, and Benaroch 2011; Cavusoglu, Mishra, and Raghunathan 2004; Kannan, Rees, and Sridhar 2007). By looking at long-term stock price effects, we link the IS literature concerning IT risk disclosures and the existing crash risk literature in accounting and economic research circles. Our findings are also important to the literature studying risk factor disclosures. Lastly, by providing empirical evidence that IT risk disclosures are correlated with stock price crash risk, we hope to clear the uncertainty regarding whether mandatory risk disclosures are useful to investors or simply boilerplate (Campbell, Chen, Dhaliwal, Lu, & Steele, 2014; Chiu, Kim, & Wang, 2018; Hope, Hu, & Lu, 2016). We also make a methodological contribution by providing a way to reliably extract Item 1A risk factors and other sections of a 10-K filing. 5 Chapter 2: Literature Review 2.1 Differences in Firms’ Performances Strategic management literature explains a firm’s performance and its competitive advantage based on the internal attributes of the firm: valuable, rare, imperfectly imitable, non-substitutable resources (Barney, 1986, 1991; Wernerfelt, 1984) and distinctive competencies (Selznick, 1957). In pursuit of building and sustaining superior performance, the resourced-based view (RBV) emphasizes heterogeneity in firms’ resources which are tangible or intangible assets and capabilities (Barney, 1986, 1991). The literature focusing on distinctive competency which are capabilities evaluated without relation to specific problems (Andrews, 1971) emphasizes firm’s ability to harmonize combination of resources and capabilities (Grant, 1991; Prahalad & Hamel, 1990). The majority of the extant literature argues that a firm aims to attain superior resources and distinctive competencies to derive economic rent and create sustainable competitive advantage. However, a relatively burgeoning stream of research in strategic management literature argues that a firm’s strategic resource position (i.e., resource strength) may not be sufficient in explaining the firm’s performance and its sustainable competitive advantage (Arend, 2004; Page West & DeCastro, 2001; Powell & Arregle, 2007). Despite successful mobilization of strategic assets and attaining superior position in the resource strength, a firm could suffer from strategic weaknesses which is the other internal dimension that “may prove constraining, severely disruptive, or even ruinous to an organization’s competitive position and performance” (Page West & DeCastro, 2001). An example of weakness that many successful organizations face is inertia associated with the previously develop capabilities (Huff, Huff, & Thomas, 1992). A 6 weakness is “something more than failure of a resource strength or the non-existence of a resource strength dimension” (Page West & DeCastro, 2001). Similarly, Selznick (1957) argues distinctive inadequacies in the context of competencies are parallel to the notion of weaknesses in the context of resource strengths and argued that distinctive inadequacies compromise the firm’s performance. Complementing RBV with resource weaknesses and distinctive inadequacies enables the literature to explain why a firm which possesses a superior position in the resource strengths could experience failure. This new perspective would attribute the existence of weaknesses of a firm to its negation of its performance gains achieved due to its superiority in the resource strengths (Page West & DeCastro, 2001). While traditional strategic management literature would emphasize gains through strengths and competencies, the recent development also emphasizes what is lost through weaknesses and inadequacies. “The loss occurs either through diminishing previously developed competitive advantage or by in fact placing the firm at a competitive disadvantage” (Page West & DeCastro, 2001). Given that contemporary strategic risk management emphasizes not only value creation but also value protection (Beasley, Frigo, & Litman, 2007), the notion of resource weakness along with strength has a practical relevance. Arend (2004) refines a class of strategic weaknesses and coined strategic liability to describe processes and tangible and intangible holdings that are firm-specific, context-specific, and create inferior performance and result in competitive disadvantage. Strategic liabilities are scarce, 7 inconvertible, costly, and appropriated (Arend, 2004). Example of strategic liabilities in the context of strategic management includes lawsuits, unable to have customer goodwill, obsolete inventory, and contaminated sites. They can originate from endowment as a result of bad luck, by-product of a strategic asset, bestowed from actions of outside parties, and outcome of unfavorable changes in the context (Arend, 2004). More relevant to our investigation, strategic liabilities may “arise as a direct concurrent byproduct of the creation, support, or use of strategic asset” and “survive many environmental changes” (Arend, 2004). Firms can invest to mitigate their existing liabilities; yet liabilities cannot be completely eliminated. It is reduced to the extent where the marginal costs just equal to the marginal benefit (Arend, 2004). While strategic assets have potentials to generate economic rents, strategic liabilities are rent destroyers (Arend, 2004). Powell & Arregle (2007) define another class of strategic weaknesses and coined the axis of errors, where performance of the firm is negatively affected by the firm’s “failures to attend the activities, resources and opportunities that are equally available to all firms” (Powell & Arregle, 2007). Such organizational errors include blunders, lapses in judgements, miscalculations of actions, missed opportunities, and inability to acquire, leverage, or retain strategic assets. These errors are particularly important because many resources, like IT in most cases, are not protected by diffusion barriers and available in the marketplace. Therefore, organizational errors are a key source of heterogeneity among firms and have performance consequences. Organizational errors are often caused by either omission or commission (Ghemawat, 1991) and would result in less value when committed than when avoided (Powell & Arregle, 2007). Organizational errors are avoidable and remediable as they are organizational choices in risk management, strategy execution, operations, and corporate social responsibilities (Powell & Arregle, 2007). 8 Drawing on the notion of weaknesses and inadequacies (Page West & DeCastro, 2001), the contemporary wisdom argues that strategic liabilities (Arend, 2004) and organizational errors (Powell & Arregle, 2007) are significant sources of heterogeneity among firms, explaining the performance difference among them. Specifically, in the context of IT, we argue that cybersecurity risk and IT value risk exhibit characteristics of strategic liability and organization error, respectively. While both cybersecurity risk and IT value risk are strategic weaknesses, since their underlying theoretical logics are different, we will investigate their differential impacts. 2.2 IT Value Related to the strategic resources and firm advantage literature, the value of IT stream of literature focuses on how IT creates value in an organization and contribute to its success. Firms have invested heavily into their information systems to enhance performance and gain a competitive advantage. Most of these firms operate in highly complex, interconnected environments that contain a mix of innovative and legacy IT systems, and they depend on the proper functioning of those systems to achieve their strategic and operational goals. Literature investigating the use of IT to reach a firm’s strategic and competitive goals abounds with a number of theoretical frameworks. Bakos & Treacy (1986) integrates several previous frameworks and provides theories related to how firms use IS as a “competitive weapon” in three broad levels: how firms use IS in their internal strategy to improve efficiency and effectiveness, how they use IS in their competitive strategy to create a competitive advantage in the market, 9 and how they use IS in their business portfolio to enhance their market position or even enter new markets. Swanson (1994) looks at the role of IS innovation in an organization’s competitive survival by adapting the dual-core model of organization innovation to a tri-core model specific to the IS function. The paper presents three different levels of IS innovation that are mapped to the three cores, ranging from IS innovation that is constrained to the outer administrative core of the organization all the way to the embedding of IS into the technology core of the business. On the empirical side of the IT value literature, Brynjolfsson & Hitt (1996) find that the return on investment of IT capital is as high as 80%. The same authors in a separate study try to measure the value of IT by utilizing production theory, microeconomic theory, and competitive strategy theory and find that IT spending improves the production function of the firm as well as increasing consumer surplus, but does not improve profitability4 (Hitt & Brynjolfsson, 1996). Brynjolfsson, Hitt, Yang, Baily, & Hall (2002) find that a $1 investment in IT capital leads to an increase of $11.95 in a firm’s market value. This is in contrast to a mere $1.47 increase in firm value when investing $1 in Property, Plant, and Equipment. Chatterjee, Pacini, & Sambamurthy (2002) show that announcements of IT infrastructure investment are associated with higher abnormal stock returns than similar announcements of IT application investment. Overall, existing evidence demonstrates that investments in IT are beneficial to the firm and that investors also believe in the firm value-enhancing properties of IT investment. 4 The authors argue that profits gained from IT are supranormal and cannot be sustained, as any profits will encourage other firms to enter and drive down prices. 10 2.3 IT Risk and Failures A stream of IS research investigates antecedents and consequences of IT failures on the firm. As firms grow and implement information technologies to support their business activities, they must overcome implementation challenges and address issues associated with IT operations. The complexity of information technology landscape grows as firms invest modern information systems while still maintaining their legacy systems. It is not uncommon that such systems fail. IT risk is “the potential for an unplanned event involving a failure or misuse of IT to threaten an enterprise objective” (Westerman & Hunter, 2007), and information systems can fail either during development or at the points of implementation and use (Poulymenakou & Holmes, 1996). The current IT failure literature mainly focuses on the negative impact of security incidents on a firm’s value (Benaroch, Chernobai, & Goldstein, 2012; Bharadwaj et al., 2009; Campbell, Gordon, Loeb, & Zhou, 2003; Cavusoglu et al., 2004; Kannan et al., 2007). A firm experiencing an IT failure affecting the confidentiality, integrity, or availability of a firm’s IT assets (Benaroch et al., 2012) could suffer a 2% or more average cumulative abnormal drop in IT stock price (Bharadwaj et al., 2009; Cavusoglu et al., 2004). Campbell et al. (2003) found that investors would only react to information security breaches when confidential data is accessed, but there is no significant reaction when confidential information is not accessed. Tanriverdi & Ruefli (2018) uses the economics-based complementary theory of the firm and propose that IT initiatives change the risk/return relationship of a firm: successful IT implementations with suitable complementarities improve the risk/return profile of the firm while IT failures degrade such a profile. When changes to firm risk are accounted for, the increase in firm value from an 11 announcement of investment in e-commerce become insignificant (Dewan & Ren, 2007). Gordon et al. (2010) show that voluntary cybersecurity-related disclosures in 10-K annual reports have a positive effect on firm value in the 2000-2004 time period, a time period before mandatory risk factor disclosures were introduced. Berkman, Jona, Lee, & Soderstrom (2018) show similar results, arguing that voluntary information security disclosures indicate “cybersecurity awareness.” Overall, the current literature suggests that investors recognize the potential benefits of IT to the investing firms but only if risks associated with IT are managed properly. Drawing from the IT value literature and extant IT failure literature, we identify two major types of IT failure: IT value failure and cybersecurity failure. We distinguish the two types in their sources of failure, modes of failure, and consequences. One the one hand, IT value failures originate within the firm’s inability to use IT as a strategic resource and capture the full intended value of the IT system. This leads to poorly implemented information systems that are prone to outages and report inaccurate information or it can lead to functional information systems that are not suitable for the firm’s business case, leading to a loss of competitive advantage and failure by the firm to derive the full intended value from the information system. On the other hand, cybersecurity failures are the result of firms failing to secure their information systems from outside threats, independent of their ability to implement and use the information system to gain a competitive advantage. The firm can take advantage of the competitive value the system provides until it is under attack originating from an external actor. This could lead to data breaches or theft, an inability by the firm to access their systems and data, e.g. CryptoLocker or 12 ransomware attack, or a breakdown of internal and public-facing networks, such as during a Denial-of-Service attack. 