{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,3]],"date-time":"2026-06-03T11:46:59Z","timestamp":1780487219302,"version":"3.54.1"},"reference-count":53,"publisher":"American Accounting Association","issue":"1","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2013,6,1]]},"abstract":"<jats:title>ABSTRACT<\/jats:title>\n               <jats:p>This paper examines how an information technology (IT) executive's position in a top management team and how his\/her compensation are associated with the likelihood of information security breaches. Using a sample drawn from multiple sources in the period from 2003 to 2008, we show that an IT executive's involvement in the top management team is negatively related to the possibility of information security breaches. We also find that the amount of behavior-based (i.e., salary) compensation and the pay differences of outcome-based (i.e., bonuses, stock awards, and stock options) compensation between IT and non-IT executives are negatively associated with the likelihood of information security breaches. Our findings shed light on how an IT executive's status in the top management team and the composition of his\/her compensation can be related to a firm's IT governance mechanisms.<\/jats:p>","DOI":"10.2308\/isys-50339","type":"journal-article","created":{"date-parts":[[2012,10,19]],"date-time":"2012-10-19T15:36:12Z","timestamp":1350660972000},"page":"219-236","source":"Crossref","is-referenced-by-count":60,"title":["The Association between Top Management Involvement and Compensation and Information Security Breaches"],"prefix":"10.2308","volume":"27","author":[{"given":"Juhee","family":"Kwon","sequence":"first","affiliation":[{"name":"Dartmouth College"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jackie Rees","family":"Ulmer","sequence":"additional","affiliation":[{"name":"Purdue University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tawei","family":"Wang","sequence":"additional","affiliation":[{"name":"University of Hawaii at Manoa"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1112","published-online":{"date-parts":[[2012,10,1]]},"reference":[{"issue":"6","key":"2024082915391289200_i1558-7959-27-1-219-Aggarwal1","doi-asserted-by":"crossref","first-page":"1999","DOI":"10.1111\/0022-1082.00180","article-title":"Executive compensation, strategic competition, and relative performance evaluation: Theory and evidence","volume":"54","author":"Aggarwal","year":"1999","journal-title":"Journal of Finance"},{"key":"2024082915391289200_i1558-7959-27-1-219-Anderson1","unstructured":"Anderson, R. J. \n          \n          2001.  Why Information Security Is Hard\u2014An Economic Perspective. Proceedings of the 17th Annual Computer Security Applications Conference, Cambridge, U.K."},{"issue":"4","key":"2024082915391289200_i1558-7959-27-1-219-Archambeault1","doi-asserted-by":"crossref","first-page":"965","DOI":"10.1506\/car.25.4.1","article-title":"Audit committee incentive compensation and accounting restatements","volume":"25","author":"Archambeault","year":"2008","journal-title":"Contemporary Accounting Research"},{"issue":"1","key":"2024082915391289200_i1558-7959-27-1-219-Bloom1","doi-asserted-by":"crossref","first-page":"25","DOI":"10.2307\/256872","article-title":"The performance effects of pay dispersion on individuals and organizations","volume":"42","author":"Bloom","year":"1999","journal-title":"Academy of Management Journal"},{"key":"2024082915391289200_i1558-7959-27-1-219-Bussey1","article-title":"Has time come for more CIOs to start reporting to the top","author":"Bussey","year":"2011","journal-title":"Wall Street Journal"},{"issue":"3","key":"2024082915391289200_i1558-7959-27-1-219-Campbell1","doi-asserted-by":"crossref","first-page":"431","DOI":"10.3233\/JCS-2003-11308","article-title":"The economic cost of publicly announced information security breaches: Empirical evidence from the stock market","volume":"11","author":"Campbell","year":"2003","journal-title":"Journal of Computer Security"},{"issue":"6","key":"2024082915391289200_i1558-7959-27-1-219-Carpenter1","doi-asserted-by":"crossref","first-page":"1085","DOI":"10.2307\/3069426","article-title":"Micro-level opportunity structures as determinants of non-CEO executive pay","volume":"45","author":"Carpenter","year":"2002","journal-title":"Academy of Management Journal"},{"issue":"4","key":"2024082915391289200_i1558-7959-27-1-219-Carpenter2","doi-asserted-by":"crossref","first-page":"367","DOI":"10.1002\/smj.228","article-title":"Top management team compensation: The missing link between CEO pay and firm performance?","volume":"23","author":"Carpenter","year":"2002","journal-title":"Strategic Management Journal"},{"issue":"1","key":"2024082915391289200_i1558-7959-27-1-219-Chen1","doi-asserted-by":"crossref","first-page":"231","DOI":"10.2753\/MIS0742-1222270110","article-title":"Antecedents and effects of CIO supply-side and demand-side leadership: A staged maturity model","volume":"27","author":"Chen","year":"2010","journal-title":"Journal of Management Information Systems"},{"key":"2024082915391289200_i1558-7959-27-1-219-ComputerSecurityInstituteCSI1","unstructured":"Computer Security Institute (CSI). 