Cyber Risk Reporting of Large International Electric Utility Companies

Abstract: The purpose of this study is to highlight and dig deeper into an increasingly relevant research area, cyber risk reporting practices. Cyber risk is one of the most significant concerns for businesses worldwide and of specific concern to the energy industry due to the vulnerability and importance of energy companies. A review of risk reporting research reveals the potential value of further longitudinal, industry-specific studies on international companies and that relatively little is known about how businesses in Europe report on cyber risk. Accordingly, this study aims to investigate the cyber risk reporting practices of five large publicly listed international European-based electric utility companies and how their reporting has changed over the last few years. A qualitative content analysis is performed on the annual reports of the five sample companies. The findings indicate that the companies tend to have a positive tone in their cyber risk disclosures, emphasise the mitigation of cyber risk and keep from revealing many details. Change over the years varies between companies, and one company stands out with its highly sparse reporting. The research shows that there seems to be room for improvement in the companies’ cyber risk reporting and indicates several potentially interesting avenues for continued research on the topic.