2.4 Internal Control Weaknesses In 2002, the U.S. Congress passed the Sarbanes-Oxley Act (SOX) in the wake of major accounting scandals in Enron and Worldcom. The goal of the legislation was to strengthen firms’ internal controls and restore investor confidence in firms’ financial reports. Pertinent to this study, section 404 of SOX (i.e., SOX 404) mandates firms to establish robust internal controls over their financial reporting systems. Additionally, firms must disclose any failures or material weaknesses in their internal controls which may lead to inaccurate or misleading financial statements. An internal control material weakness (ICMW) is indicative of a weak financial reporting system whose accuracy and reliability of reporting is not assured. If managers cannot rely on internal company reports to make business decisions or predict firm performance, the firm’s forecast accuracy will suffer (Feng, Li, & McVay, 2009). The financial reporting systems of a firm are intricately linked to the rest of the firm’s IS/IT infrastructure as the latter feeds information needed by the former to produce financial reports. An IT failure would then have the potential to negatively impact the firm’s financial reporting and could lead to a decline in forecast accuracy due to lowered data integrity (Li, Peters, Richardson, & Watson, 2012). IT-related ICMW disclosures also lower firm’s return on assets (ROA) by weakening the supporting IT infrastructure for company operations and hindering the ability to deliver products and services to the firm’s customers (Stoel & Muhanna, 2011). As managers are responsible for the contents of financial reports, there is higher CEO and CFO turnover in the wake of IT-related ICMW disclosures (Masli et al., 2016). 13 2.5 Crash Risk Our paper focuses on stock price crash risk, which captures chances of extreme negative returns in a firm’s stock. Stock price crashes are caused by managers withholding negative information about the firm, and once the stockpiled negative information reaches a certain level, the bad news is released all at once, leading to a stock price crash (Myers & Jin, 2004). The accounting literature investigates several determinants of crash risk. For example, Hutton, Marcus, & Tehranian (2008) show that information opacity, operationalized by the three-year moving sum of accruals, is positively linked to future crash risk. Interestingly, this effect disappears for the post-SOX period. The effect is somewhat explained by Kim, Yeung, & Zhou (2017) who show that ICMW disclosures have a negative effect on a firm’s future crash risk, but the firm is more crash-prone in the year prior to the ICMW disclosure. Kim & Zhang (2012) found that accounting conservatism limits the ability of managers to hoard bad news and thus lowers a firm’s stock price crash risk. Kim, Li, & Zhang (2011a) found that the sensitivity of the CFO’s portfolio to their firm’s stock price is positively linked to the firm’s crash risk, arguing that CFOs are more incentivized to hoard bad news and manipulate information flow to the market. However, there is as yet no study that investigates the effect of risk factor disclosures on stock price crash risk, and we expect our paper to contribute in this way. 14 Chapter 3: Hypothesis Development Given the important role of IS/IT plays in day-to-day business operations and overall firm strategy in any contemporary organization, failures in a firm’s IT adversely influence the firm’s ability to achieve its business objectives and gain a competitive advantage. In any firm, IS implementations are initiated to deliver business value to the firm. However, there is always a risk that the firm may not be able to gain the intended benefits from the IS/IT, and investors are keenly aware of the risks associated with IT (Dewan & Ren, 2007). There are many causes of this risk, including implementation challenges, unmanaged complexity (scope creep), IT governance issues, or poorly specified project requirements to name a few. As previous studies have shown, there are severe consequences to a firm’s stock price when IT risks materialize and an IT failure occurs (e.g. Bharadwaj, Keil, and Mähring 2009; Goldstein, Chernobai, and Benaroch 2011; Kannan, Rees, and Sridhar 2007). We propose that, if an existing IT system or a newly implemented IT project has a significant risk of failure to achieve its performance goals and to deliver value to the firm, managers will attempt to hide the information from outside investors for as long as possible to avoid damage to the firm’s value. This hoarding of bad news about the IT systems of a firm will eventually reach a tipping point, and the information will be released to the market all at once and induce a stock price crash. The bubble “bursting” can occur when investors recognize that the expected progress has not been achieved for ongoing projects or intended performance improvements have not been delivered for the existing IT. The bad news could also be revealed to the market if the IT risk is materialized (e.g. the firm experienced a data breach) or an IT failure occurs (e.g., the firm experienced IS/IT outage). We postulate that, due to the requirements of the SEC to disclose any 15 and all risk factors, IT-related risk factor disclosures in a firm’s 10-K would cut through the veil of opacity and reveal that the firm’s IS/IT may not deliver its intended business value or be well-protected. Hence, we propose that IT-related risk disclosures are positively correlated with a firm’s stock price crash risk. This leads to our first hypothesis: H1: IT-related risk factor disclosures are positively correlated with a firm’s stock price crash risk. As discussed previously, IT has an inherent risk in failing to deliver its full value to the firm. A firm’s inability to leverage its IT resource can cause the firm to fail to appropriate the intended value of IT, but not all IT failures can be explained through that theoretical lens. A firm can possess necessary competencies to implement IT systems successfully, derive value from its IT investments, and gain a competitive advantage as a result, while it may also fail to protect against cyber security attacks such as Denial-of-Service attacks. Additionally, a cyber attack may not always affect a firm’s ability to operate, especially if only a data breach is involved; the subsequent news of the breach will certainly affect the company’s market value and/or goodwill but will not affect the company’s ability to function. We point out these two distinct modes of failure and risks, thus we break down IT risk into two types: IT cybersecurity risk and IT value risk. First, IT value risk is the risk that the firm will not be able to realize the full intended value of the IT systems. This risk originates from the firm’s (lack of) skills and competencies in implementing/running an IT system and deriving its full intended value. The lack of maturity in the firm’s IT strategy, governance, and management processes is often to blame. Second, IT cybersecurity risk is any risk that the confidentiality, 16 availability, or integrity of a firm’s IT and data assets can be adversely affected (Benaroch et al., 2012) and thus outside actors can exploit and cause harm to the firm’s business objectives. We theorize that IT value risk disclosures will reflect the firm’s inability to fully utilize their IT systems. That is, the more IT value risks the firm disclosures, the more informed the investors will be about the firm’s increasing inability to capture the full value from their IT systems and the more informed the investors will be about the state of the firm’s IS. The information that suboptimal IT/IS generates would be inaccurate, incomplete, or not timely. The managers and executives relying on the information from these systems would make suboptimal decisions, resulting in performance degradation and increasing the risk of a major stock price crash. Furthermore, the IS/IT is ingrained in all aspects of businesses, suboptimal IS/IT would cause inefficiencies/ineffectiveness in business processes, resulting in further performance degradation. Thus, we postulate that IT value risk disclosures should be positively correlated with a firm’s stock price crash risk. H1a: IT value risk disclosures are positively correlated with a firm’s stock price crash risk. Vulnerabilities in IS/IT that an organization possesses are liability for the firm. Malicious internal users and external hackers would exploit these vulnerabilities. We argue that IT cybersecurity risk disclosures will reflect the firm’s lack of protection for their IT assets from cybersecurity risks. That is, the more cybersecurity risks the firm disclosures, the more informed the investors will be about the firm’s increasing inability to protect its IT infrastructure and underlying key business data. Additionally, it is more difficult to hide cybersecurity breaches or failures from investors compared to IT value failures. For example, it is plainly obvious that a 17 breach occurred if the firm’s webpage has been defaced by hackers or customer information is leaked online. For IT security failures, it is a matter of when, not if the failure is disclosed sometime in the future. Hence, we expect that IT security risk disclosures will be positively correlated with a firm’s future stock price crash risk. H1b: IT cybersecurity risk disclosures are positively correlated with a firm’s stock price crash risk. IT has become all-pervasive in the business environment and, importantly, has transformed financial reporting systems, ERP systems, and inventory management systems within the modern firm. Firms establish internal control systems to ensure accurate reporting of their financial status. To function properly, these control systems are heavily integrated into financial reporting systems and all of the IS feeding relevant data into the firm’s financial reporting systems. Those systems, like all IT infrastructure, can break down and affect the firm’s ability to attest to its financial reporting accuracy. If a breakdown occurs, the firm is mandated to disclose its internal control material weakness (ICMW) as per SOX 404. We argue that the existence of an IT-related ICMW disclosure will further “confirm” that IT-related failure risks are present or realized. This results in an amplifying effect of IT-related risk disclosures such that the currently disclosed risks are more likely to be realized and result in a stock price crash if an IT-related ICMW is also reported. We therefore hypothesize that: H2: The existence of IT-related material weakness disclosures strengthens the relation between IT-related risk factor disclosures and a firm’s stock price crash risk. 18 In the SEC ruling that introduced mandatory risk factor disclosures, the SEC mandated that 10-K filings and risk factors are to be written in “plain English” and firms should avoid “legal and highly technical business terminology”, with the intention to provide readable and understandable documents to investors (SEC, 2005). It is expected that investors will respond more to readable 10-K filings and risks disclosures, as the information is more understandable and easier to comprehend. Market reaction to complex 10-K filings are more sluggish than simple ones, suggesting that investors required more time to incorporate the information in less readable annual reports (You & Zhang, 2009). Li (2008) proposed that firms are willing to be more straightforward in disclosing positive information and found that firms with less (more) readable filings have lower (higher) earnings. Hope et al. (2016) found that specific risk factor disclosures enhance analysts’ ability in assessing a firm’s fundamental risk. We expect that more readable IT-related risk factors convey more accurate information about the risks of a firm’s IS. Thus, the market reaction would be stronger for more readable IT risk factor disclosures. We hypothesize: H3: The readability of IT-related risk factor disclosures strengthens the relation between IT-related risk factor disclosures and a firm’s stock price crash risk. The mandatory risk factor disclosure section of the 10-K annual report has been met with wariness since its introduction by the SEC. Critics have doubted the informational value of mandatory risk factor disclosures, saying that the risks are boilerplate and that firms are likely to simply disclose all possible business risks (Malone, 2005). Nelson & Pritchard (2007) find that once a firm discloses a certain risk, the disclosure is rarely removed in subsequent filings. However, other studies (Campbell et al., 2014; Chiu et al., 2018; Hope et al., 2016) have 19 managed to find significant consequences to risk factor disclosures. One such study looks at the unexpected portion of risk factor disclosures and finds a negative relation with abnormal returns as well as a proportional relation with idiosyncratic firm risks (Campbell et al., 2014). When considering both the current body of evidence that risk factors have relevance to investors as well as the findings that risk factors are “sticky” (Nelson & Pritchard, 2007), we believe that a risk factor already disclosed in the previous year, if disclosed in the focal year would have no effect on stock price crash risk because no new information has been introduced. Only new risk factors by the firm which are different from the risk factors disclosed in