No Rose without a thorn: Board IT competence and market reactions to operational IT failures

Abstract

The continuous escalation in cybersecurity risk and the frequency of operational IT failures have drawn attention to the importance of the board of directors’ monitoring function and responsibility for maximizing IT value-protection. In response, boards have sought to enhance their IT competence levels. We assert that, while higher board IT competence has positive implications in IT value-creation, it could have a negative implication in the IT value-protection context. When firms have a more IT competent board, equity investors’ ex-ante expectations of superior oversight of IT by the board are baked into those firms’ equity prices. When such firms experience operational IT failures, investors would view their boards as relatively ineffective in IT oversight and adjust more sharply the ex-ante expectations built into equity prices. Using agency-theoretic arguments, we develop this reasoning into a hypothesis that board IT competence is negatively associated with firm market performance post operational IT failures. Our analysis of 107 operational IT failures in public U.S. firms provides support for this hypothesis, even after we address the potential endogeneity of board IT competence.