Do CEO attributes matter in the nexus between board composition and cybersecurity risk disclosure? Evidence from South African firms

In recent years, regulatory authorities, shareholders, managers, and governance bodies have been more aware of the growing wave of cyber threats and information security breaches and their effects on business operations. Cybersecurity risk disclosure has been recognized as a critical governance approach that minimizes information asymmetry among different and heterogeneous stakeholders to control and limit a firm's exposure to cyberattacks. This study examines the impact of board composition on cybersecurity risk disclosure across 52 South African companies. The study also investigates the role of CEO attributes in the nexus between the two variables. The study applies heteroscedasticity consistent standard error pooled ordinary least square, system generalized method of moment, panel corrected standard errors and Driscoll and Kraay robust standard error methods to control for heteroscedasticity, endogeneity, and cross-sectional dependence respectively among the panel units. The main findings from the study show that gender diversity on the board, board independence, and the frequency of board meetings consistently improve corporate decisions on cybersecurity risk disclosure. In the meantime, the quantity of cybersecurity information in company annual reports does not seem to be significantly impacted by ethnic diversity constantly. At the same time, board size is associated with less disclosure of cyber-related information. The study further documents that CEO education and tenure act as strong moderators and thus shape the impact of board attributes on cybersecurity disclosure. The study highlights the crucial role of CEO attributes in moderating the relationship between board composition and firms' decisions on corporate cybersecurity risk disclosure.