the previous year contain new information about the state of the firm’s information systems. We therefore hypothesize that: H4: Only new IT-related risk factor disclosures are positively correlated with a firm’s stock price crash risk. The stock market is generally believed to be efficient. However, prior studies have shown that the market is not fully efficient, and that information about individual firms takes time to be fully reflected in the stock price (Bernard, 1989). One potential reason for this is that the market contains “average investors”, that is, investors who are not financial experts and do not read firms’ annual reports. Demonstrably, the SEC requires firms to release financial statements and reports in “plain English” in a 1998 ruling (SEC, 1998). When it comes to accessing and integrating information into their stock price beliefs, these investors suffer from limited attention spans and psychological biases such as overconfidence and self-attribution bias (Scott, 2015, p. 192). There is also the primacy effect, where individuals can only recall information that was presented first (Murdock, 1962). We expect that the combined primacy effect and limited 20 attention spans will cause “average investors” to respond only to the risk factors that appear at the beginning of Item 1A. Thus, we hypothesize that: H5: The order of appearance of IT-related risk factors relative to other risk factors in Item 1A moderates its relationship with a firm’s stock price crash risk. 21 Chapter 4: Research Model and Data Collection 4.1 Data Collection We collect and analyze the data on U.S. publicly traded firms to examine the relationship between risk factor disclosure and stock price crash risk. We obtain risk factor disclosures from Item 1A of Form 10-K annual reports filed by publicly traded companies to the U.S. Securities and Exchange Commission (SEC). Form 10-Ks are bulk downloaded from the SEC’s Electronic Data Gathering, Analysis, and Retrieval (EDGAR) system. The SEC mandated companies to include Item 1A in their 10-K filings after December 2005. Hence, our data sample includes 10-K filings submitted from December 2005 to July 2017. We collected 96,223 annual reports with reporting periods ranging from fiscal year 2005 to fiscal year 2016. To extract IT-related risk factor disclosures from the annual reports, we wrote a heuristic algorithm that uses the HTML structure of a 10-K filing to identify and collect individual risk factors in Item 1A of the filing. Specifically, the algorithm parses the HTML filing and builds a Document Object Model (DOM) of the filing. The DOM is a tree hierarchy made from the HTML elements that can be traversed and from which the visual structure of the filing can be deduced. The algorithm first removes page numbers, tables of contents, headers and footers, and other unrelated HTML elements. Then, it identifies the start of Item 1A in the filing by looking for a visually emphasized HTML element containing text that matches a regular expression5. If 5 We consider an HTML element to be visually emphasized if the element has an h1, h2, h3, h4, h5, h6, b, em, strong, i, or u tag. The text contained in the HTML element must match the regular expression /^\s*item[^a-z0-9]*1A[^a-z]*risk[^a-z]*factors?[^a-z0-9]?\s*$/gi. 22 Item 1A is found, we extract the subtree for Item 1A and pass that to the second stage of the algorithm. Risk factor disclosures in Item 1A follow a basic structure of leading with a summary sentence followed by one or more explanatory paragraphs or bullet points. We found that the summary sentence is almost always visually emphasized. In the second stage, the risk factor extraction algorithm considers a paragraph containing nothing but visually emphasized text to be a summary sentence, and it splices the Item 1A section into individual risk factors based on the location of the summary sentences. Using this algorithm, we managed to extract 1.72 million risk factors from 66,822 HTML-based 10-K filings, of which 62,324 contained an Item 1A section. From some 10-K filings, the algorithm could not extract risk factors because either the firm is too small6, the HTML structure of the filing is not parsable or too complex, or the filing was submitted in raw text, in which case we could not distinguish one risk factor from another algorithmically. Overall, risk factors were extracted from 64.8% of all available 10-K filings, or 93.3% of all HTML-based 10-K filings, in our sample period. We use latent Dirichlet allocation (LDA), a generative probabilistic framework modeling the topic structure of textual corpora (Blei, Jordan, & Ng, 2003), to extract 40 risk factor topics from a corpus containing 1.72 million risk factors. We manually labelled the 40 topics according to the words with the highest word weights for each topic and identified one risk factor topic that was IT related. The LDA algorithm assumes a generative process through which each document 6 According to Item 10(f)(1) of Regulation S-K, the SEC does not require “smaller reporting companies” who have a market cap of less than $250 million or revenues less than $100 million to disclose risk factors. 23 in corpus was created. In particular, each document is characterized as random mixture over latent topics and each topic is characterized by a distribution over all the words in the corpus. The LDA algorithm reverse engineers the generative process and results in document-topic distribution matrix and topic-word distribution matrix. Using the topic weights of each risk factor (i.e. a row in the first matrix)7, we identified 30,987 IT related risk factors. The 40 topics and top keywords of each topic are found in Panel A of Table 1. Consistent with the strategic management literature (West 2001), our theory postulated that there are two distinct broad classes of IT-related risk. To identify IT value and IT cybersecurity risk factor disclosures from 10-K reports, we run LDA again using the 30,987 IT related risk factors as a corpus. We specified a 5-topic LDA model and manually mapped each topic to either IT value related or IT cybersecurity related according to the top keywords in the topic. The five IT topics and top keywords of each topic are found in Panel B of Table 18. Each IT risk factor was classified as an IT value risk factor or IT cybersecurity risk factor according to a simple majority of the sum of its topic weights belonging to IT value or IT cybersecurity, respectively, and we plot the proportion of IT value risk factors and IT cybersecurity risk factors disclosed per year in Figure 1 below. 7 If a topic has the highest weight, the risk factor is considered to be related to the corresponding topic and that topic only. We used other cut-off values of 0.05 and 0.1 (in which case a risk factor can have multiple topics) and our qualitative results have not changed. 8 Topics 1 and 5 are related to cybersecurity and Topics 2, 3, and 4 are related to IT value. 24 Figure 1 Plot of Number of IT Cybersecurity Risk Factors and IT Value Risk Factors as a Percentage of Total IT-Related Risk Factor Disclosures We obtain firm-related data from Compustat and stock return data from CRSP. Following (Masli et al., 2016) and consistent with the accounting research, we use Audit Analytics to obtain material weaknesses disclosed by firms in their 10-K filings. After excluding observations with missing data, our final dataset includes 11,857 unique firms across 30,347 firm-years. 4.2 LDA This study requires the identification of IT-related risk factors among a large corpus of risk factor disclosures. Following (Bao & Datta, 2014; Dyer, Lang, & Stice-Lawrence, 2017), we use LDA topic modelling to categorize risk factor disclosures. We use LDA for three main reasons. 0%10%20%30%40%50%60%70%80%90%100%2005 2007 2009 2011 2013 2015 2017IT SecurityIT Value25 First, LDA has the benefit of being an unsupervised machine learning model, which means that there is no manual labelling or data collection needed. This is especially important as our initial corpus contained over 1.7 million documents. Further, LDA can not only identify just IT-related risk factors, but it automatically generates all other risk factor topics which may be useful for other studies and researchers. This generative property of LDA can also be used as a sanity check in that the appearance of an IT risk factor topic confirms that our study relates to a meaningful subject area. In addition, by using an unsupervised machine learning model instead of a keyword search-based model, we avoid any biases introduced from the manual selection of keywords. Second, LDA is fairly accurate in identifying IT-related risk factors as well as separating those IT risk factors into fine-grained topics of cybersecurity risk and IT value risk, as shown in section 4.2.2. Third, LDA is an established topic modelling method used in the accounting and Information Systems literature (Bao & Datta, 2014; Campbell et al., 2014; Dyer et al., 2017). 4.2.1 Choosing the Number of Topics for LDA A necessary step in using LDA topic modeling algorithms is choosing the number of topics, also known as hyperparameter tuning. To determine the number of topics to be used, we utilized the perplexity score, a common measurement of model fitness in topic modeling (Azzopardi, Girolami, & Rijsbergen, 2002; Blei et al., 2003). We split the document corpus into a training set and test set consisting of 90% and 10% of the total document corpus, respectively, and train the LDA model on the training set, while measuring its predictive performance on the test set with the perplexity score. We calculate the model perplexity score for a range of topic numbers, and the plot of perplexity against number of topics is shown in Figure 2. Since perplexity is 26 monotonically decreasing as the number of topics grows, the “best” number of topics is theoretically infinity. However, the topics would become indistinguishable if the number of topics is excessive. Thus, we chose the number of topics to be 40, which was a good tradeoff between attaining a low perplexity score and achieving high interpretability of the topics. This resulted in distinct topics without having any repeated topics. The number of topics chosen closely followed previous studies that used topic classification to examine risk factors (Bao & Datta, 2014; Brown, Crowley, & Elliott, 2016; Huang & Li, 2011). As a robustness check, we use an alternative measure of model fit in the hyperparameter tuning step. For each LDA model, we calculate cosine similarity scores for all pairs of topic-word vectors generated by the model. Since a “topic” in the context of LDA is defined by its word weights, a low cosine similarity score between two topics would indicate that the topics have dissimilar word weights and thus are semantically different. Conversely, a high cosine similarity score indicates that two topics are semantically close together. We calculate the cosine similarity score between all the topic pairs of a given LDA model, and we plot the minimum cosine similarity score found for each LDA model in Figure 2. We find that minimum cosine similarity also monotonically decreases like perplexity does and that a low minimum cosine similarity score is desired. We chose the number of topics to be 40 as a tradeoff between attaining a low enough minimum cosine similarity and interpretability of the topics. 27 Figure 2 Plot of Model Selection Parameters against Number of Topics 4.2.2 LDA Robustness Check To verify that we correctly extracted IT risk factor disclosures from 10-K reports, we randomly sampled 100 non-IT risk factors and 100 IT risk factors identified by the first 40-topic LDA model. We then distributed the two samples to three researchers and asked them to label each risk factor disclosure as either IT-related or not IT-related. There were eight risk factors that had inter-coder disagreement in the non-IT risk factor sample and one risk factor that had disagreement in the IT risk factor sample. The Fleiss’ Kappa was 0.94, indicating almost perfect agreement. To calculate the false positive rate and false negative rate of our IT risk factor identification process, the three researchers convened and labeled the risk factors that had disagreements as either IT-related or not. We consider the labels generated by the researchers as 00.10.20.30.40.50.6800 850 900 950 1000 1050 1100 1150 1200 15 25 35 45 55 65 75 85 95 Cosine Similarity Perplexity Score Number of topics Perplexity ScoreMinimum Cosine Similarity28 the actual, ground truth labels, and the labels given by LDA as the predicted labels. The results are presented in the confusion matrix in Figure 3. In summary, we have a 0% false negative rate and a 2% false positive rate in classifying IT risk factors using LDA. Actual IT Non-IT Predicted IT 98 2 Non-IT 0 100 Figure 3 Confusion matrix for measuring the performance of LDA in classifying IT risk factors The aim of this paper is to study the effects of IT value risk factor disclosure and IT security risk factor disclosure by separating general IT-related risk factors into component topics using LDA. To verify that the 5-topic LDA model we used to do so was not misspecified and that it generated meaningful, distinct topics without ignoring other topics, we take a grounded theory approach in analyzing IT-related risk factors. We do this by randomly sampling 100 IT-related risk factors and manually coding each risk factor by its contents. After manual coding, we find that almost all risk factors talk about either cybersecurity breaches or failure of the company’s IT systems. There are secondary topics that are sometimes discussed, such as lack of cyberinsurance, reliance on third party vendors and cloud infrastructure, or government regulation, but they are discussed in relation to cybersecurity or systems failure. We conclude from the results of manual coding that our LDA model was able to identify IT security and IT value risk factors and that our theoretical model is sound. 