2011.  CSI Computer Crime and Security Survey 2010\/2011. New York, NY: Computer Security Institute."},{"issue":"6","key":"2024082915391289200_i1558-7959-27-1-219-Demsetz1","doi-asserted-by":"crossref","first-page":"1155","DOI":"10.1086\/261354","article-title":"The structure of corporate ownership: Causes and consequences","volume":"93","author":"Demsetz","year":"1985","journal-title":"Journal of Political Economy"},{"issue":"2","key":"2024082915391289200_i1558-7959-27-1-219-Dhillon1","doi-asserted-by":"crossref","first-page":"127","DOI":"10.1046\/j.1365-2575.2001.00099.x","article-title":"Current directions in IS security research: Towards socio-organizational perspectives","volume":"11","author":"Dhillon","year":"2001","journal-title":"Information Systems Journal"},{"key":"2024082915391289200_i1558-7959-27-1-219-Dumagan1","article-title":"Industry-level effects of information technology use on productivity and inflation","author":"Dumagan","year":"2002","journal-title":"Digital Economy 2002"},{"issue":"1","key":"2024082915391289200_i1558-7959-27-1-219-Eisenhardt1","doi-asserted-by":"crossref","first-page":"57","DOI":"10.2307\/258191","article-title":"Agency theory: An assessment and review","volume":"14","author":"Eisenhardt","year":"1989","journal-title":"Academy of Management Review"},{"issue":"2","key":"2024082915391289200_i1558-7959-27-1-219-Ettredge1","doi-asserted-by":"crossref","first-page":"71","DOI":"10.2308\/jis.2003.17.2.71","article-title":"Information transfer among Internet firms: The case of hacker attacks","volume":"17","author":"Ettredge","year":"2003","journal-title":"Journal of Information Systems"},{"issue":"11","key":"2024082915391289200_i1558-7959-27-1-219-Fiss1","doi-asserted-by":"crossref","first-page":"1013","DOI":"10.1002\/smj.558","article-title":"Social influence effects and managerial compensation evidence from Germany","volume":"27","author":"Fiss","year":"2006","journal-title":"Strategic Management Journal"},{"issue":"5","key":"2024082915391289200_i1558-7959-27-1-219-Galbraith1","doi-asserted-by":"crossref","first-page":"353","DOI":"10.1002\/smj.4250120503","article-title":"The effect of compensation program and structure on SBU competitive strategy: A study of technology-intensive firms","volume":"12","author":"Galbraith","year":"1991","journal-title":"Strategic Management Journal"},{"issue":"3","key":"2024082915391289200_i1558-7959-27-1-219-Gibbons1","doi-asserted-by":"crossref","first-page":"468","DOI":"10.1086\/261826","article-title":"Optimal incentive contracts in the presence of career concerns: Theory and evidence","volume":"100","author":"Gibbons","year":"1992","journal-title":"Journal of Political Economy"},{"key":"2024082915391289200_i1558-7959-27-1-219-Greene1","unstructured":"Greene, W. H. \n          \n          2003.  Econometric Analysis. Upper Saddle River, NJ: Prentice Hall."},{"issue":"1","key":"2024082915391289200_i1558-7959-27-1-219-Hall1","doi-asserted-by":"crossref","first-page":"193","DOI":"10.1080\/07421222.2003.11045838","article-title":"Financial performance, CEO compensation, and large-scale information technology outsourcing decisions","volume":"22","author":"Hall","year":"2005","journal-title":"Journal of Management Information Systems"},{"issue":"3","key":"2024082915391289200_i1558-7959-27-1-219-Hallock1","doi-asserted-by":"crossref","first-page":"331","DOI":"10.2307\/2331203","article-title":"Reciprocally interlocking boards of directors and executive compensation","volume":"32","author":"Hallock","year":"1997","journal-title":"Journal of Financial and Quantitative Analysis"},{"issue":"2","key":"2024082915391289200_i1558-7959-27-1-219-Holthausen1","doi-asserted-by":"crossref","first-page":"279","DOI":"10.1016\/0165-4101(94)00385-I","article-title":"Business unit innovation and the structure of executive compensation","volume":"19","author":"Holthausen","year":"1995","journal-title":"Journal of Accounting and Economics"},{"key":"2024082915391289200_i1558-7959-27-1-219-ISACA1","unstructured":"ISACA. 