Software-Vendor Diversification: A Source of Organizational Rigidity in Adversity?

2023 | Journal of Management Information Systems | Citations: 0

Authors: Gong, Jing; Liang, Yi; Ramasubbu, Narayan

Abstract: Firms often assemble digital infrastructures using continuously evolving softwar ... Expand

Abstract: Firms often assemble digital infrastructures using continuously evolving software applications sourced from a multitude of vendors. Using the theoretical lens of the threat-rigidity thesis, we raise the possibility that during adverse environmental conditions, software-vendor diversification can be a source of organizational rigidity that may dampen firm performance. Empirical analysis using data on 918 large public U.S. firms operating during two severe environmental shocks, the global financial crisis and the burst of the dot-com bubble, lends strong support to our thesis. Results indicate that a variety of firm performance indicators (e.g., stock return and operating income measures) are negatively associated with software-vendor diversification during crisis periods. Mediation analysis highlights the role of IT-related material weakness in firms' internal controls in transmitting threat-rigidity effects that decrease performance. These results underscore the importance of software portfolio optimization for countering the dysfunctional effects of software-vendor diversification during adverse environmental shocks. Collapse

Topics: organizational productivity accounting computer hardware information technology infrastructure database system

Methods: mediation analysis structural equation modeling cross sectional research propensity score method longitudinal research

Where is IT in Information Security? The Interrelationship among IT Investment, Security Awareness, and Data Breaches

2023 | Management Information Systems Quarterly | Citations: 1

Authors: Li, Wilson Weixun; Leung, Alvin; Yue, Wei

Abstract: Data breaches can severely damage a firm's reputation and its customers' confid ... Expand

Abstract: Data breaches can severely damage a firm's reputation and its customers' confidence. Firms must therefore continuously invest in security measures to prevent such breaches. However, the effectiveness of security investment has been questioned by both practitioners and academics. We illustrate the bidirectional dynamic relationship between information technology (IT) investment and data breaches moderated by threat and countermeasure security awareness using an eight-year panel of 311 U.S.-listed firms to provide empirical evidence that threat awareness broadens firms' scope for addressing databreach issues by investing more in IT than in security. Countermeasure awareness equips firms with sufficient knowledge and experience to ensure effective implementation of IT, which provides more comprehensive protection than security investment alone. Our results suggest that firms should evolve beyond the reactive mindset of solely upgrading security and begin nurturing both threat awareness and countermeasure awareness to address the underlying IT system issues that are the cause of data breaches. Collapse

Topics: IT investment data breach IT security defense data security IT security threat

Methods: longitudinal research robustness check autocorrelation analysis survey literature study

Theories: institutional theory protection motivation theory

AN INVESTIGATION INTO THE ROLE OF DATA GOVERNANCE IN IMPROVING DATA QUALITY: A CASE STUDY OF THE OMANI BANKING SECTOR

2022 | European Conference On Information Systems | Citations: 0

Authors: Al Wahshi, Jihad; Foster, Jonathan; Abbott, Pamela

Abstract: In the era of big data analytics, data is widely recognised as a valuable asset ... Expand

Abstract: In the era of big data analytics, data is widely recognised as a valuable asset that can enable organisations to achieve their strategic objectives. Despite that, banks are still struggling to maintain high-quality data. Prior studies show that a data governance programme can play a critical role in improving data quality. It can provide data quality professionals with a holistic approach to formally define policies, procedures and decision rights required for managing data quality in a more systematic manner. However, few empirical studies were conducted in this area. Therefore, the present paper aims to close this gap by investigating the data quality problem in the Omani banking industry to understand how various data governance mechanisms can address this issue. The study adopted a qualitative case study with semi-structured interviews and document reviews being used to collect data. A theoretical framework by Abraham et al. (2019) was adopted to guide the collection and analysis of the data. A thematic analysis (TA) by Braun and Clark was followed for data analysis. Findings of the study suggest that the data governance mechanisms, namely 'performance measurement', 'compliance monitoring' and 'training', have positively contributed to mitigating data quality issues in the Omani banking sector. Collapse

Topics: data quality data governance business intelligence Sarbanes–Oxley Act data management

Methods: qualitative interview case study personal interview field study qualitative content analysis

Configuring the Enterprise Systems Portfolio: The Role of Information Risk

2022 | Information Systems Research | Citations: 0

Authors: Sambhara, Chaitanya; Rai, Arun; Xu, Sean Xin

Abstract: We investigate how public firms configure their enterprise systems (ES) portfoli ... Expand