29 4.3 Dependent and Independent Variables Our main independent variables are related to the risk disclosures. We used the topic of each risk factor disclosure found in the 10-K document to calculate the risk disclosure variables of interest for each firm year observation. Subscripts i and t denote the 10-K filing for firm i in year t. IT risk disclosure (i.e., ITRFDit) is the count of risk factors associated with the IT topic (i.e., topic 24), found in the 10-K filing for firm i in year t. Each risk topic disclosure (i.e., 𝑅𝐹𝑇𝑂𝑃𝐼𝐶𝑖𝑡𝑛 where n  [1,40]) is the count of risk factors associated with topic n. When the model of interest aims to disentangle the impacts of different classes of IT risk, we used IT risk topic assignment. In particular, IT value risk disclosure (i.e., ITVALUEit) and IT cybersecurity risk disclosure (i.e., ITSECURITYit) are obtained as the counts of IT value risk factors and IT cybersecurity risk factors disclosed in the 10-K filing for firm i in year t. Our dependent variable is CRASHit+1 and it refers to the stock price crash risk for the one-year window following firm i filing a 10-K in year t. Following prior studies on crash risk (e.g. Chen, Hong, & Stein, 2001; Hutton, Marcus, & Tehranian, 2008; Kim, Li, & Zhang, 2011b, 2011a; Myers & Jin, 2004), we use two measures of crash risk in our main tests: down-to-up volatility of abnormal daily stock return (i.e., DUVOL), and the negative skewness of abnormally daily stock return (i.e., NCSKEW). We obtain control variables from Compustat and also include the number of total risk factors disclosed, NUMRFit, as a control variable as well as year and industry dummies. A complete description of the crash risk measures can be found in Appendix A and variable descriptions can be found in Appendix B . 30 4.4 Model Our first hypothesis is intended to answer if IT risk factor disclosures in general have any effect on a firm’s stock price crash risk. We run the following OLS regression model to test H1. CRASHit+1 = β0 + β1ITRFDit + Controls + εit (1) where ITRFDit is the count of IT-related risk factor disclosures found in Item 1A for firm i in fiscal year t, and CRASHit+1 refers to one of the two crash risk measures employed in this study, NCSKEWit+1 and DUVOLit+1. Controls includes the following control variables for determinants of crash risk identified in previous studies: firm size for firm i at the fiscal year-end t, SIZEit; book-to-market ratio for firm i at the fiscal year-end t, BMit; stock return momentum for firm i in the fiscal year-end t, MOMit; abnormal trading volume for firm i in the fiscal year-end t, ABVOLit; stock return volatility of volume for firm i in the fiscal year t, SIGMAit; leverage ratio of firm i at the fiscal year-end t, LEVit; return over assets for firm i in the fiscal year t, ROAit; earnings volatility for firm i in the fiscal year t, ROA_STDit; operating cycle of firm i in the fiscal year t, OCit; and sales growth of for firm i in the fiscal year t, SGit. In all regressions, we also include in our controls dummies for industry using the Fama-French twelve industry classification and dummies for fiscal years 2005 to 2016. When the aim is to disentangle impacts of different classes of IT related risk disclosures and stock price crash risk, we used the following OLS regression model: CRASHit+1 = β0 + β1ITVALUEit + β2ITSECURITYit + β3ITVALUEit*ITSECURITYit + Controls + εit (2) where CRASHit+1 refers to the crash risk measures DUVOL or NCSKEW for firm i in the fiscal year t+1. ITVALUEit and ITSECURITYit refer to the measures for IT value risk disclosure and 31 cybersecurity risk factor disclosure in Item 1A of a 10-K annual report for firm i in fiscal year t, respectively. We used the same Controls used in Equation (1). When testing moderating effects of IT-related material weaknesses and readability, we used the OLS model in Equation (2) for each of the split samples. When we are testing the role of novelty of the risk disclosure, we used a modified version of the model in Equation (2), which will be explained in the Results and Analysis section below. 32 Chapter 5: Results and Analysis 5.1 Descriptive Statistics Panel A of Table 2 reports the mean, median, standard deviation, and the first and the third quartiles for main variables used in our analyses. Our main crash risk measures NCSKEW and DUVOL have means of -0.003 and -0.048, respectively. This is in line with the previous literature (Kim et al., 2011b, 2017). The mean number of risk factors disclosed by firms in a 10-K filing is 27.436. The mean number of IT value and IT cybersecurity risk factors disclosed in a 10-K filing is 0.412 and 0.151, respectively. 5.2 Effects of IT Risk Factor Disclosure H1 is concerned with whether IT risk factor disclosures in general have any effect on a firm’s stock price crash risk. To test this, we regressed the number of IT-related risk factors disclosed against the crash risk measures following Equation (1). We run the regression for each crash risk measure separately (i.e., NCSKEWit+1 and DUVOLit+1). The regression results are found in Table 3 and show that IT-related risk factor disclosures are significantly positively related to stock price crash risk for the one-year window following the release of a 10-K annual report. The coefficients (t-statistics) for ITRFDit in the two models are 0.069 (6.52) and 0.013 (6.25), respectively. One concern might be that the result that IT related risk factor disclosure is associated the higher stock price crash risk can be affected by the other risk factor disclosures. As a robustness check, we ran the same regression but included the counts of the other 39 risk factor topics into the model specified in (1). That is: 33 𝐶𝑅𝐴𝑆𝐻𝑖𝑡+1 = 𝛽0 + ∑ 𝛽𝑛𝑅𝐹𝑇𝑂𝑃𝐼𝐶𝑖𝑡𝑛40𝑛=1 + 𝐶𝑜𝑛𝑡𝑟𝑜𝑙𝑠 + 𝜖𝑖𝑡 (3) where 𝑅𝐹𝑇𝑂𝑃𝐼𝐶𝑖𝑡𝑛 refers to the count of risk factors of topic n for firm i in year t. 𝑅𝐹𝑇𝑂𝑃𝐼𝐶𝑖𝑡24 is ITRFDit. The regression results are found in Table 4Table 3 and show that the significant coefficients in Model (1) reported in Table 3 remained significant even after controlling for all other risk factor topics. The coefficients (t-statistics) of IT risk factor disclosure are 0.058 (4.66) and 0.012 (5.13). We also note that the IT risk factor disclosure had the highest statistical significance of all the risk factor topics, indicating a strong statistical relationship with a company’s stock return. In terms of magnitude of the coefficients of risk disclosure topics, IT related risk disclosure has the second highest magnitude, after the coefficient of risk disclosure related to Operations (i.e. topic 11). Given that our focus is on IT related risks and we have not postulated any hypothesis for the specific risk factor disclosures other than IT-related ones, in the subsequent analyses, we would control for the other risk disclosures. This will be accomplished by including NUMRFit into the regression models. NUMRFit is the total number of all the risk factor disclosures (i.e., 𝑁𝑈𝑀𝑅𝐹𝑖𝑡 = ∑ 𝑅𝐹𝑇𝑂𝑃𝐼𝐶𝑖𝑡𝑛40𝑛=1 .). As a robustness check, we run the following model: CRASHit+1 = β0 + β1ITRFDit + β2NUMRFit + Controls + εit (4) The magnitude and significance of the relationship between IT-related risk disclosure and stock price crash risk reported in Table 5 are consistent with those reported in Table 4. The result reaffirms that IT-related risk disclosure is positively associated with stock price crash risk even after controlling for the entire risk disclosures (NUMRFit) and many other idiosyncratic factors (Controls). 34 5.3 Cybersecurity and IT Value Risk Disclosures To examine the relation between IT risk disclosures on stock price crash risk more closely, we look at IT value risk disclosures and IT cybersecurity risk disclosures separately and measure their effect on a firm’s stock price crash risk. We followed Equation (2) in regressing the number of IT cybersecurity and IT value risks disclosed against the stock price crash risk and the results are reported in Table 6. The coefficients (t-statistics) for ITSECURITYit in the two models are 0.051 (2.20) and 0.011 (2.21), respectively, indicating that IT cybersecurity related disclosures are significantly and positively correlated with a firm’s stock price crash risk in the one year following such a disclosure. However, the coefficients for ITVALUEit are not significant for either of the two crash risk measures. This is not in line with our theoretical expectation. Our finding indicates that risks associated with the IT liabilities correlate significantly with stock price crash risk while risks associated with IT organizational errors do not. We believe that differential effects can be explained by how much risks are within the control of the companies. Since IT value creation is within the purview of the leadership and management teams of the companies, the market can interpret the IT value risk as a risk of doing business. This is also consistent with organizational errors notion of (Powell & Arregle, 2007) that avoiding an organizational error is “a hygiene or parity factor” not a source of competitive advantage. Since cyber security is often characterized as an arm race between security practitioners and malicious actors (Cavusoglu, Cavusoglu, & Raghunathan, 2004), even if the organization investments in security technologies to bring the cyber risk to an acceptable level, the ability of the firm to deal with the constantly-evolving vulnerabilities and attack vectors deteriorates very quickly. Therefore, cybersecurity risk disclosure can be viewed as an admission 35 of deteriorating conditions of the cybersecurity risks that the firm is exposed to beyond the acceptable level. Since cybersecurity risk is the significant IT related risk, the rest of our analyses will specifically focus on the coefficients on ITSECURITY. We also performed a likelihood ratio test to see if IT cybersecurity risk disclosures affect stock price crash risk more than IT value risk disclosures do. Along with the full model in (2), the test requires a restricted model9 where coefficients of cybersecurity and IT value risk disclosures are restricted to be the same. We computed the likelihood scores Lfull and Lrestricted. We computed the likelihood ratio, defined as −2ln (𝐿𝑓𝑢𝑙𝑙𝐿𝑟𝑒𝑠𝑡𝑟𝑖𝑐𝑡𝑒𝑑), and compared that to a χ2 statistic critical value with one degree of freedom at the 95% level. The likelihood ratio of 8.93 was greater than the critical value of 3.84. Hence, we conclude that IT cybersecurity risk disclosures affect stock crash risk significantly more than IT value risk disclosures. 5.4 IT Material Weaknesses and IT Risk Factor Disclosure To test the moderating effect of IT material weakness disclosures on the relation between IT risk disclosures and stock price crash risk, we split our dataset into two subsamples – one subsample containing firm-year observations that had no IT-related material weakness disclosures in that year, and another subsample containing firm-year observations that had at least one IT-related material weakness disclosure in that year. 9 CRASHit+1 = β0 + β1(ITVALUEit + ITSECURITYit) + β2ITVALUEit*ITSECURITYit + Controls + εit is the restricted model. 36 Following Kim et al. (2017) and Masli et al. (2016), we obtain material weakness from Audit Analytics. Their internal control material weaknesses (ICMW) database includes ICMW disclosures collected from 10-K and 10-Q reports and categorizes the reason(s) for each ICMW disclosure. Following Masli et al. (2016), we identified all IT-related reasons from the descriptions and classify each ICMW disclosure as either IT or non-IT related material weakness based on the reason(s) listed10. Finally, we included a firm-year observation into the ICMW subsample if it contained at least one IT-related ICMW, or we included in into the non-ICMW subsample otherwise. The subsamples consisted of 2,038 and 27,197 observations, respectively. We run a separate regression specified in model (2) for each subsample. Results are presented in Table 7. Overall, results are not consistent. The coefficient on ITSECURITY is significant for the ICMW subsample, however the relation only holds when using DUVOL as a crash risk measure. When using NCSKEW as a crash risk measure, the coefficient on ITSECURITY is significant for the non-ICMW subsample and insignificant for the ICMW subsample. However, ITSECURITY coefficient magnitudes are increased under the ICMW subsample. They are 2.53 times and 3.7 times larger compared to the non-ICMW subsample for the NCSKEW and DUVOL crash measures, respectively. Additionally, the R2 in ICMW subsample is approximately doubled compared to that in the non-ICMW subsample. We believe that the inconclusive result may be driven by the small size of ICMW subsample. 10 The reason numbers identified as IT-related are 22, 26, 42, 51, 52, 53, 57, 61, 76, and 85. 