Abstract:[Purpose]Recently, the importance of information protection has been emerged with the increasing number of cases of cyber security incidents toward companies. In this study, we examine whether there is relevant implication to the input of additional audit efforts from the auditor’s point of view, whose work includes checking additional efforts invested by companies to improve the level of information protection by linking them with internal control risks. [Methodology]A regression analysis was conducted based on a sample constructed from TS2000 and the information security disclosure portal sites. [Findings]Results of the study show that there is a positive (+) relationship between the level of information protection (investment amount, manpower) and audit effort (fee, hour). In addition, there is a positive (+) relationship between information protection investment per person and audit effort, but the higher amount of information protection investment among the amount of technology investment might influence relationship, which reminded us of the need to appropriately consider the size of investment and the size of manpower in information security. [Implications]This study contributes by suggesting that it is possible to study the accounting aspect in the field of information protection and, at the same time, contributes to the expansion of related literature. In addition, by selecting information protection rather than external intrusion (hacking) as a substitute for cyber security, it is differentiated from previous studies by showing that it is possible to identify a relatively small sample to conduct empirical tests. However, since the mandatory information security disclosure system is in its infancy and the sample was selected based on compulsory disclosure and voluntary disclosure, it did not cover the entire industry and various sizes of companies, so care must be taken in interpreting the results.

Where is IT in Information Security? The Interrelationship among IT Investment, Security Awareness, and Data Breaches

Understanding the Cost associated with Data Security Breaches.

The Roles of IT Strategies and Security Investments in Reducing Organizational Security Breaches

Differential Market Reaction to Data Security Breaches: A Screening Perspective

Information security breaches and IT security investments: Impacts on competitors

The Role of Corporate Reputation and Crisis Response Strategies in Data Breach Management.

Game of Information Security Investment: Impact of Attack Types and Network Vulnerability.

An Extreme Value Approach to Information Technology Security Investment.

The Relationship between Board-Level Technology Committees and Reported Security Breaches

Do Strategy and Timing in IT Security Investments Matter? an Empirical Investigation of the Alignment Effect

The effect of information security certification announcements on the market value of the firm

Factors Affecting Perception of Information Security and Their Impacts on IT Adoption and Security Practices.

An Empirical Analysis of Security Investment in Countermeasures Based on an Enterprise Survey in Japan.

Empirical-Analysis Methodology for Information-Security Investment and Its Application to Reliable Survey of Japanese Firms

Focusing on the Fundamentals? an Investigation of the Relationship Between Corporate Social Irresponsibility and Data Breach Risk

Knowledge sharing and investment decisions in information security

A Study on the Relation between Firm’s Information Protection Level and Audit Efforts

Threats and countermeasures for information system security: A cross-industry study

Comparison of Information Security Decisions under Different Security and Business Environments

Towards the Framework of Information Security

Adaptive Model of Information Security Technique Investment