Abstract: We investigate how public firms configure their enterprise systems (ES) portfolio when faced with information risk, which refers to the likelihood that corporate financial information is of poor quality. We focus on firms’ configuration of their ES portfolio by introducing a novel construct: ES portfolio balance, or the relative proportion of two categories of ES modules, operational and functional. We draw on the theory of information processing to hypothesize the impact of information risk on ES portfolio balance and how this impact is affected by internal controls. We construct a multisource panel data set of 697 firms and 1,993 firm-year observations from 2005 to 2008 and use econometric and multivariate procedures to test our hypotheses. We find that when faced with an increase in information risk, firms change their ES portfolio balance more toward operational modules. However, when such firms are also faced with materially weak internal controls, they change their ES portfolio balance more toward functional modules instead. These findings expand our understanding of how firms’ information processing needs drive the configuration of their ES portfolio and, more broadly, IT resources portfolio. Collapse

Topics: accounting enterprise information system database system Sarbanes–Oxley Act innovation management

Methods: longitudinal research theory development robustness check autocorrelation analysis statistical hypothesis test

Theories: theory of information

Assessing Privacy and Security of Information Systems from Audit Data

2022 | Information Systems Frontiers | Citations: 0

Authors: Westland, J. Christopher

Abstract: We investigated publicly reported security breaches of internal controls in corp ... Expand

Abstract: We investigated publicly reported security breaches of internal controls in corporate information systems to determine whether U.S. Securities and Exchange Commission (SEC) data are information bearing with respect to breaches of security and privacy. The issue has grown in importance as information systems breaches have steadily grown costlier and more frequent. Our analysis supports a high predictability for credit card breaches, portable device related breaches and breaches conducted by firm insiders. Our study also found evidence that employees are subverting particularly strict internal controls by using portable devices that can be carried outside the physical boundaries of the firm. In general, auditing and corporate data filed with the SEC was non-informative with regard to breaches involving unintended disclosures, physical losses, hacking and malware and workplace computers. Scope and fees associated with auditing are significant factors in predicting security breaches, whereas assessments of internal controls effectiveness was shown to be less significant for prediction. Collapse

Topics: Sarbanes–Oxley Act IT security threat credit card fraud privacy IT security

Methods: machine learning random forest classification gradient boosting general multivariate regression model XGBoost

No Rose without a thorn: Board IT competence and market reactions to operational IT failures

2021 | Information & Management | Citations: 6

Authors: Benaroch, Michel; Fink, Lior

Abstract: The continuous escalation in cybersecurity risk and the frequency of operational ... Expand

Abstract: The continuous escalation in cybersecurity risk and the frequency of operational IT failures have drawn attention to the importance of the board of directors’ monitoring function and responsibility for maximizing IT valueprotection. In response, boards have sought to enhance their IT competence levels. We assert that, while higher board IT competence has positive implications in IT value-creation, it could have a negative implication in the IT value-protection context. When firms have a more IT competent board, equity investors’ ex-ante expec­ tations of superior oversight of IT by the board are baked into those firms’ equity prices. When such firms experience operational IT failures, investors would view their boards as relatively ineffective in IT oversight and adjust more sharply the ex-ante expectations built into equity prices. Using agency-theoretic arguments, we develop this reasoning into a hypothesis that board IT competence is negatively associated with firm market performance post operational IT failures. Our analysis of 107 operational IT failures in public U.S. firms provides support for this hypothesis, even after we address the potential endogeneity of board IT competence. Collapse

Topics: IS failure IS value IT risk management IT governance database system

Methods: robustness check descriptive statistic econometric modeling data transformation statistical hypothesis test

Theories: agency theory lemon market theory

Women in the Inner Circle: Gender and Director Networks After the Fracturing of the Corporate Elite

2021 | Organization Science | Citations: 0

Authors: Benton, Richard A.

Abstract: Over the past two decades, women have increased their representation among multi ... Expand

Abstract: Over the past two decades, women have increased their representation among multiboard directors—corporate directors who simultaneously hold seats on two or more firms. Traditionally, multiboard directors exercised greater power and influence in corporate governance. As a consequence, women’s increased representation among this “inner circle” could signal women’s increased influence in corporate governance. However, women’s access to these elite positions comes at a time when multiboard holding has declined. This paper investigates gendered patterns in access to and outcomes of multiboard holding. I argue that these patterns reflect gendered logics in director appointment practices such that firms increasingly recruit and appoint highly boarded female directors, but multiboard women continue to lag in substantive influence in the boardroom. Analyses of nearly two decades of data on S&P 1500 boards demonstrate female directors’ increased access to the corporate inner-circle, but this access is decoupled from increased participation in board committees and interorganizational social influence. I discuss implications for theory on gender tokenism, corporate networks, and board processes. Collapse

Topics: social influence corporate governance network effect social network accounting

Methods: longitudinal research autocorrelation analysis simulation regression analysis method propensity score matching

