IT Risk Reporting and its Determinants: An Empirical Analysis of German Group Management Reports

Risks related to cybersecurity, information technology, and information security increasingly threaten business operations and imply disclosures in mandatory risk reporting. In Germany, there is lack of empirical evidence on the development and the determinants of IT risk reporting. Our study provides such evidence based on an automated content analysis of group management reports of companies listed in the DAX, MAX, and TecDAX in the period 2016-2020. Our multiple regression results indicate that the volume of IT risk reporting (1) has increased over time, (2) is unrelated to corporate IT risk, and (3) is positively associated with the share of women in the supervisory boards. The findings have implications for regulation, practice, and research.