The association between top management involvement and compensation and information security breaches

Journal of Information Systems

Volumn 27, Issue 1, 2013, Pages 219-236

  Kwon, Juhee ^a   Ulmer, Jackie Rees ^b   Wang, Tawei ^c  

^a DARTMOUTH COLLEGE   (United States)

^b PURDUE UNIVERSITY   (United States)

^c UNIVERSITY OF HAWAII   (United States)

Author keywords

Information security breach; Information security risk management; IT executives; IT governance

Indexed keywords

EID: 84879741395     PISSN: 08887985     EISSN: 15587959     Source Type: Journal    
DOI: 10.2308/isys-50339     Document Type: Article

References (53)

1. Aggarwal, R. K., and A. A. Samwick. 1999. Executive compensation, strategic competition, and relative performance evaluation: Theory and evidence. Journal of Finance 54 (6): 1999-2043.
2. Anderson, R. J. 2001. Why Information Security Is Hard-An Economic Perspective. Proceedings of the 17th Annual Computer Security Applications Conference, Cambridge, U.K.
3. Archambeault, D. S., F. T. DeZoort, and D. R. Hermanson. 2008. Audit committee incentive compensation and accounting restatements. Contemporary Accounting Research 25 (4): 965-992.
4. Bloom, M. 1999. The performance effects of pay dispersion on individuals and organizations. Academy of Management Journal 42 (1): 25-40.
5. Bussey, J. 2011. Has time come for more CIOs to start reporting to the top? Wall Street Journal (May 17).
6. Campbell, K., L. Gordon, M. Loeb, and L. Zhou. 2003. The economic cost of publicly announced information security breaches: Empirical evidence from the stock market. Journal of Computer Security 11 (3): 431-448.
7. Carpenter, M. A., and J. B. Wade. 2002. Micro-level opportunity structures as determinants of non-CEO executive pay. Academy of Management Journal 45 (6): 1085-1103.
8. Carpenter, M. A., and W. G. Sanders. 2002. Top management team compensation: The missing link between CEO pay and firm performance? Strategic Management Journal 23 (4): 367-375.
9. Chen, D. Q., D. S. Preston, and W. D. Xia. 2010. Antecedents and effects of CIO supply-side and demandside leadership: A staged maturity model. Journal of Management Information Systems 27 (1): 231-272.
10. Computer Security Institute (CSI). 2011. CSI Computer Crime and Security Survey 2010/2011. New York, NY: Computer Security Institute.
11. Demsetz, H., and K. Lehn. 1985. The structure of corporate ownership: Causes and consequences. Journal of Political Economy 93 (6): 1155-1177.
12. Dhillon, G., and J. Backhouse. 2001. Current directions in IS security research: Towards socioorganizational perspectives. Information Systems Journal 11 (2): 127-153.
13. Dumagan, J., and G. Gill. 2002. Industry-level effects of information technology use on productivity and inflation. In Digital Economy 2002, edited by J. Mayer and L. Price, 31-40. Washington, DC: U.S. Department of Commerce.
14. Eisenhardt, K. M. 1989. Agency theory: An assessment and review. Academy of Management Review 14 (1): 57-74.
15. Ettredge, M. L., and V. J. Richardson. 2003. Information transfer among Internet firms: The case of hacker attacks. Journal of Information Systems 17 (2): 71-82.
16. Fiss, P. C. 2006. Social influence effects and managerial compensation evidence from Germany. Strategic Management Journal 27 (11): 1013-1031.
17. Galbraith, C. S., and G. B. Merrill. 1991. The effect of compensation program and structure on SBU competitive strategy: A study of technology-intensive firms. Strategic Management Journal 12 (5): 353-370.
18. Gibbons, R., and K. J. Murphy. 1992. Optimal incentive contracts in the presence of career concerns: Theory and evidence. Journal of Political Economy 100 (3): 468-505.
19. Greene, W. H. 2003. Econometric Analysis. Upper Saddle River, NJ: Prentice Hall.
20. Hall, J. A., and S. L. Liedtka. 2005. Financial performance, CEO compensation, and large-scale information technology outsourcing decisions. Journal of Management Information Systems 22 (1): 193-221.
21. Hallock, K. F. 1997. Reciprocally interlocking boards of directors and executive compensation. Journal of Financial and Quantitative Analysis 32 (3): 331-344.
22. Holthausen, R. W., D. F. Larcker, and R. G. Sloan. 1995. Business unit innovation and the structure of executive compensation. Journal of Accounting and Economics 19 (2): 279-313.
23. ISACA. 2012a. COBIT 5 for Information Security. Rolling Meadows, IL: ISACA.
24. ISACA. 2012b. Securing Sensitive Personal Data or Information Using COBIT 5. Rolling Meadows, IL: ISACA.
25. IT Governance Institute (ITGI). 2005. Board Briefing on IT Governance. Rolling Meadows, IL: The IT Governance Institute.
26. Johnson, A. M., and A. L. Lederer. 2010. CEO/CIO mutual understanding, strategic alignment, and the contribution of IS to the organization. Information and Management 47 (3): 138-149.
