Cybersecurity Effectiveness and Cloud Accounting Risk: The Moderating Role of the COBIT-5 Governance Framework—Evidence from Jordanian Banks
TL;DR
The findings suggest that technical cybersecurity controls alone may be insufficient to secure cloud-stored financial information, and that their risk-mitigating potential appears to be more fully realized when embedded within a mature governance framework that institutionalises accountability, continuous monitoring, and compliance enforcement.
Abstract
This study investigates the effect of cybersecurity effectiveness on cloud accounting risk—operationalized through the three dimensions of the confidentiality, integrity, and availability (CIA) triad—within the Jordanian banking sector, comprising the 13 commercial banks listed on the Amman Stock Exchange. It further examines the moderating role of Control Objectives for Information and Related Technologies (COBIT-5) governance maturity in this relationship. Drawing on data from 388 cybersecurity, information technology, network security, and accounting professionals, the study employs Partial Least Squares Structural Equation Modeling (PLS-SEM) via SmartPLS 4 to estimate a single integrated structural model. The results indicate that cybersecurity effectiveness is significantly and negatively associated with all three dimensions of cloud accounting risk. COBIT-5 governance maturity significantly strengthens these negative associations across confidentiality, integrity, and availability, while exerting no statistically detectable direct effect of its own—a pattern consistent with COBIT-5 functioning as a pure moderator. Out-of-sample predictive tests (PLSpredict and the cross-validated predictive ability test, CVPAT) confirm that the model’s explanatory power translates into genuine predictive validity. These findings suggest that technical cybersecurity controls alone may be insufficient to secure cloud-stored financial information, and that their risk-mitigating potential appears to be more fully realized when embedded within a mature governance framework that institutionalises accountability, continuous monitoring, and compliance enforcement. The study recommends that Jordanian banks treat cybersecurity investment and COBIT-5 governance maturity as complementary, jointly prioritised strategic initiatives, and that regulatory authorities incorporate explicit COBIT-5 maturity benchmarks into supervisory assessment frameworks.