Board Gender Diversity and Corporate Response to Cyber Risk: Evidence from Cybersecurity Related Disclosure

Abstract

Cyber risk has become one of the greatest threats to firms in recent years. Accordingly, boards of directors must be continually vigilant about this danger. They have a duty to ensure that the companies adopt appropriate cybersecurity measures to manage the risk of cyber fraud. Boards should also ensure that the firm disclose material cyber risk and breaches. We examine how the board’s gender composition can influence the extent of such disclosure, based on a sample of the companies listed on the S&P/TSX 60 Index over the period 2014–2018. Results show evidence of a positive association between the presence and level of cybersecurity disclosure and board gender diversity. However, the board must boast a critical mass of at least three women before this positive impact can be observed. Our findings contribute to the debate on the importance of gender diversity by adding the concept of the positive influence of heterogeneity on cyber disclosure. We also augment the literature on the critical mass of women in boardrooms by providing empirical evidence that three or more women constitute the threshold for better governance. Our study has important implications for investors, stakeholders and regulators. If investors wish to increase cybersecurity disclosure, they should ask for more diversified boards. Our findings support regulators in their efforts to increase women’s representation on boards by providing empirical evidence of better outcomes with this type of board composition.

Appendices

Appendix A: List of the Sample Companies

No.	Company
1	Agnico Eagle Mines
2	Alimentation Couche-Tard
3	Bank of Montreal
4	Bank of Nova Scotia
5	Barrick Gold
6	Bausch Health Companies
7	BCE
8	BlackBerry
9	Bombardier
10	Brookfield Asset Management
11	Brookfield Infrastructure Partners
12	Cameco Corporation
13	Canadian Imperial Bank Of Commerce
14	Canadian National Railway Company
15	Canadian Natural Resources
16	Canadian Pacific Railway
17	Canadian Tire
18	Canopy Growth
19	CCL Industries
20	Cenovus Energy
21	CGI
22	Constellation Software
23	Dollarama
24	Emera
25	Enbridge
26	Encana
27	First Quantum Minerals
28	Fortis
29	Franco-Nevada
30	George Weston
31	Gildan Activewear
32	Husky Energy
33	Imperial Oil
34	Inter Pipeline
35	Kinross Gold
36	Loblaw Companies
37	Magna International
38	Manulife Financial
39	Metro
40	National Bank of Canada
41	Nutrien
42	Open Text
43	Pembina Pipeline
44	Power Corporation of Canada
45	Restaurant Brands International
46	Rogers Communications
47	Royal Bank of Canada
48	Saputo
49	Shaw Communications
50	Shopify
51	SNC-Lavalin Group
52	Sun Life Financial
53	Suncor Energy
54	TC Energy
55	Teck Resources
56	TELUS
57	Thomson Reuters
58	Toronto-Dominion Bank
59	Waste Connections
60	Wheaton Precious Metals

Appendix B

Example of Similar Cybersecurity-Related Statements in Annual Reports Published Between 2015 and 2018

Excerpts from the annual reports of Wheaton Precious Metals.

Information Systems and Cyber Security

Silver Wheaton’s information systems, and those of its counterparties under the precious metal purchase agreements, third-party service providers and vendors, are vulnerable to an increasing threat of continually evolving cybersecurity risks. Unauthorized parties may attempt to gain access to these systems or the Company’s information through fraud or other means of deceiving the Company’s counterparties under its precious metal purchase agreements, third-party service providers or vendors.

Silver Wheaton’s operations depend, in part, on how well Silver Wheaton and its suppliers, as well as counterparties under the precious metal purchase agreements, protect networks, equipment, information technology (“IT”) systems and software against damage from a number of threats. Silver Wheaton has entered into agreements with third parties for hardware, software, telecommunications and other services in connection with its operations. The Company’s operations and Mining Operations also depend on the timely maintenance, upgrade and replacement of networks, equipment, IT systems and software, as well as pre-emptive expenses to mitigate the risks of failures. Any of these and other events could result in information system failures, delays and/or increase in capital expenses. The failure of information systems or a component of information systems could, depending on the nature of any such failure, adversely impact the Corporation’s reputation and results of operations.

Although to date the Company has not experienced any material losses relating to cyber attacks or other information security breaches, there can be no assurance that Silver Wheaton will not incur such losses in the future. The Company’s risk and exposure to these matters cannot be fully mitigated because of, among other things, the evolving nature of these threats. As a result, cyber security and the continued development and enhancement of controls, processes and practices designed to protect systems, computers, software, data and networks from attack, damage or unauthorized access remain a priority.

Any future significant compromise or breach of the Company’s data security, whether external or internal, or misuse of data, could result in additional significant costs, lost sales, fines and lawsuits, and damage to the Company’s reputation. In addition, as the regulatory environment related to information security, data collection and use, and privacy becomes increasingly rigorous, with new and constantly changing requirements applicable to Silver Wheaton’s business and counterparties to the precious metal purchase agreements, compliance with those requirements could also result in additional costs. As cyber threats continue to evolve, the Company or its counterparties may be required to expend additional resources to continue to modify or enhance protective measures or to investigate and remediate any security vulnerabilities.”

Wheaton Precious Metals 2018 Annual Report, p. 44,

Wheaton Precious Metals 2017 Annual Report, p. 41,

Wheaton Precious Metals 2016 Annual Report, p. 38,

Wheaton Precious Metals 2015 Annual Report, p. 51.

Appendix C: Statement on a Woman Director with IT Expertise

Excerpt from Imperial Oil Form 10-K (2018).⁴

Miranda C. Hubbs.

Toronto, Ontario, Canada.

Miranda Hubbs is currently an independent director of Nutrien Ltd. and also serves as an independent director of PSP Investments (Public Sector Pension Investment Board). Ms. Hubbs serves on the board of the Canadian Red Cross and is a founding member and past national co-chair of the Canadian Red Cross Tiffany Circle—Women Leading Through Philanthropy. Prior to retirement in 2011, Ms. Hubbs was executive vice president and managing director of McLean Budden. Ms. Hubbs holds a BSc from Western University and an MBA from Schulich School of Business at York University and is a CFA charterholder and a National Association of Corporate Directors (NACD) Governance Fellow. Ms. Hubbs also received her CERT Certificate in Cybersecurity Oversight issued by the CERT Division of the Software Engineering Institute at Carnegie Mellon University.

Nonemployee director (independent).

Age: 52.

Director since: July 26, 2018.

Skills and experience Global experience, Strategy development, Audit committee financial expert, Financial expertise, Information technology/Cybersecurity, Executive compensation.

Director qualification and selection process.

Other expertise.

Expertise in information technology and cybersecurity (Information technology/Cybersecurity).