27. Kannan, K., J. Rees, and S. Sridhar. 2007. Market reactions to information security breach announcements: An empirical analysis. International Journal of Electronic Commerce 12 (1): 69-91.
28. Kearns, G. S., and A. L. Lederer. 2003. A resource-based view of strategic IT alignment: How knowledge sharing creates competitive advantage. Decision Sciences 34 (1): 1-29.
29. Kohli, R., and S. Devaraj. 2003. Measuring information technology payoff: A meta-analysis of structural variables in firm-level empirical research. Information Systems Research 14 (2): 127-145.
30. Li, C., J. Lim, and Q. Wang. 2007. Internal and external influences on IT control governance. International Journal of Accounting Information Systems 8: 225-229.
31. Luftman, J. 2000. Assessing business-IT alignment maturity. Communications of the Association for Information Systems 4: Article 14.
32. Luftman, J., and R. Kempaiah. 2008. Key issues for IT executives 2007. MIS Quarterly Executive 7 (2): 99-112.
33. McFadzean, E., J. N. Ezingeard, and D. Birchall. 2007. Perception of risk and the strategic impact of existing IT on information security strategy at board level. Online Information Review 31: 622-660.
34. Oliver, R. L., and E. Anderson. 1994. An empirical test of the consequences of behavior-and outcomebased sales control-systems. Journal of Marketing 58 (4): 53-67.
35. Pavlou, P. A., H. G. Liang, and Y. J. Xue. 2007. Understanding and mitigating uncertainty in online exchange relationships: A principal-agent perspective. MIS Quarterly 31 (1): 105-136.
36. Pfeffer, J., and N. Langton. 1993. The effect of wage dispersion on satisfaction, productivity, and working collaboratively: Evidence from college and university faculty. Administrative Science Quarterly 38 (3): 382-407.
37. Posthumus, S., and R. von Solms. 2005. A responsibility framework for information security. Security Management, Integrity, and Internal Control in Information Systems 193: 205-221.
38. Preston, D. S., D. Chen, and D. E. Leidner. 2008. Examining the antecedents and consequences of CIO strategic decision-making authority: An empirical study. Decision Sciences 39 (4): 605-642.
39. PricewaterhouseCoopers (PwC). 2011. Corporate Directors Increasing Their Focus on Executive Compensation, Risk Management and Succession Planning. New York, NY: PwC.
40. Santaló, J., and C. J. Kock. 2009. Division director versus CEO compensation: New insights into the determinants of executive pay. Journal of Management 35 (4): 1047-1077.
41. Smaltz, D. H., V. Sambamurthy, and R. Agarwal. 2004. The Antecedents of CIO Role Effectiveness in Organizations: An Empirical Study in the Healthcare Sector. Proceedings of the Conference on Information Systems and Technology, Denver, CO.
42. Strassmann, P. A. 1994. CIOs should get back to basics. Datamation 40 (18): 70-72.
43. Thong, J. Y. L., C. S. Yap, and K. S. Raman. 1996. Top management support, external expertise and information systems implementation in small businesses. Information Systems Research 7 (2): 248-267.
44. Vafeas, N. 1999. Board meeting frequency and firm performance. Journal of Financial Economics 53 (1): 113-142.
45. Vafeas, N. 2005. Audit committees, boards, and the quality of reported earnings. Contemporary Accounting Research 22 (4): 1093-1122.
46. Wallace, L., H. Lin, and M. A. Cefaratti. 2011. Information security and Sarbanes-Oxley compliance: An exploratory study. Journal of Information Systems 25 (1): 185-211.
47. Wang, T., and C. Hsu. 2010a. The Impact of Board Structure on Information Security Breaches. Proceedings of the Pacific Asia Conference on Information Systems (PACIS), Taipei, Taiwan.
48. Wang, T., and C. Hsu. 2010b. The Composition of Top Management Team on the Effectiveness of Information Security Management. Proceedings of the Americas Conference on Information Systems (AMCIS), Buenos Aires, Argentina.
49. Wang, T., and C. Hsu. 2012. Board Composition and Operational Risk Events of Financial Institutions. Working paper, University of Hawaii at Manoa and National Taiwan University.
50. Wang, T., J. Rees, and K. Kannan. 2012. The Textual Contents of Media Reports of Information Security Breaches and Profitable Short-Term Investment Opportunities. Working paper, University of Hawaii at Manoa and Purdue University.
51. Wang, T., K. Kannan, and J. Rees. 2012. The association between the disclosure and the realization of information security risk factors. Information Systems Research (forthcoming).
52. Wilkin, C. L., and R. H. Chenhall. 2010. A review of IT governance: A taxonomy to inform accounting information systems. Journal of Information Systems 24 (2): 107-146.
53. Yayla, A., and Q. Hu. 2008. Determinants of CIO Compensation Structure and Its Impact on Firm Performance Proceedings of the 41st Hawaii International Conference on System Sciences, Big Island, Hawaii.