37 5.5 Effect of Readability on IT Risk Factor Disclosures Next, we examine the moderating effect the readability of risk factor disclosures on the relation between IT risk disclosures and stock price crash risk. We operationalize readability using the Gunning Fog Index (Loughran & Mcdonald, 2014), which estimates the years of formal education needed for a reader to understand a piece of text and is a synthetic score combining average number of words per sentence and average word complexity. It is calculated as 𝐹𝑂𝐺𝑖𝑡 = 0.4 [𝑊𝑜𝑟𝑑𝑠𝑖𝑡𝑆𝑒𝑛𝑡𝑒𝑛𝑐𝑒𝑠𝑖𝑡+ 100𝐶𝑜𝑚𝑝𝑙𝑒𝑥𝑊𝑜𝑟𝑑𝑠𝑖𝑡𝑊𝑜𝑟𝑑𝑠𝑖𝑡] where FOGit is the Fog index of the entire Item 1A section for firm i in fiscal year t, Wordsit is the total word count of Item 1A, Sentencesit is the number of sentences in Item 1A, and ComplexWordsit is the number of words in Item 1A that have three or more syllables. A higher Fog Index means lower readability. We computed the Fog Index for all firm-years and we found that the mean FOG for all the Item 1A’s is 23.6, which is roughly in line with previous literature (J. L. Campbell et al., 2014). We then divided our dataset into two subsamples dependent on FOG. The low readability subsample contains firm-year observations where the FOG index of Item 1A of the firm’s 10-K is at least one standard deviation above the mean FOG of all the Item 1A, and the high readability subsample contains all other observations. The two subsamples have 9,837 observations and 20,510 observations, respectively. This roughly corresponds to a one third/two third split. We run a separate regression specified in model (2) for each subsample. Results are presented in Table 8. The coefficients (t-statistics) for ITSECURITY in the high readability (i.e., low FOG) subsample are 0.108 (2.87) and 0.022 (2.88) for crash risk measures NCSKEW and DUVOL, 38 respectively while ITSECURITY is consistently insignificant in the low readability (high FOG) subsample tests. The result confirms our prediction that highly readable IT-related risk factors better convey the information about the IT risks to investors. 5.6 Role of New IT Risk Factor Disclosures We then test whether only new IT risk disclosures are positively correlated with a firm’s stock price crash risk. We recoded ITVALUE measure into ITVALUEnew and ITVALUEold and similarly we recoded ITSECURITY into ITSECURITYnew and ITSECURITYold. If a particular risk disclosure in a given year is exactly the same as a risk disclosure in the previous year, we consider such risk disclosure as an old one. We then run the following regression model: 𝐶𝑅𝐴𝑆𝐻𝑖𝑡+1 = 𝛽0 + 𝛽1𝐼𝑇𝑃𝐸𝑅𝐹𝑂𝑅𝑀𝑖𝑡𝑛𝑒𝑤 + 𝛽2𝐼𝑇𝑆𝐸𝐶𝑈𝑅𝐼𝑇𝑌𝑖𝑡𝑛𝑒𝑤 + 𝛽3𝐼𝑇𝑃𝐸𝑅𝐹𝑂𝑅𝑀𝑖𝑡𝑛𝑒𝑤 ∗ 𝐼𝑇𝑆𝐸𝐶𝑈𝑅𝐼𝑇𝑌𝑖𝑡𝑛𝑒𝑤 + 𝛽4𝐼𝑇𝑃𝐸𝑅𝐹𝑂𝑅𝑀𝑖𝑡𝑜𝑙𝑑 + 𝛽5𝐼𝑇𝑆𝐸𝐶𝑈𝑅𝐼𝑇𝑌𝑖𝑡𝑜𝑙𝑑 + 𝐶𝑜𝑛𝑡𝑟𝑜𝑙𝑠 (5) where 𝐼𝑇𝑃𝐸𝑅𝐹𝑂𝑅𝑀𝑖𝑡𝑛𝑒𝑤and 𝐼𝑇𝑆𝐸𝐶𝑈𝑅𝐼𝑇𝑌𝑖𝑡𝑛𝑒𝑤 are the total counts of IT value and IT cybersecurity risks disclosed by firm i in fiscal year t, respectively, that did not exactly match any risk factors disclosed by firm i in the previous year (i.e., in t-1), and 𝐼𝑇𝑃𝐸𝑅𝐹𝑂𝑅𝑀𝑖𝑡𝑜𝑙𝑑 and 𝐼𝑇𝑆𝐸𝐶𝑈𝑅𝐼𝑇𝑌𝑖𝑡𝑜𝑙𝑑 are the are the total counts of IT value and IT cybersecurity risks disclosed that had an exact matching risk factor in the previous year (i.e., in t-1) for firm i. Regression results are reported in Table 9. The coefficients (t-statistics) on 𝐼𝑇𝑆𝐸𝐶𝑈𝑅𝐼𝑇𝑌𝑖𝑡𝑛𝑒𝑤 are 0.058 (2.23) and 0.010 (2.44) for NCSKEW and DUVOL crash risk measures, respectively. Furthermore, the coefficients on 𝐼𝑇𝑆𝐸𝐶𝑈𝑅𝐼𝑇𝑌𝑖𝑡𝑜𝑙𝑑 are insignificant for both crash risk measures. This indicates that only the newly disclosed cybersecurity risks would be associated with the firm’s stock price crash risk. Disclosing the same risk again in the following year t+1 does not 39 have any relation to the firm’s stock price crash risk in the year to follow t+2. Considering our strict definition of new risk disclosure (exact match), this result may indicate that investors are sensitive to the small changes in the risk disclosure. 5.7 Effect of Order of Appearance on IT Risk Factor Disclosures Finally, we test if IT risk disclosures that are listed earlier in the Item 1A section of the 10-K filing (i.e. near the top of the section) have a stronger relationship with stock price crash risk than IT risk disclosures that are listed later in the section. To test this conjecture, we split our dataset into two subsamples. We ranked each firm-year observation by the average appearance order of its IT related risk disclosures. For example, if a firm’s second and fifth risks disclosed out of ten total risks disclosure in Item 1A were IT-related, that particular firm-year observation is assigned a rank of (2+5)/10 = 0.35. The higher the calculated rank, the later the IT risks listed in the Item 1A section. We classify the lowest one third of observations in terms of the rank calculated into low-IT-ranked subsample and the other two thirds into high-ranked subsample. The two subsamples have 10,092 observations and 20,225 observations, specifically. We run a separate regression specified in model (2) for each subsample. Results are presented in Table 10. The coefficients (t-statistics) on ITSECURITY for the low-IT-ranked subsample are 0.119 (2.42) and 0.011 (2.07) for NCSKEW and DUVOL crash risk measures, respectively, indicating a positive relationship between IT cybersecurity risk disclosures and stock price crash risk when IT-related risks are listed at the top of Item 1A. Furthermore, the coefficients on ITSECURITY in the high IT rank subsample are insignificant for both crash risk measures. It appears that managers disclose more relevant IT risk factors first, leading to an increased relation 40 to stock price crash risk as those risk factors contain more pertinent information about the firm’s IS/IT. 5.8 Robustness Checks 5.8.1 Crash Risk Window All our results reported in the paper have been obtained by considering a stock price crash risk window starting from fiscal year end that the 10-K in which risks factors were disclosed corresponds to (i.e. time t) to one year later (i.e. time t+1) for both stock price crash risk measures, NCSKEW and DUVOL. We repeated our analysis reported in Table 6 by using different stock price crash window sizes: 6 months, 18 months, two years, and three years after risk disclosure. Results are reported in Table 11. For the 6-month window size, ITSECURITY was insignificant for both crash risk measures. In all other window sizes, ITSECURITY remained positive and significant for NCSKEW and DUVOL. This is an acceptable result, since crash risk measures such as NCSKEW and DUVOL are intended to capture long term stock price crash risks and a 6-month window size is most likely too short to capture long term stock price effects. 5.8.2 Placebo Test Here, we aim to show that if risk disclosures had not taken place, the stock price crash risk would not have occurred. To that end, we performed a simple validity check by slightly modifying Equation (1) so that the dependent variable CRASHit+1 becomes CRASHit and rerunning our analyses of Table 6. This shifted the stock price crash risk measurement window from [t, t+1] back one year to [t-1, t] while the risk disclosure remained at time t. We expect to see that past stock price crash risk would not have been influenced by the upcoming risk factor disclosures. 41 Results are reported in Table 12. Our main coefficients became insignificant, confirming our validity check. 5.8.3 Subsample Splitting Thresholds In our analyses to test H3, we used cutoff values of mean plus one standard deviation (i.e., 𝜇 +𝜎) to separate the dataset into two subsamples. This would be translated into 32.4% (67.6%) of the observations falling into the alternate (null) hypothesis subsample for H3. We repeated our analyses with cutoff values ranging from 10% to 90% belonging to the alternate hypothesis subsample in 10% increments and found that our results are very robust to cutoff changes. Our robustness check results in Table 13 show that the direction and significance of ITSECURITY remain unchanged compared to Table 8 for all cutoff values except 90%, where the results become mixed. We perform a similar subsample splitting threshold robustness check for H5, where we repeated our analysis of Table 10 but with subsample cutoff values of 10% and 20% belonging to the alternate hypothesis subsample. Cutoff values above 30% resulted in a linearly dependent regression, since the majority of firm-year observations had no IT risk factor disclosures and thus the IT risk factor rank variable was labelled as missing data. Results of this robustness check are in Table 14 and show that our results qualitatively remain the same regardless of cutoff value used. 42 Chapter 6: Limitations and Conclusion In this study, we investigated the long-term effect of IT-related risk factor disclosures in 10-K filings. We documented that IT cybersecurity disclosures specifically have a significant relation with a firm’s crash risk in the one-year window after the disclosure. This result is consistent with the notion that IT risk factors reflect the notion of liability of a firm, which later materializes as an IT failure/issue that causes a severe stock price drop. We also documented that the contents of the IT risk disclosure moderate its relation to firm stock price crash risk. Specifically, the readability, position, and novelty of the risk factor disclosures strengthen the relation to the firm’s crash risk. Altogether, we provided empirical evidence that risk disclosures are not boilerplate and contain relevant information about a firm’s long-term performance, and that the way the information is conveyed also matters. This study also advanced our understanding by separating IT-related risk into two categories – value risk and cyber security risk – and shows that the latter type of risk disclosure significantly increases stock price crash risk. We also make methodological contributions by providing a framework for conducting textual analysis on risk factors contained in 10K annual reports and by providing Java and Python source code to aid future researchers in extracting risk factors. This paper is without its limitations. First, risk factor topics were extracted using an unsupervised machine learning model and manually labeled using the highest weighted key words of each topic. As with all unsupervised machine learning methods, there is always a risk that the generated model does not match the ground truth. Further studies may consider using a method to classify risk factors by combining a manual coding grounded in theory for a subset of risk disclosures and supervised learning models trained on the manual coded risk disclosures. 43 Second, the heuristic algorithm used to extract risk factor disclosures is imperfect due to the fact that 10-K filings were created by different entities over many years so the filings are not well-structured. Despite our diligent effort, it is possible that algorithm might have missed identifying some risk factors or wrongly identified non-risk related passages as risk disclosure. Also, plain text filings were not parsed due to a lack of structure and difficulty differentiating risk factors from one another. More refinement of the algorithm will be able to more accurately extract risk factors from 10-K reports. Finally, this paper only looks at the post-disclosure effects of risk factors on crash risk. IT-related risk factor disclosures are only a proxy for a firm’s strategic (mis)use of IT and there may be endogeneity that we have not accounted for, as there may be selection bias in the firms choosing to disclose risk factors. That is, a firm might choose to disclose risk factors only after the particular risk is already mitigated and is only seeking to benefit from the litigation shield that the disclosure provides. Another potential source of endogeneity we may need to control for is the degree of an organization’s IT investment – it would be logical to assume that companies with more IT investment would face greater risks associated with IT and that companies who invest no or very little into IT would not face any direct IT-related risks. That is to say, IT investment is not just a binary variable where the vast majority of firms today would be coded as “1”. For the above reasons, this study cannot claim a direct causal relationship. 