The continuous escalation in cybersecurity risk and the frequency of operational IT failures have drawn attention to the importance of the board of directors’ monitoring function and responsibility for maximizing IT value-protection. In response, boards have sought to enhance their IT competence levels. We assert that, while higher board IT competence has positive implications in IT value-creation, it could have a negative implication in the IT value-protection context. When firms have a more IT competent board, equity investors’ ex-ante expectations of superior oversight of IT by the board are baked into those firms’ equity prices. When such firms experience operational IT failures, investors would view their boards as relatively ineffective in IT oversight and adjust more sharply the ex-ante expectations built into equity prices. Using agency-theoretic arguments, we develop this reasoning into a hypothesis that board IT competence is negatively associated with firm market performance post operational IT failures. Our analysis of 107 operational IT failures in public U.S. firms provides support for this hypothesis, even after we address the potential endogeneity of board IT competence.

网络安全风险的持续升级和 IT 运营故障的频繁发生，已经引起了人们对董事会监控职能和责任的重要性的关注，以最大限度地保护 IT 价值。作为回应，董事会寻求提高其 IT 能力水平。我们断言，虽然更高的董事会 IT 能力对 IT 价值创造具有积极意义，但它可能对 IT 价值保护环境产生负面影响。当公司拥有更胜任的 IT 董事会时，股权投资者的事前对董事会对 IT 进行卓越监督的期望已计入这些公司的股价中。当这些公司遇到 IT 运营失败时，投资者会认为他们的董事会在 IT 监督方面相对无效，并更大幅度地调整股票价格中的事前预期。使用代理理论论证，我们将这一推理发展为一个假设，即董事会 IT 能力与 IT 运营失败后的公司市场绩效呈负相关。我们对美国上市公司 107 起 IT 运营失败的分析为这一假设提供了支持，即使我们解决了董事会 IT 能力的潜在内生性问题。