Abstract
The continuous escalation in cybersecurity risk and the frequency of operational IT failures have drawn attention to the importance of the board of directors’ monitoring function and responsibility for maximizing IT value-protection. In response, boards have sought to enhance their IT competence levels. We assert that, while higher board IT competence has positive implications in IT value-creation, it could have a negative implication in the IT value-protection context. When firms have a more IT competent board, equity investors’ ex-ante expectations of superior oversight of IT by the board are baked into those firms’ equity prices. When such firms experience operational IT failures, investors would view their boards as relatively ineffective in IT oversight and adjust more sharply the ex-ante expectations built into equity prices. Using agency-theoretic arguments, we develop this reasoning into a hypothesis that board IT competence is negatively associated with firm market performance post operational IT failures. Our analysis of 107 operational IT failures in public U.S. firms provides support for this hypothesis, even after we address the potential endogeneity of board IT competence.
Original language | American English |
---|---|
Article number | 103546 |
Journal | Information and Management |
Volume | 58 |
Issue number | 8 |
DOIs | |
State | Published - 1 Dec 2021 |
Keywords
- Board IT competence
- IT risk governance
- IT value-protection
- Operational IT failures
- Stock market reaction
All Science Journal Classification (ASJC) codes
- Management Information Systems
- Information Systems
- Information Systems and Management