44 Bibliography Andrews, K. R. (1971). The concept of corporate strategy. Homewood, Ill: Dow Jones-Irwin. Arend, R. J. (2004). The definition of strategic liabilities, and their impact on firm performance. Journal of Management Studies, 41(6), 1003–1027. https://doi.org/10.1111/j.1467-6486.2004.00464.x Azzopardi, L., Girolami, M., & Rijsbergen, K. Van. (2002). Investigating the Relationship between Language Model Perplexity and IR Precision-Recall Measures. In Proceedings of the 26th annual international ACM SIGIR conference on Research and development in informaion retrieval (pp. 5–6). Bakos, J. Y., & Treacy, M. E. (1986). Information Technology and Corporate Strategy: A Research Perspective. MIS Quarterly. Minneapolis: The Society for Information Management and The Management Information Systems Research Center of the University of Minnesota. https://doi.org/10.2307/249029 Bao, Y., & Datta, A. (2014). Simultaneously Discovering and Quantifying Risk Types from Textual Risk Disclosures. Management Science, 60(6), 1371–1391. https://doi.org/10.1287/mnsc.2014.1930 Barney, J. B. (1986). Strategic Factor Markets: Expectations, Luck, and Business Strategy . Management Science . Linthicum : INFORMS . https://doi.org/10.1287/mnsc.32.10.1231 Barney, J. B. (1991). Firm Resources and Sustained Competitive Advantage. Journal of Management. https://doi.org/10.1177/014920639101700108 Beasley, M. S., Frigo, M. L., & Litman, J. (2007). Strategic risk management: Creating and protecting value. Strategic Finance, 88(11), 24. Benaroch, M., & Chernobai, A. (2017). Operational IT Failures, IT Value Destruction, and Board-Level IT Governance Changes. MIS Quarterly. https://doi.org/10.25300/MISQ/2017/41.3.04 Benaroch, M., Chernobai, A., & Goldstein, J. (2012). An internal control perspective on the market value consequences of IT operational risk events. International Journal of Accounting Information Systems. https://doi.org/10.1016/j.accinf.2012.03.001 Berkman, H., Jona, J., Lee, G., & Soderstrom, N. (2018). Cybersecurity awareness and market valuations. Journal of Accounting and Public Policy, 37(6), 508–526. https://doi.org/10.1016/j.jaccpubpol.2018.10.003 Bernard, V. L. T. (1989). Post-Earnings-Announcement Drift. Journal of Accounting Research. Bharadwaj, A., Keil, M., & Mähring, M. (2009). Effects of information technology failures on 45 the market value of firms. Journal of Strategic Information Systems. https://doi.org/10.1016/j.jsis.2009.04.001 Blei, D., Jordan, M., & Ng, A. Y. (2003). Latent Dirichlet allocation. Journal of Machine Learning Research, 3, 993–1022. https://doi.org/10.1162/jmlr.2003.3.4-5.993 Brown, N. C., Crowley, R., & Elliott, W. B. (2016). What are You Saying? Using Topic to Detect Financial Misreporting. SSRN. https://doi.org/10.2139/ssrn.2803733 Brynjolfsson, E., & Hitt, L. (1996). Paradox Lost? Firm-Level Evidence on the Returns to Information Systems Spending. Management Science, 42(4), 541–558. https://doi.org/10.1287/mnsc.42.4.541 Brynjolfsson, E., Hitt, L. M., Yang, S., Baily, M. N., & Hall, R. E. (2002). Intangible assets: Computers and organizational capital / Comments and discussion. Brookings Papers on Economic Activity. Washington: Brookings Institution Press. Campbell, J. L., Chen, H., Dhaliwal, D. S., Lu, H. min, & Steele, L. B. (2014). The information content of mandatory risk factor disclosures in corporate filings. Review of Accounting Studies, 19(1), 396–455. https://doi.org/10.1007/s11142-013-9258-3 Campbell, K., Gordon, L. A., Loeb, M. P., & Zhou, L. (2003). The economic cost of publicly announced information security breaches: Empirical evidence from the stock market. Journal of Computer Security, 11(May 2001), 431–448. https://doi.org/10.3233/JCS-2003-11308 Cavusoglu, Hasan, Cavusoglu, H., & Raghunathan, S. (2004). Economics of ITSecurity Management: Four Improvements to Current Security Practices. CAIS, 14, 3. Cavusoglu, Huseyin, Mishra, B., & Raghunathan, S. (2004). The Effect of Internet Security Breach Announcements on Market Value: Capital Market Reactions for Breached Firms and Internet Security Developers. International Journal of Electronic Commerce, 9(1), 70–104. Retrieved from http://dl.acm.org/citation.cfm?id=1278168.1278173 Chatterjee, D., Pacini, C., & Sambamurthy, V. (2002). The shareholder-wealth and trading-volume effects of information-technology infrastructure investments. Journal of Management Information Systems, 19(2), 7–42. https://doi.org/10.1080/07421222.2002.11045723 Chen, J., Hong, H., & Stein, J. C. (2001). Forecasting crashes: Trading volume, past returns, and conditional skewness in stock prices. Journal of Financial Economics. https://doi.org/10.1016/S0304-405X(01)00066-6 Chiu, T.-T., Kim, J.-B., & Wang, Z. (2018). Customers’ risk factor disclosures and suppliers’ investment efficiency. Contemporary Accounting Research. https://doi.org/10.1111/1911-3846.12447 46 Dewan, S., & Ren, F. (2007). Risk and return of information technology initiatives: Evidence from electronic commerce announcements. Information Systems Research. https://doi.org/10.1287/isre.1070.0120 Dyer, T., Lang, M., & Stice-Lawrence, L. (2017). The evolution of 10-K textual disclosure: Evidence from Latent Dirichlet Allocation”. Journal of Accounting and Economics, 64(2–3), 221–245. https://doi.org/10.1016/j.jacceco.2017.07.004 Feng, M., Li, C., & McVay, S. (2009). Internal control and management guidance. Journal of Accounting and Economics, 48(2–3), 190–209. https://doi.org/10.1016/j.jacceco.2009.09.004 Ghemawat, P. (1991). Commitment: the dynamic of strategy. New York;Toronto; Free Press. Goldstein, J., Chernobai, A., & Benaroch, M. (2011). An Event Study Analysis of the Economic Impact of IT Operational Risk and its Subcategories. Journal of the Association for Information Systems. https://doi.org/10.17705/1jais.00275 Gordon, B. L. A., Smith, R. H., & Loeb, M. P. (2010). Market Value of Voluntary Disclosures Concerning Information Security. MIS Quarterly, 34(3), 567–594. https://doi.org/Article Grant, R. M. (1991). The Resource-Based Theory of Competitive Advantage: Implications for Strategy Formulation . California Management Review . Los Angeles, CA : University of California Walter A. Haas School of Business . https://doi.org/10.2307/41166664 Hitt, L. M., & Brynjolfsson, E. (1996). Productivity, Business Profitability, and Consumer Surplus: Three Different Measures of Information Technology Value. MIS Quarterly. Minneapolis: The Society for Information Management and The Management Information Systems Research Center of the University of Minnesota, and The Association for Information Systems. https://doi.org/10.2307/249475 Hope, O. K., Hu, D., & Lu, H. (2016). The benefits of specific risk-factor disclosures. Review of Accounting Studies. https://doi.org/10.1007/s11142-016-9371-1 Huang, K.-W., & Li, Z. (2011). A Multi-Label Text Classification Algorithm for Labeling Risk Factors in SEC Form 10-K. Ssrn, 2(3). https://doi.org/10.2139/ssrn.1916044 Huff, J. O., Huff, A. S., & Thomas, H. (1992). Strategic renewal and the interaction of cumulative stress and inertia. Strategic Management Journal, 13(Special Issue), 55–76. https://doi.org/10.1002/smj.4250131006 Hutton, A. P., Marcus, A. J., & Tehranian, H. (2008). Opaque Financial Reports , R-square , and Crash Risk. SSRN Electronic Journal. Kannan, K., Rees, J., & Sridhar, S. (2007). Market Reactions to Information Security Breach Announcements: An Empirical Analysis. International Journal of Electronic Commerce, 12(1), 69–91. https://doi.org/10.2753/JEC1086-4415120103 47 Kim, J. B., Li, Y., & Zhang, L. (2011a). CFOs versus CEOs: Equity incentives and crashes. Journal of Financial Economics. https://doi.org/10.1016/j.jfineco.2011.03.013 Kim, J. B., Li, Y., & Zhang, L. (2011b). Corporate tax avoidance and stock price crash risk: Firm-level analysis. Journal of Financial Economics. https://doi.org/10.1016/j.jfineco.2010.07.007 Kim, J. B., Yeung, I., & Zhou, J. (2017). Stock price crash risk and internal control weakness: Presence vs. disclosure effect. Accounting and Finance, (144511). https://doi.org/10.1111/acfi.12273 Kim, J. B., & Zhang, L. (2012). Accounting Conservatism and Stock Price Crash Risk : Firm level Evidence. Contemporary Accounting Research, Forthcoming. Li, F. (2008). Annual report readability, current earnings, and earnings persistence. Journal of Accounting and Economics. https://doi.org/10.1016/j.jacceco.2008.02.003 Li, Peters, Richardson, & Watson. (2012). The Consequences of Information Technology Control Weaknesses on Management Information Systems: The Case of Sarbanes-oxley Internal Control Reports. MIS Quarterly, 36(1), 179. https://doi.org/10.2307/41410413 Loughran, T., & Mcdonald, B. (2014). Measuring readability in financial disclosures. Journal of Finance. https://doi.org/10.1111/jofi.12162 Malone, S. (2005). Refco risks boiler-plate disclosure. Reuters. Retrieved from http://w4.stern.nyu.edu/news/news.cfm?doc_id=5094 Masli, A., Richardson, V. J., Weidenmier Watson, M., & Zmud, R. W. (2016). Senior Executives’ IT Management Responsibilities: Serious IT-Related Deficiencies and CEO/CFO Turnover. MIS Quarterly. https://doi.org/10.25300/MISQ/2016/40.3.08 Murdock, B. B. (1962). The serial position effect of free recall. Journal of Experimental Psychology. https://doi.org/10.1037/h0045106 Myers, S. C., & Jin, L. (2004). R-Squared Around the World: New Theory and New Tests. SSRN. https://doi.org/10.2139/ssrn.531263 Nelson, K. K., & Pritchard, A. C. (2007). Litigation Risk and Voluntary Disclosure: The Use of Meaningful Cautionary Language. SSRN. https://doi.org/10.2139/ssrn.998590 Page West, G., & DeCastro, J. (2001). The Achilles heel of firm strategy: Resource weaknesses and distinctive inadequacies. Journal of Management Studies, 38(3), 417–442. https://doi.org/10.1111/1467-6486.00243 Poulymenakou, A., & Holmes, A. (1996). A contingency framework for the investigation of information systems failure . European Journal of Information Systems . Abingdon : Taylor & Francis . https://doi.org/10.1057/ejis.1996.10 48 Powell, T. C., & Arregle, J.-L. (2007). Firm Performance and the Axis of Error. Journal of Management Research, 7(2), 59–77. Prahalad, C., & Hamel, G. (1990). The Core Competence of the Corporation. Harvard Business Review. Scott, W. R. (2015). Financial Accounting Theory (7th ed.). Toronto: Pearson. SEC. (1998). Plain English Disclosure. Retrieved from https://www.sec.gov/rules/final/33-7497.txt SEC. (2005). Securities Offering Reform. Retrieved from https://www.sec.gov/rules/final/33-8591.pdf Selznick, P. (1957). Leadership in administration; a sociological interpretation. Evanston, Ill. : Row, Peterson. Stoel, M. D., & Muhanna, W. A. (2011). IT internal control weaknesses and firm performance: An organizational liability lens. International Journal of Accounting Information Systems. https://doi.org/10.1016/j.accinf.2011.06.001 Swanson, E. B. (1994). Information Systems Innovation among Organizations. Management Science, 40(9), 1069–1092. Tanriverdi, H., & Ruefli, T. (2018). The Role of Information Technology in Risk/Return Relations of Firms. Journal of the Association for Information Systems. https://doi.org/10.17705/1jais.00061 Wang, T., Kannan, K. N., Ulmer, J. R., Wang, T., Kannan, K. N., & Ulmer, J. R. (2012). The Association Between the Disclosure and the Realization of Information Security Risk Factors. Information Systems Research, 24(2), 201–218. https://doi.org/10.1287/isre.1120.0437 Wernerfelt, B. (1984). A resource‐based view of the firm. Strategic Management Journal. https://doi.org/10.1002/smj.4250050207 Westerman, G., & Hunter, R. (2007). IT Risk: Turning Business Threats Into Competitive Advantage. Communications News. Nelson Publishing. You, H., & Zhang, X. jun. (2009). Financial reporting complexity and investor underreaction to 10-k information. Review of Accounting Studies, 14(4), 559–586. https://doi.org/10.1007/s11142-008-9083-2 49 Appendices Appendix A Crash Risk Measures We measure down-to-up volatility of abnormal daily stock return DUVOLit for firm i at fiscal year-end t as the natural logarithm of the ratio of standard deviation of abnormal daily stock returns below the mean to standard deviation of abnormal daily stock returns above the mean, as expressed below: 𝐷𝑈𝑉𝑂𝐿𝑖𝑡 = log {(𝑛𝑢 − 1) ∑ 𝑅𝑖𝑡2𝐷𝑂𝑊𝑁((𝑛𝑑 − 1) ∑ 𝑅𝑖𝑡2𝑈𝑃)⁄ } where nu and nd are the number of up and down days, respectively. The abnormal daily stock return ARitd is calculated as the natural logarithm of one plus εitd: ARitd = log(1 + εitd), from the following expanded market model estimated using daily stock returns over a horizon of one year: RETitd= β0i + β1iRETmtd-2 + β2iRETmtd-1 + β3iRETmtd + β4iRETmtd+1 + β5iRETmtd+2 + εitd where RETitd is return on stock i at day d of year t, and RETmtd is the corresponding return on CRSP value-weighted market index. RETmtd-2, RETmtd-1, RETmtd+1, and RETmtd+2 are the lead and lag terms for RETmtd. We measure negative skewness of stock return NCSKEWit for firm i at fiscal year-end t as negative one times the third moment of abnormal daily stock return divided by the standard deviation of abnormal daily stock return raised to the third power, as expressed below: 𝑁𝐶𝑆𝐾𝐸𝑊𝑖𝑡 = − (𝑛(𝑛 − 1)32 ∑ 𝑅𝑖𝑡3 ) ((𝑛 − 1)(𝑛 − 2) (∑ 𝑅𝑖𝑡2 )32)⁄ where n is the number of observations of daily returns during the one-year period of t. The abnormal daily stock return ARitd is the natural logarithm of one plus εitd from the above 50 expanded market model estimated using daily stock returns over a horizon of one year: ARitd = log(1 + εitd). 51 Appendix B Variable Definitions Measures for IT Risk Factor Disclosure ITVALUE The aggregate IT value risk factor disclosure for Item 1A in a 10-K annual report. It is measured as the aggregate count of IT risk factors belonging to topics 2, 3, and 4 that are generated from the second pass of LDA topic modeling for Item 1A in a 10-K annual report. ITSECURITY The aggregate IT security risk factor disclosure for Item 1A in a 10-K annual report. It is measured as the aggregate count of IT risk factors belonging to topics 1 and 5 that are generated from the second pass of LDA topic modeling for Item 1A in a 10-K annual report. Measures for Crash Risk NCSKEW Negative stock return skewness measured as the negative one times the third moment of residual returns divided by the standard deviation of residual returns raised to the third power. The residual return is the natural logarithm of one plus the residual estimated from an expanded market model using daily stock returns over a one-year rolling window (e.g. Kim, Li, and Zhang 2011b). DUVOL The down-to-up stock volatility ratio calculated as the natural logarithm of the ratio of the standard deviations of residual returns below the mean to standard deviation of residual returns above the mean. The residual returns and estimation windows are the same as in the NCSKEW estimation. 