Economic theory suggests that negative peer events can result in market-wide spillovers that help unaffected firms take real actions to enhance corporate governance. Motivated by the SEC's concern about cybersecurity, I study the role of peer events in corporate governance using the setting of data breaches. While controlling for firm-specific time-varying unobservable characteristics, I find that peer data breaches are associated with a reduction in future internal control material weaknesses for non-breached firms. The association is robust to a changes analysis and varies cross-sectionally with breach, firm, and board characteristics. Inferences remain consistent when studying IT-related material weaknesses only. Finally, non-breached firms are more likely to have a cybersecurity expert on the top management team after a peer breach. My findings have important implications for mandatory disclosure regulation in general and, in particular, suggest that regulators can help reduce market-wide exposure to cyber risk by facilitating disclosure of cyber incidents. Data Availability: All data used in the study are publicly available.

Data breach disclosure laws are state-level disclosure mandates intended to protect individuals from the consequences of identity theft. However, we argue that the laws help reduce shareholder risk by encouraging managers to take real actions to reduce firms’ exposure to cyber risk. Consistent with this argument, we find an on-average decrease in shareholder risk, proxied by cost of equity, after the staggered passage of these laws. We also find the effect is attenuated for firms that already took real actions to manage cyber risk before the laws. Further, after these laws, firms are more likely to increase cybersecurity investments and have a cybersecurity officer. Finally, we observe positive abnormal returns on key dates related to the passage of these laws. Our collective evidence suggests that consumer protection disclosure mandates can benefit shareholders and, specifically, that regulators can use disclosure mandates to incentivize managers to reduce firms’ exposure to cyber risk. Data Availability: All data used in this study are publicly available.

We examine whether information technology expertise on audit committees impacts the reliability and timeliness of financial reporting. We find a reduction in the likelihood of material restatement, a reduction in the likelihood of information technology-related material weaknesses (which account for 55 percent of all reported material weaknesses), and more timely earnings announcements at firms with audit committee information technology expertise. These findings are robust to controlling for a firm's other information technology attributes, as well as when using entropy balanced samples, and we mitigate endogeneity concerns with evidence that our findings hold in a subsample of firms that all possess overall high-quality information technology. Finally, a difference-in-differences analysis, inclusion of firm fixed effects, and a falsification test largely support our assertion that the quality of financial reporting is significantly improved by the presence of an audit committee information technology expert. JEL Classifications: M41; M15. Data Availability: All data used in the study are publicly available.