Table 1 Measurement and operationalization of variables.

Dependent variable

Financial loss (cybercrime)

FINLoss

Proxy by the total financial loss suffered due to cybercrime disclosed in the annual reports

Baxter et al. [23] and Okoye et al. [65]

Independent variables (risk gov. variables)

Chief risk officer presence

CRO_presence

CRO is dummy variable, set equal to 1 for firms with CRO designation, and 0 otherwise

McShane et al. [29]

Chief risk officer centrality

CRO_centrality

CRO remuneration divided by CFO remuneration. Note CFO means Chief Financial Officer

Cavezzali, and Garddenal [66]

Board risk committee size

BRC_size

The total number of members on the risk committee

Erin et al. [21] and [33]

Board risk committee activism

BRC_activism

BRC activism is the number of times meeting was held in a financial year

Aebi et al. [67] and Li et al. [20]

Enterprise risk management index

ERM_index

ERM index is measured through the combination of corporate governance and risk variables

Hoyt and Liebenberg [38] and Arnold et al. [68]

Board risk committee independence

BRC_independence

The proportion of non-executive directors divided by total numbers of directors

Gordon et al. [16] and Soliman and Adam [6]

Corporate governance variables

Board of director independence

BOD_independence

The proportion of non-executive directors divided by total numbers of directors

Ellul and Yerramilli [41];

Board size

BSIZE

The actual number of directors on the firm’s board

Ame, Arumona and Erin [45]

Firm characteristics variables

Firm Age

FAGE

The number of years of a firm’s existence since incorporation

Baxter et al. [23] and Okoye et al. [43]

Firm size

FSIZE

Proxy by the natural logarithm of Total Assets

Uwuigbe et al. [47]