Theories: organizational behavior theory

The strategic role of CIOs in IT controls: IT control weaknesses and CIO turnover

2021 | Information & Management | Citations: 9

Authors: Li, Wanyun; Phang, Soon-Yeow; Choi, Ka Wai (Stanley); Ho, Shuk Ying

Abstract: Extending the literature on information technology control weaknesses (ITCWs), w ... Expand

Abstract: Extending the literature on information technology control weaknesses (ITCWs), we investigate the strategic role of chief information officers (CIOs) in maintaining adequate internal controls and remediating ITCWs. Drawing on institutional theory and sunk cost effect, we develop three hypotheses. We adopt an archival approach and obtain CIO turnover and ITCW data for 890 distinct firms, finding that: (i) ITCW disclosures may not increase the likelihood of CIO turnover, (ii) CIOs’ backgrounds are associated with the likelihood of turnover, and (iii) CIO turnover increases the likelihood of subsequent ITCW remediation. Theoretically, we extend the literature by investigating the strategic role of CIOs in remediating ITCW. Practically, we find that common practices by firms to retain CIOs in ITCW situations are ineffective for ITCW remediation. Firms are encouraged to reconsider these practices. Collapse

Topics: Chief Information Officer accounting Sarbanes–Oxley Act LinkedIn logistics management

Methods: descriptive statistic archival research logistic regression regression analysis method propensity score matching

Theories: institutional theory

Developing a decision support system to detect material weaknesses in internal control

2021 | Decision Support Systems | Citations: 2

Authors: Nasir, Murtaza; Simsek, Serhat; Cornelsen, Erin; Ragothaman, Srinivasan; Dag, Ali

Abstract: Wells Fargo employees set up 3.5 million fraudulent accounts over several years. ... Expand

Abstract: Wells Fargo employees set up 3.5 million fraudulent accounts over several years. Wells Fargo ended up paying $4.5 billion in fines. The Wells Fargo scandal highlights the importance of management actions to prevent misstatements and potential frauds on a timely basis. This study utilized the design science research paradigm to develop a predictive framework (IT artifact) in order to stratify firms into multiple risk groups for disclosing material weakness(es) in internal control (MWIC). The proposed methodology employed a hybrid heuristic optimization-based machine learning methodology. Synthetic minority over-sampling technique (SMOTE) was uti­ lized to handle the learning problem with the imbalanced data. The best performing model was the proposed hybrid Genetic Algorithms (GA) and Support Vector Machines (SVM). The proposed methodology was internally validated via k-fold cross validation, and then externally validated using several separate datasets. The (GA) selected variables were ranked from the most important to the least through Information fusion (IF) sensitivity. A web-based decision support system was built to predict the firm-specific MWIC risk category. The web-based tool can be used to create an early warning system for predicting MWIC(s). Collapse

Topics: decision support system database system Sarbanes–Oxley Act missing data

Methods: support vector machine computational algorithm machine learning sensitivity analysis classification method

Theories: financial theory

COMMITMENT TO IT INVESTMENT PLANS: THE INTERPLAY OF REAL EARNINGS, MANAGEMENT, IT DECENTRALIZATION, AND CORPORATE GOVERNANCE

2021 | Management Information Systems Quarterly | Citations: 0

Authors: Xue, Ling; Mithas, Sunil

Abstract: How does real earnings management (REM) influence the extent to which firms real ... Expand

Abstract: How does real earnings management (REM) influence the extent to which firms realize their IT investment plans? To answer this question, we study the association between firms’ engagement in REM and the extent of commitment to planned investments in IT infrastructure. We also study the extent to which this association is moderated by IT decentralization, and, in turn, how such a moderating relationship is influenced by other corporate governance mechanisms such as institutional ownership and takeover threats. We document three important findings based on our analyses of data on 2,884 U.S. firms over the period 1998–2009. First, we find a negative association between engagement in REM and IT infrastructure investment commitment, suggesting potentially negative consequences of REM for realizing IT investment plans. Second, we find that IT decentralization weakens the negative association between REM and IT investment commitment (ITIC), implying that decentralized IT governance mechanisms can serve as a potential antidote to negative effects of REM on IT investments. Finally, we find evidence that other corporate governance mechanisms, such as institutional ownership and takeover threats, can complement IT decentralization to further mitigate the negative association between REM and ITIC. Together, these findings provide new insights on how REM, IT decentralization, and other corporate governance mechanisms influence actual IT investments of firms. Our work here, which focuses on deviations from one’s own IT investment plans, makes a novel contribution by extending prior work which has so far focused only on deviations from industry norm in IT investments. Collapse

Topics: IT decentralization IT investment corporate governance information technology infrastructure database system

Methods: robustness check Compustat descriptive statistic probit regression data transformation