Audit committee and board-level governance effects on cybersecurity disclosure: evidence from the Takaful insurance industry

Purpose This study aims to investigate the impact of audit committee features on content and linguistic characteristics of insurance company’s cybersecurity risks disclosure practices over the period from 2020 to 2023. Design/methodology/approach This study allows for efficient estimation of parameters under different model specifications including count data models, panel data estimation techniques and the system generalized method of moments and data structures. Findings The author finds that the length of cybersecurity risk disclosures increases linearly during the period of our study. This increase is associated with the size of audit committee board, the size of the Shariah board and the presence of independent members. The disclosed information is more difficult to read as audit fees decrease and is easier to read as the proportion of independent members increase. On average, large companies with higher number of audit members are more likely to use litigious language. Practical implications The research findings substantiate the validity of resource dependency theory by empirically indicating that audit committee size, presence of independent members and large Shariah board size have the ability to address the needs of different stakeholders. In line with behavioral agency theory, paying a significantly higher audit fee plays a crucial role in the decision-making process of companies regarding cybersecurity risk-related disclosures initiatives. Originality/value First, this study provides the first systematic evidence on the relationship between audit committee characteristics and cybersecurity risk disclosure in the insurance industry as an essential element of sustainable economic growth. Second, the sample in this study covers Islamic (Takaful) insurance industry which enables us to examine the changes in disclosure usefulness and how effective the system of Islamic corporate governance is in controlling their disclosures toward describing cybersecurity risk. Third, although disclosure theories suggest a positive effect of audit governance tools on risk disclosure, they failed to provide the necessary evidence in the accurate information; thus, words count, language and readability are crucial for effective communication.