52 Measures for Other Control Variables SIZE Firm size measured as the natural logarithm of a firm’s market value of equity at the fiscal year end. BM Ratio of book value of equity to market value of equity. MOM Return momentum measured as the accumulated monthly return over the fiscal year. ABVOL Abnormal trading volume measured as the average monthly share turnover over the current year, minus the average monthly share turnover over the previous year, with monthly share turnover calculated as the monthly trading volume divided by total number of shares outstanding during the month. SIGMA Standard deviation of daily stock returns over the fiscal year. LEV Leverage ratio measured as the ratio of total liabilities to total assets at the fiscal year end. ROA Profitability measured as the ratio of net income before extraordinary items to total assets at the start of the fiscal year. ROA_STD The standard deviation of ROA calculated over the past five fiscal years. OC Operating cycle measured as the natural logarithm of receivables to sales plus inventory to cost of goods sold multiplied by 360. SG Sales growth measured as the percentage change in sales in a fiscal year 53 over the prior fiscal year. NUMRF Total number of risk factors that a firm disclosed in a fiscal year 54 Appendix C Tables Table 1 Risk Factor Topic Labels Panel A: General Risk Factor Topic Labels Topic Label Top 10 keywords 1: Debt debt, credit, indebtedness, facility, notes, senior, obligations, covenants, default, make 2: Competitors new, competitors, competitive, competition, companies, compete, industry, resources, technologies, greater 3: Stock risk common, shares, price, preferred, securities, stockholders, holders, share, outstanding, issue 4: Litigation claims, liability, litigation, legal, product, subject, proceedings, damages, claim, costs 5: Intellectual property rights, property, intellectual, patent, patents, proprietary, third, protect, parties, license 6: Sales/Revenue sales, revenue, revenues, customer, operating, significant, quarter, inventory, product, demand 7: Contracts/Trading risk, transactions, trading, hedging, credit, contracts, risks, losses, derivative, counterparties 8: Tax tax, income, reit, taxable, federal, taxes, subject, purposes, qualify, certain 9: Internal controls internal, reporting, controls, control, public, act, requirements, company, accounting, required 10: Oil/Natural resources gas, oil, natural, production, prices, drilling, reserves, exploration, properties, development 11: Operations assurance, continue, able, operating, assure, losses, limited, development, achieve, revenues 12: Partnerships units, partnership, partner, general, distributions, trust, unitholders, distribution, limited, partners 13: Insurance insurance, coverage, losses, risks, events, natural, damage, disasters, terrorist, reinsurance 14: Energy usage energy, fuel, power, emissions, facilities, costs, gaming, electricity, generation, electric 15: Real estate properties, property, real, lease, estate, construction, leases, tenants, projects, project 16: Regulatory risk regulations, laws, subject, regulatory, federal, requirements, state, act, compliance, regulation 17: Cash flow adverse, effect, material, condition, impact, cash, flows, significant, affect, failure 18: Executive risk directors, officers, interests, interest, joint, control, stockholders, affiliates, ownership, venture 19: Macroeconomy economic, conditions, markets, affect, demand, impact, credit, industry, global, affected 20: International risk foreign, united, international, states, countries, currency, exchange, risks, prc, china 21: Operations company, company's, believes, operating, subsidiary, subsidiaries, assurance, operates, relies, expects 22: Pharmaceutical product, clinical, candidates, regulatory, approval, fda, trials, development, drug, marketing 23: Board of directors directors, board, provisions, stockholders, control, penny, stockholder, change, shares, law 24: Information systems service, reputation, system, failure, software, damage, failures, customer, access, harm 25: Mergers and acquisitions acquisitions, acquisition, growth, acquired, businesses, risks, new, strategy, manage, successfully 26: Manufacturing manufacturing, suppliers, supply, materials, production, manufacturers, components, costs, raw, manufacture 27: Internal controls statements, estimates, actual, assumptions, accounting, based, factors, report, changes, risks 28: Investment portfolio investment, investments, securities, portfolio, assets, funds, value, companies, advisor, management 29: No meaningful topic december, million, approximately, year, 2009, 2011, 2010, 2012, years, ended 30: Assets value, assets, impairment, fair, goodwill, net, asset, charges, intangible, required 31: Cost of capital capital, additional, cash, financing, terms, available, obtain, funds, debt, raise 32: Marketing advertising, internet, stores, brand, consumer, content, service, retail, network, consumers 33: Cost of capital dividends, bank, pay, capital, subsidiaries, cash, institutions, ratings, banking, banks 34: Talent acquisition personnel, employees, key, retain, management, attract, qualified, success, executive, senior 35: Interest rates rates, interest, rate, increase, costs, changes, increases, higher, income, cost 36: Healthcare health, healthcare, programs, care, reimbursement, medicare, government, program, medical, payors 37: Mortgages loans, loan, mortgage, losses, real, estate, portfolio, commercial, collateral, credit 38: Environmental regulation environmental, laws, regulations, costs, safety, hazardous, subject, materials, water, liabilities 39: Stock volatility price, common, securities, trading, fluctuations, factors, operating, companies, analysts, changes 40: Contracts agreements, contracts, agreement, third, terms, parties, contract, arrangements, certain, obligations Panel B: IT Risk Factor Topic Labels Topic Label Top 10 keywords 1: Cyber attacks cyber, attacks, confidential, unauthorized, networks, damage, access, disruptions, measures, threats 2: Software defects software, products, errors, new, results, system, adversely, failure, ability, affect 3: Network failure service, failures, interruptions, network, failure, system, damage, interruption, ability, power 4: IT operations company, company’s, failure, third, operational, risk, customer, failures, effect, regulatory 5: Data breach reputation, breach, measures, personal, access, unauthorized, confidential, protect, liability, privacy 55 Table 2 Descriptive Statistics Variable Mean Std. Dev. Q1 Median Q3 NCSKEW -0.007 1.645 -0.696 -0.143 0.479 DUVOL -0.052 0.335 -0.256 -0.068 0.131 ITVALUE 0.403 0.649 0 0 1 ITSECURITY 0.166 0.499 0 0 0 TOPIC1 0.055 0.275 0 0 0 TOPIC2 0.171 0.417 0 0 0 TOPIC3 0.167 0.391 0 0 0 TOPIC4 0.065 0.255 0 0 0 TOPIC5 0.111 0.366 0 0 0 FOG 23.604 1.973 22.503 23.467 24.521 SIZE 6.493 2.003 5.135 6.485 7.830 BM 0.666 0.766 0.295 0.499 0.807 MOM 1.133 0.702 0.813 1.060 1.321 SIGMA 0.030 0.017 0.019 0.026 0.037 ABVOL -0.031 5.279 -0.263 -0.001 0.269 ROA 0.002 0.195 -0.010 0.039 0.078 ROA_STD 0.618 59.777 0.018 0.038 0.090 LEV 0.194 0.189 0.006 0.160 0.316 SG 0.358 21.700 -0.030 0.063 0.177 OC 4.572 0.857 4.160 4.645 5.058 NUMRF 25.816 13.939 16.000 24.000 33.000 This table presents summary statistics used in our analysis. Variable definitions are found in Appendix C. 56 Table 3 Effects of IT Risk Disclosure on Stock Price Crash Risk NCSKEW DUVOL Intercept 0.630 [4.75]*** 0.074 [2.59]*** ITRFD 0.069 [6.52]*** 0.013 [6.25]*** SIZE 0.007 [0.91] 0.002 [1.53] BM 0.060 [3.72]*** 0.020 [5.50]*** MOM -0.409 [-6.55]*** -0.096 [-6.36]*** SIGMA -7.875 [-5.70]*** -2.034 [-9.02]*** ABVOL 0.003 [2.39]** 0.001 [2.49]*** ROA -0.147 [-2.10]** -0.012 [-0.80] ROA_STD 0.000 [6.32]*** 0.000 [7.09]*** LEV -0.017 [-0.26] -0.004 [-0.29] SG 0.000 [-0.74] 0.000 [-0.22] OC 0.000 [-0.03] 0.001 [0.28] Industry Dummies Yes Yes Year Dummies Yes Yes Obs. 30347 30347 R2 0.0445 0.0631 This table presents regression results from examining the association between IT Risk Disclosure and a firm’s stock price crash risk following Equation (2). ***, **, and * indicate significance levels of 99%, 95%, and 90%, respectively. 57 Table 4 Effects of All Risk Disclosure types on Stock Price Crash Risk NCSKEW DUVOL Intercept 0.666 [4.85]*** 0.086 [2.96]*** RFTOPIC1 0.042 [3.85]*** 0.009 [4.08]*** RFTOPIC2 0.000 [-0.03] -0.001 [-0.66] RFTOPIC3 -0.024 [-1.62] -0.007 [-2.28]** RFTOPIC4 0.025 [1.71]* 0.002 [0.64] RFTOPIC5 0.014 [0.98] 0.001 [0.38] RFTOPIC6 0.022 [2.71]*** 0.005 [3.03]*** RFTOPIC7 -0.012 [-0.63] -0.001 [-0.29] RFTOPIC8 0.016 [1.71]* 0.004 [2.22]** RFTOPIC9 0.032 [1.68]* 0.004 [1.15] RFTOPIC10 -0.008 [-1.42] -0.002 [-1.31] RFTOPIC11 -0.099 [-3.40]*** -0.022 [-3.85]*** RFTOPIC12 0.001 [0.15] 0.000 [0.26] RFTOPIC13 0.006 [0.45] 0.004 [1.37] RFTOPIC14 -0.016 [-2.25]** -0.003 [-1.71]* RFTOPIC15 -0.042 [-4.45]*** -0.009 [-4.26]*** RFTOPIC16 0.011 [0.93] 0.002 [0.96] RFTOPIC17 -0.045 [-0.68] -0.013 [-0.96] RFTOPIC18 -0.044 [-2.65]*** -0.008 [-2.51]*** RFTOPIC19 -0.037 [-3.30]*** -0.006 [-2.68]*** RFTOPIC20 -0.006 [-0.57] -0.003 [-1.70]* RFTOPIC21 -0.107 [-1.59] -0.029 [-2.15]** RFTOPIC22 0.016 [2.38]** 0.002 [1.74]* RFTOPIC23 0.006 [0.29] 0.002 [0.59] RFTOPIC24 (ITRFD) 0.058 [4.66]*** 0.012 [5.13]*** RFTOPIC25 -0.023 [-1.82]* -0.004 [-1.64] RFTOPIC26 0.013 [1.59] 0.004 [2.22]** RFTOPIC27 0.002 [0.12] -0.001 [-0.31] RFTOPIC28 -0.018 [-2.62]*** -0.002 [-1.48] RFTOPIC29 -0.001 [-0.03] 0.000 [0.06] RFTOPIC30 0.031 [1.53] 0.005 [1.30] RFTOPIC31 -0.004 [-0.24] -0.002 [-0.58] RFTOPIC32 0.000 [0.08] -0.001 [-0.76] RFTOPIC33 -0.015 [-0.74] -0.003 [-0.65] RFTOPIC34 0.021 [1.24] 0.005 [1.45] RFTOPIC35 0.006 [0.29] -0.002 [-0.46] RFTOPIC36 0.019 [2.52]*** 0.004 [3.02]*** RFTOPIC37 0.018 [1.30] 0.005 [1.76]* RFTOPIC38 -0.012 [-0.82] -0.003 [-1.03] RFTOPIC39 0.017 [0.91] 0.001 [0.19] RFTOPIC40 -0.008 [-0.88] -0.003 [-1.50] SIZE 0.004 [0.56] 0.002 [1.08] BM 0.067 [4.04]*** 0.020 [5.65]*** MOM -0.407 [-6.49]*** -0.096 [-6.34]*** SIGMA -8.223 [-5.80]*** -1.997 [-8.58]*** ABVOL 0.002 [1.89]* 0.001 [2.07]** ROA -0.144 [-1.97]** -0.020 [-1.28] ROA_STD 0.000 [6.75]*** 0.000 [7.11]*** LEV -0.034 [-0.46] -0.015 [-1.02] 58 NCSKEW DUVOL SG 0.000 [-0.42] 0.000 [0.12] OC -0.004 [-0.25] 0.000 [-0.06] Industry Dummies Yes Yes Year Dummies Yes Yes Obs. 30347 30347 R2 0.0627 0.0915 This table presents regression results from examining the association between all risk disclosure types and a firm’s stock price crash risk, following Equation (3). ***, **, and * indicate significance levels of 99%, 95%, and 90%, respectively. 59 Table 5 Effects of IT Risk Disclosure on Stock Price Crash Risk Controlling for Total Number of Risk Factors NCSKEW DUVOL Intercept 0.597 [4.52]*** 0.070 [2.46]** ITRFD 0.059 [5.36]*** 0.012 [5.41]*** SIZE 0.006 [0.82] 0.002 [1.47] BM 0.059 [3.62]*** 0.020 [5.44]*** MOM -0.409 [-6.54]*** -0.096 [-6.36]*** SIGMA -8.115 [-5.86]*** -2.062 [-9.11]*** ABVOL 0.003 [2.43]** 0.001 [2.50]*** ROA -0.132 [-1.89]* -0.010 [-0.68] ROA_STD 0.000 [6.24]*** 0.000 [7.07]*** LEV -0.040 [-0.61] -0.006 [-0.49] SG 0.000 [-0.82] 0.000 [-0.26] OC 0.000 [0.01] 0.001 [0.31] NUMRF 0.003 [3.09]*** 0.000 [1.75]* Industry Dummies Yes Yes Year Dummies Yes Yes Obs. 30347 30347 R2 0.0448 0.0632 This table presents regression results from examining the association between IT Risk Disclosure and a firm’s stock price crash risk following Equation (2) and adding NUMRFit as an additional control. ***, **, and * indicate significance levels of 99%, 95%, and 90%, respectively. 60 Table 6 Effects of IT Value Risk Disclosure and IT Security Risk Disclosure on Stock Price Crash Risk NCSKEW DUVOL Intercept 0.627 [4.76]*** 0.076 [2.68]*** ITVALUE 0.032 [0.86] 0.008 [1.10] ITSECURITY 0.051 [2.20]** 0.011 [2.21]** ITVALUE*ITSECURITY -0.028 [-0.82] -0.008 [-1.25] SIZE 0.008 [1.08] 0.002 [1.73]* BM 0.053 [3.29]*** 0.018 [5.17]*** MOM -0.411 [-6.56]*** -0.097 [-6.38]*** SIGMA -8.049 [-5.81]*** -2.048 [-9.03]*** ABVOL 0.003 [2.51]*** 0.001 [2.56]*** ROA -0.130 [-1.85]* -0.009 [-0.65] ROA_STD 0.000 [5.79]*** 0.000 [6.63]*** LEV -0.081 [-1.23] -0.015 [-1.10] SG 0.000 [-0.89] 0.000 [-0.33] OC -0.009 [-0.62] -0.001 [-0.37] NUMRF 0.004 [4.90]*** 0.001 [3.49]*** Industry Dummies Yes Yes Year Dummies Yes Yes Obs. 30347 30347 R2 0.0434 0.0619 This table presents regression results from examining the association between IT Value Risk Disclosure and IT Security Risk Disclosure and a firm’s stock price crash risk following Equation (1). ***, **, and * indicate significance levels of 99%, 95%, and 90%, respectively. 61 Table 7 Moderating Effects of IT-related Material Weaknesses on Relations between IT Risk Factor Disclosure and Stock Price Crash Risk NCSKEW DUVOL Material Weakness Subsample No Material Weakness Subsample Material Weakness Subsample No Material Weakness Subsample Intercept 0.356 [0.91] 0.683 [4.78]*** 0.039 [0.52] 0.090 [2.89]*** ITVALUE 0.203 [1.59] 0.013 [0.33] 0.051 [2.04]** 0.003 [0.31] ITSECURITY 0.124 [1.49] 0.049 [1.99]** 0.034 [2.19]** 0.009 [1.77]* ITPERF*ITSEC -0.116 [-1.26] -0.020 [-0.53] -0.028 [-1.51] -0.005 [-0.75] SIZE 0.034 [0.91] 0.005 [0.60] 0.005 [0.77] 0.002 [1.19] BM 0.053 [1.48] 0.046 [2.63]*** 0.014 [1.94]* 0.018 [4.50]*** MOM -0.219 [-2.24]** -0.455 [-6.62]*** -0.054 [-2.37]** -0.106 [-6.30]*** SIGMA -15.358 [-3.83]*** -5.455 [-3.75]*** -3.150 [-5.96]*** -1.634 [-6.33]*** ABVOL -0.009 [-0.67] 0.003 [2.77]*** -0.001 [-0.37] 0.001 [3.51]*** ROA -0.172 [-0.74] -0.098 [-1.27] -0.022 [-0.43] -0.001 [-0.09] ROA_STD -0.009 [-1.95]* 0.000 [5.82]*** -0.001 [-0.94] 0.000 [6.71]*** LEV 0.218 [0.93] -0.085 [-1.20] 0.051 [1.08] -0.015 [-1.05] SG 0.000 [-1.20] -0.004 [-1.44] 0.000 [1.72]* -0.001 [-2.36]** OC 0.060 [1.11] -0.012 [-0.76] 0.012 [1.09] -0.002 [-0.68] NUMRF -0.001 [-0.20] 0.004 [4.17]*** 0.000 [-0.77] 0.001 [2.86]*** Industry Dummies Yes Yes Yes Yes Year Dummies Yes Yes Yes Yes Obs. 2038 27197 2038 27197 R2 0.0857 0.0418 0.1003 0.0593 This table presents the regression results from examining the moderating effects of IT-related Material Weaknesses on the relationship between IT Risk Factor Disclosure and a firm’s stock price crash risk following Equation (1). We split the sample into two subsamples containing firm-years where an IT-related Material Weakness was disclosed, and otherwise. ***, **, and * indicate significance levels of 99%, 95%, and 90%, respectively. 