Code, control and cybersecurity: how board IT expertise shapes corporate risk management

Purpose This study investigates how board members with information technology (IT) backgrounds influence corporate cybersecurity risk governance. It focuses on Chinese A-share listed firms and explores the mechanisms through which IT expertise at the board level strengthens firms’ cybersecurity management. Design/methodology/approach Using a panel dataset of Chinese listed firms from 2007 to 2022, the paper measures cybersecurity governance through text analysis of annual reports. Board IT expertise is manually coded and assessed via both binary and ratio-based metrics. The empirical strategy employs fixed effects, robustness checks, instrumental variable regressions and mechanism analyses. Findings The presence of IT-experienced directors significantly improves corporate cybersecurity governance. This effect is primarily driven by greater IT investment and digital technology innovation. The positive impact is stronger in firms with high ESG reputations, those in high-tech industries and those in competitive markets. Enhanced cybersecurity governance, in turn, leads to greater corporate risk-taking and improved investor protection. Research limitations/implications The study focuses on Chinese listed firms, which may limit generalisability. Future research could extend to different institutional settings and examine long-term performance outcomes of board-level IT integration. Practical implications The findings offer practical guidance for firms and regulators aiming to strengthen cybersecurity oversight. Appointing IT-savvy directors can materially improve governance outcomes, mitigate cyber risks and enhance investor confidence. Social implications By promoting stronger corporate responses to cybersecurity threats, IT-competent boards contribute to digital resilience and trust in capital markets, especially in increasingly data-driven economies. Originality/value This study is among the first to empirically link board IT expertise with cybersecurity governance outcomes. It advances literature on board composition, digital governance and risk oversight by identifying how IT knowledge at the board level drives strategic corporate responses to cyber risk.