62 Table 8 Moderating Effects of FOG Index on Relations between IT Risk Factor Disclosure and Stock Price Crash Risk NCSKEW DUVOL High FOG Subsample Low FOG Subsample High FOG Subsample Low FOG Subsample Intercept 0.579 [3.88]*** 0.696 [2.50]*** 0.072 [2.28]** 0.073 [1.18] ITVALUE 0.035 [0.82] 0.014 [0.18] 0.010 [1.18] 0.001 [0.08] ITSECURITY 0.021 [0.72] 0.108 [2.87]*** 0.004 [0.73] 0.022 [2.88]*** ITPERF*ITSEC -0.070 [-1.94]* 0.045 [0.68] -0.016 [-2.21]** 0.006 [0.50] SIZE 0.008 [0.85] 0.014 [1.16] 0.003 [1.52] 0.003 [1.33] BM 0.056 [2.98]*** 0.044 [1.39] 0.018 [4.43]*** 0.019 [2.65]*** MOM -0.396 [-5.78]*** -0.460 [-3.28]*** -0.094 [-5.68]*** -0.105 [-3.13]*** SIGMA -9.823 [-6.01]*** -3.850 [-1.53] -2.434 [-9.55]*** -1.122 [-2.38]** ABVOL 0.003 [2.65]*** 0.002 [0.27] 0.001 [2.63]*** 0.001 [0.47] ROA -0.062 [-0.78] -0.339 [-2.19]** -0.006 [-0.36] -0.020 [-0.67] ROA_STD 0.002 [0.88] 0.000 [9.04]*** 0.001 [1.08] 0.000 [10.85]*** LEV -0.035 [-0.43] -0.145 [-1.22] -0.011 [-0.65] -0.019 [-0.81] SG 0.000 [-0.99] 0.004 [0.28] 0.000 [-0.41] 0.000 [-0.04] OC -0.004 [-0.23] -0.030 [-1.12] 0.000 [-0.04] -0.004 [-0.86] NUMRF 0.007 [5.59]*** 0.000 [0.34] 0.001 [4.36]*** 0.000 [-0.35] Industry Dummies Yes Yes Yes Yes Year Dummies Yes Yes Yes Yes Obs. 20510 9837 20510 9837 R2 0.0475 0.0408 0.0673 0.0557 This table presents the regression results from examining the moderating effects of readability on the relationship between IT Risk Factor Disclosure and a firm’s stock price crash risk following Equation (1). We split the sample into two subsamples, one where FOG is more than one standard deviation above the mean FOG, and one where FOG is less than one standard deviation above the mean FOG. ***, **, and * indicate significance levels of 99%, 95%, and 90%, respectively. 63 Table 9 Effect of new IT Risk Factor Disclosures on Stock Price Crash Risk NCSKEW DUVOL Intercept 0.627 [4.76]*** 0.076 [3.47]*** ITVALUEnew 0.026 [0.63] 0.006 [0.82] ITSECURITYnew 0.058 [2.23]** 0.010 [2.44]** ITVALUEnew * ITSECURITYnew -0.046 [-1.27] -0.009 [-1.47] ITVALUEold 0.044 [0.76] 0.007 [0.80] ITSECURITYold 0.032 [0.86] 0.009 [1.42] SIZE 0.008 [1.08] 0.003 [2.17]** BM 0.053 [3.30]*** 0.019 [6.20]*** MOM -0.411 [-6.57]*** -0.097 [-8.89]*** SIGMA -8.052 [-5.81]*** -2.049 [-10.92]*** ABVOL 0.003 [2.51]*** 0.001 [2.67]*** ROA -0.130 [-1.87]* -0.009 [-0.79] ROA_STD 0.000 [5.87]*** 0.000 [7.35]*** LEV -0.080 [-1.21] -0.014 [-1.32] SG 0.000 [-0.89] 0.000 [-0.34] OC -0.009 [-0.63] -0.001 [-0.43] NUMRF 0.004 [4.92]*** 0.001 [4.24]*** Industry Dummies Yes Yes Year Dummies Yes Yes Obs. 30347 30347 R2 0.0434 0.0619 This table presents the regression results from examining the relationship between newly disclosed IT Risk Factor Disclosures and a firm’s stock price crash risk following Equation (5). ***, **, and * indicate significance levels of 99%, 95%, and 90%, respectively. 64 Table 10 Moderating Effect of IT Risk Factor Rank on Relations between IT Risk Factor Disclosure and Stock Price Crash Risk NCSKEW DUVOL Low IT Rank Subsample High IT Rank Subsample Low IT Rank Subsample High IT Rank Subsample Intercept 0.470 [1.47] -0.505 [-0.28] 0.052 [0.97] -0.181 [-0.51] ITVALUE 0.103 [1.85]* 0.039 [0.18] 0.018 [1.89]* 0.010 [0.24] ITSECURITY 0.119 [2.42]** 0.001 [0.01] 0.016 [2.07]** 0.007 [0.26] ITPERF*ITSEC -0.073 [-1.63] -0.043 [-0.15] -0.012 [-1.76]* -0.020 [-0.36] SIZE 0.013 [0.87] 0.009 [1.06] 0.004 [1.78]* 0.002 [1.39] BM 0.047 [1.19] 0.059 [3.44]*** 0.017 [2.42]** 0.019 [5.00]*** MOM -0.529 [-3.59]*** -0.367 [-5.66]*** -0.118 [-4.75]*** -0.089 [-5.58]*** SIGMA -0.836 [-0.24] -10.396 [-6.85]*** -0.566 [-1.10] -2.530 [-10.48]*** ABVOL -0.005 [-0.35] 0.003 [2.52]*** -0.002 [-0.81] 0.001 [2.41]** ROA -0.169 [-1.16] -0.126 [-1.58] -0.027 [-1.16] -0.006 [-0.33] ROA_STD 0.000 [5.87]*** 0.001 [0.54] 0.000 [8.91]*** 0.000 [0.73] LEV -0.019 [-0.16] -0.097 [-1.25] 0.008 [0.39] -0.023 [-1.45] SG 0.009 [0.75] 0.000 [-0.97] 0.000 [0.23] 0.000 [-0.36] OC -0.012 [-0.48] -0.007 [-0.37] -0.002 [-0.55] 0.000 [-0.13] NUMRF 0.001 [0.58] 0.005 [4.91]*** 0.000 [-0.11] 0.001 [3.73]*** ITRANK -0.109 [-1.07] 1.138 [0.63] -0.020 [-1.21] 0.263 [0.74] Industry Dummies Yes Yes Yes Yes Year Dummies Yes Yes Yes Yes Obs. 10092 20255 10092 20255 R2 0.0432 0.0454 0.0568 0.0661 This table presents the regression results from examining the moderating effects of the order of appearance of IT related risk factors in Item 1A on the relationship between IT Risk Factor Disclosure and a firm’s stock price crash risk, following Equation (1). We separate the sample based on whether or not IT related risk factors are, on average, in the top one third of Item 1A in terms of the order in which risk factors are disclosed. A low rank means the risk factor is disclosed near the top of the Item 1A section, while a high rank means the risk factor is disclosed near the bottom. ***, **, and * indicate significance levels of 99%, 95%, and 90%, respectively. 65 Table 11 Robustness Check Results for Varying Crash Risk Window Sizes on Relations between IT Risk Factor Disclosure and Stock Price Crash Risk Panel A: 6 Month Window NCSKEW DUVOL ITVALUE 0.058 [1.52] 0.014 [1.50] ITSECURITY 0.038 [1.70]* 0.008 [1.31] ITVALUE*ITSECURITY -0.069 [-2.23]** -0.018 [-2.31]** Controls Yes Yes Obs. 30398 30398 R2 0.0229 0.0288 Panel B: 18 Month Window NCSKEW DUVOL ITVALUE 0.031 [0.83] 0.008 [1.05] ITSECURITY 0.052 [2.22]** 0.011 [2.21]** ITVALUE*ITSECURITY -0.026 [-0.74] -0.008 [-1.12] Controls Yes Yes Obs. 30294 30294 R2 0.0446 0.0632 Panel C: 2 Year Window NCSKEW DUVOL ITVALUE 0.063 [1.71]* 0.011 [1.85]* ITSECURITY 0.047 [2.09]** 0.010 [2.68]*** ITVALUE*ITSECURITY -0.014 [-0.40] -0.004 [-0.66] Controls Yes Yes Obs. 30248 30248 R2 0.0292 0.0451 Panel D: 3 Year Window NCSKEW DUVOL ITVALUE 0.074 [2.53]*** 0.012 [2.66]*** ITSECURITY 0.040 [2.28]** 0.007 [2.68]*** ITVALUE*ITSECURITY 0.003 [0.10] -0.001 [-0.31] Controls Yes Yes Obs. 30121 30121 R2 0.0281 0.0423 This table presents regression results from varying the stock price crash risk time window that was used to construct the two crash risk measures NCSKEW and DUVOL as a robustness check to our findings following Equation (1). ***, **, and * indicate significance levels of 99%, 95%, and 90%, respectively. 66 Table 12 Validity Check for the Effects of IT Value Risk Disclosure and IT Security Risk Disclosure on Stock Price Crash Risk NCSKEW DUVOL Intercept -0.345 [-3.61]*** -0.153 [-7.52]*** ITVALUE 0.033 [0.87] 0.009 [1.11] ITSECURITY 0.020 [0.89] 0.007 [1.47] ITVALUE*ITSECURITY 0.032 [0.89] 0.004 [0.61] SIZE 0.040 [5.90]*** 0.009 [6.29]*** BM 0.117 [7.17]*** 0.034 [9.37]*** MOM 0.053 [2.64]*** 0.012 [2.92]*** SIGMA -2.029 [-2.20]** -0.764 [-3.87]*** ABVOL -0.012 [-1.31] -0.002 [-1.18] ROA -0.237 [-3.34]*** -0.040 [-2.74]*** ROA_STD 0.000 [-2.42]** 0.000 [-3.58]*** LEV -0.110 [-1.71]* -0.015 [-1.09] SG 0.000 [-0.81] 0.000 [-1.04] OC -0.016 [-1.08] -0.001 [-0.22] NUMRF 0.003 [3.42]*** 0.000 [1.30] Industry Dummies Yes Yes Year Dummies Yes Yes Obs. 29583 29583 R2 0.0104 0.0177 This table presents regression results from examining the association between IT Value Risk Disclosure and IT Security Risk Disclosure and a firm’s stock price crash risk following Equation (1), but with the crash risk measurement window shifted one year back so that no correlation should be expected. ***, **, and * indicate significance levels of 99%, 95%, and 90%, respectively. 67 Table 13 Robustness Check Results for Varying Subsample Splitting Thresholds on the Moderating Effects of FOG Index on Relations between IT Risk Factor Disclosure and Stock Price Crash Risk Panel A: Low (High) Fog Subsample Having 10% (90%) of Observations NCSKEW DUVOL High FOG Subsample Low FOG Subsample High FOG Subsample Low FOG Subsample ITVALUE 0.043 [1.15] -0.162 [-0.80] 0.010 [1.35] -0.026 [-0.69] ITSECURITY 0.041 [1.66]* 0.140 [2.12]** 0.008 [1.68]* 0.028 [1.98]** ITVALUE*ITSEC -0.041 [-1.11] 0.137 [1.30] -0.011 [-1.63] 0.028 [1.41] Controls Yes Yes Yes Yes Obs. 27264 3083 27264 3083 R2 0.0483 0.0356 0.0685 0.0455 Panel B: Low (High) Fog Subsample Having 20% (80%) of Observations NCSKEW DUVOL High FOG Subsample Low FOG Subsample High FOG Subsample Low FOG Subsample ITVALUE 0.053 [1.37] -0.068 [-0.64] 0.012 [1.53] -0.011 [-0.53] ITSECURITY 0.034 [1.34] 0.117 [2.34]** 0.006 [1.19] 0.027 [2.63]*** ITVALUE*ITSEC -0.071 [-2.28]** 0.143 [1.45] -0.016 [-2.47]*** 0.024 [1.41] Controls Yes Yes Yes Yes Obs. 24311 6036 24311 6036 R2 0.0497 0.0384 0.0696 0.0470 Panel C: Low (High) Fog Subsample Having 30% (70%) of Observations NCSKEW DUVOL High FOG Subsample Low FOG Subsample High FOG Subsample Low FOG Subsample ITVALUE 0.035 [0.85] 0.017 [0.21] 0.010 [1.15] 0.002 [0.14] ITSECURITY 0.027 [0.97] 0.106 [2.65]*** 0.005 [0.88] 0.023 [2.76]*** ITVALUE*ITSEC -0.065 [-1.85]* 0.041 [0.59] -0.015 [-2.08]** 0.005 [0.39] Controls Yes Yes Yes Yes Obs. 21430 8917 21430 8917 R2 0.0479 0.0389 0.0677 0.0539 Panel D: Low (High) Fog Subsample Having 40% (60%) of Observations NCSKEW DUVOL High FOG Subsample Low FOG Subsample High FOG Subsample Low FOG Subsample ITVALUE 0.043 [0.98] 0.001 [0.01] 0.010 [1.11] 0.003 [0.23] ITSECURITY 0.011 [0.37] 0.103 [2.94]*** 0.003 [0.50] 0.020 [2.85]*** ITVALUE*ITSEC -0.075 [-1.98]** 0.036 [0.61] -0.016 [-2.04]** 0.002 [0.23] Controls Yes Yes Yes Yes Obs. 18605 11742 18605 11742 R2 0.0487 0.0410 0.0680 0.0564 Panel E: Low (High) Fog Subsample Having 50% (50%) of Observations NCSKEW DUVOL High FOG Subsample Low FOG Subsample High FOG Subsample Low FOG Subsample ITVALUE 0.063 [1.26] -0.010 [-0.18] 0.014 [1.39] 0.001 [0.05] ITSECURITY 0.013 [0.38] 0.078 [2.45]** 0.003 [0.37] 0.016 [2.50]*** ITVALUE*ITSEC -0.061 [-1.35] 0.008 [0.17] -0.013 [-1.44] -0.002 [-0.24] Controls Yes Yes Yes Yes Obs. 15601 14746 15601 14746 R2 0.0492 0.0416 0.0688 0.0579 68 Panel F: Low (High) Fog Subsample Having 60% (40%) of Observations NCSKEW DUVOL High FOG Subsample Low FOG Subsample High FOG Subsample Low FOG Subsample ITVALUE 0.039 [0.71] 0.023 [0.47] 0.011 [0.99] 0.006 [0.57] ITSECURITY 0.004 [0.10] 0.070 [2.36]** 0.002 [0.30] 0.014 [2.27]** ITVALUE*ITSEC -0.030 [-0.55] -0.026 [-0.60] -0.008 [-0.72] -0.007 [-0.93] Controls Yes Yes Yes Yes Obs. 12562 17785 12562 17785 R2 0.0481 0.0425 0.0683 0.0595 Panel G: Low (High) Fog Subsample Having 70% (30%) of Observations NCSKEW DUVOL High FOG Subsample Low FOG Subsample High FOG Subsample Low FOG Subsample ITVALUE 0.011 [0.17] 0.035 [0.76] 0.004 [0.30] 0.009 [0.99] ITSECURITY 0.009 [0.21] 0.063 [2.29]** 0.001 [0.07] 0.013 [2.40]** ITVALUE*ITSEC 0.033 [0.52] -0.038 [-0.95] 0.004 [0.31] -0.010 [-1.36] Controls Yes Yes Yes Yes Obs. 9439 20908 9439 20908 R2 0.0470 0.0432 0.0655 0.0613 Panel H: Low (High) Fog Subsample Having 80% (20%) of Observations NCSKEW DUVOL High FOG Subsample Low FOG Subsample High FOG Subsample Low FOG Subsample ITVALUE 0.027 [0.29] 0.032 [0.78] -0.002 [-0.11] 0.010 [1.25] ITSECURITY 0.000 [0.00] 0.056 [2.20]** -0.003 [-0.20] 0.012 [2.32]** ITVALUE*ITSEC 0.007 [0.08] -0.030 [-0.82] 0.006 [0.31] -0.010 [-1.43] Controls Yes Yes Yes Yes Obs. 6272 24075 6272 24075 R2 0.0426 0.0445 0.0579 0.0636 Panel I: Low (High) Fog Subsample Having 90% (10%) of Observations NCSKEW DUVOL High FOG Subsample Low FOG Subsample High FOG Subsample Low FOG Subsample ITVALUE 0.089 [0.63] 0.030 [0.77] -0.004 [-0.12] 0.009 [1.20] ITSECURITY -0.174 [-1.68]* 0.056 [2.32]** -0.045 [-2.13]** 0.012 [2.42]** ITVALUE*ITSEC -0.078 [-0.38] -0.029 [-0.82] -0.005 [-0.11] -0.009 [-1.40] Controls Yes Yes Yes Yes Obs. 3083 27264 3083 27264 R2 0.0610 0.0421 0.0831 0.0601 This table presents the regression results from examining the moderating effects of readability on the relationship between IT Risk Factor Disclosure and a firm’s stock price crash risk following Equation (1) by varying the threshold for dividing the alternate and null samples. ***, **, and * indicate significance levels of 99%, 95%, and 90%, respectively. 69 Table 14 Robustness Check Results for Varying Subsample Splitting Thresholds on the Moderating Effect of IT Risk Factor Rank on Relations between IT Risk Factor Disclosure and Stock Price Crash Risk Panel A: Low (High) IT Risk Factor Rank Subsample Having 10% (90%) of Observations NCSKEW DUVOL Low IT Rank Subsample High IT Rank Subsample Low IT Rank Subsample High IT Rank Subsample ITVALUE 0.071 [0.97] 0.073 [1.92]* 0.010 [0.65] 0.018 [2.36]** ITSECURITY 0.130 [1.95]* 0.054 [2.60]*** 0.023 [1.71]* 0.010 [2.41]** ITVALUE*ITSEC -0.037 [-0.71] -0.049 [-1.31] -0.008 [-0.70] -0.012 [-1.70]* Controls Yes Yes Yes Yes Obs. 3259 27088 3259 27088 R2 0.07509 0.04088 0.1066 0.05925 Panel B: Low (High) IT Risk Factor Rank Subsample Having 20% (80%) of Observations NCSKEW DUVOL Low IT Rank Subsample High IT Rank Subsample Low IT Rank Subsample High IT Rank Subsample ITVALUE -0.027 [-0.46] 0.102 [1.94]* 0.003 [0.30] 0.014 [1.26] ITSECURITY -0.002 [-0.06] 0.143 [3.01]*** 0.000 [0.08] 0.020 [2.14]** ITVALUE*ITSEC 0.076 [0.94] -0.100 [-2.70]*** 0.011 [0.95] -0.016 [-2.08]** Controls Yes Yes Yes Yes Obs. 6555 23792 6555 23792 R2 0.05799 0.03932 0.08042 0.05811 This table presents the regression results from examining the moderating effects of the order of appearance of IT related risk factors in Item 1A on the relationship between IT Risk Factor Disclosure and a firm’s stock price crash risk, following Equation (1) by varying the threshold for dividing the alternate and null samples. ***, **, and * indicate significance levels of 99%, 95%, and 90%, respectively.
Thesis/Dissertation
eng
Business Administration - Management Information Systems
Vancouver : University of British Columbia Library
Attribution-NonCommercial-NoDerivatives 4.0 International
Graduate
IT risk factor disclosure and stock price crashes
Text