2012a.  COBIT 5 for Information Security. Rolling Meadows, IL: ISACA."},{"key":"2024082915391289200_i1558-7959-27-1-219-ISACA2","unstructured":"ISACA. 2012b.  Securing Sensitive Personal Data or Information Using COBIT 5. Rolling Meadows, IL: ISACA."},{"key":"2024082915391289200_i1558-7959-27-1-219-ITGovernanceInstituteITGI1","unstructured":"IT Governance Institute (ITGI). 2005.  Board Briefing on IT Governance. Rolling Meadows, IL: The IT Governance Institute."},{"issue":"3","key":"2024082915391289200_i1558-7959-27-1-219-Johnson1","doi-asserted-by":"crossref","first-page":"138","DOI":"10.1016\/j.im.2010.01.002","article-title":"CEO\/CIO mutual understanding, strategic alignment, and the contribution of IS to the organization","volume":"47","author":"Johnson","year":"2010","journal-title":"Information and Management"},{"issue":"1","key":"2024082915391289200_i1558-7959-27-1-219-Kannan1","doi-asserted-by":"crossref","first-page":"69","DOI":"10.2753\/JEC1086-4415120103","article-title":"Market reactions to information security breach announcements: An empirical analysis","volume":"12","author":"Kannan","year":"2007","journal-title":"International Journal of Electronic Commerce"},{"issue":"1","key":"2024082915391289200_i1558-7959-27-1-219-Kearns1","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1111\/1540-5915.02289","article-title":"A resource-based view of strategic IT alignment: How knowledge sharing creates competitive advantage","volume":"34","author":"Kearns","year":"2003","journal-title":"Decision Sciences"},{"issue":"2","key":"2024082915391289200_i1558-7959-27-1-219-Kohli1","doi-asserted-by":"crossref","first-page":"127","DOI":"10.1287\/isre.14.2.127.16019","article-title":"Measuring information technology payoff: A meta-analysis of structural variables in firm-level empirical research","volume":"14","author":"Kohli","year":"2003","journal-title":"Information Systems Research"},{"key":"2024082915391289200_i1558-7959-27-1-219-Li1","doi-asserted-by":"crossref","first-page":"225","DOI":"10.1016\/j.accinf.2007.09.002","article-title":"Internal and external influences on IT control governance","volume":"8","author":"Li","year":"2007","journal-title":"International Journal of Accounting Information Systems"},{"key":"2024082915391289200_i1558-7959-27-1-219-Luftman1","doi-asserted-by":"crossref","DOI":"10.17705\/1CAIS.00414","article-title":"Assessing business-IT alignment maturity","author":"Luftman","year":"2000","journal-title":"Communications of the Association for Information Systems"},{"issue":"2","key":"2024082915391289200_i1558-7959-27-1-219-Luftman2","first-page":"99","article-title":"Key issues for IT executives 2007","volume":"7","author":"Luftman","year":"2008","journal-title":"MIS Quarterly Executive"},{"key":"2024082915391289200_i1558-7959-27-1-219-McFadzean1","doi-asserted-by":"crossref","first-page":"622","DOI":"10.1108\/14684520710832333","article-title":"Perception of risk and the strategic impact of existing IT on information security strategy at board level","volume":"31","author":"McFadzean","year":"2007","journal-title":"Online Information Review"},{"issue":"4","key":"2024082915391289200_i1558-7959-27-1-219-Oliver1","first-page":"53","article-title":"An empirical test of the consequences of behavior- and outcome-based sales control-systems","volume":"58","author":"Oliver","year":"1994","journal-title":"Journal of Marketing"},{"issue":"1","key":"2024082915391289200_i1558-7959-27-1-219-Pavlou1","doi-asserted-by":"crossref","first-page":"105","DOI":"10.2307\/25148783","article-title":"Understanding and mitigating uncertainty in online exchange relationships: A principal-agent perspective","volume":"31","author":"Pavlou","year":"2007","journal-title":"MIS Quarterly"},{"issue":"3","key":"2024082915391289200_i1558-7959-27-1-219-Pfeffer1","doi-asserted-by":"crossref","first-page":"382","DOI":"10.2307\/2393373","article-title":"The effect of wage dispersion on satisfaction, productivity, and working collaboratively: Evidence from college and university faculty","volume":"38","author":"Pfeffer","year":"1993","journal-title":"Administrative Science Quarterly"},{"key":"2024082915391289200_i1558-7959-27-1-219-Posthumus1","first-page":"205","article-title":"A responsibility framework for information security","volume":"193","author":"Posthumus","year":"2005","journal-title":"Security Management, Integrity, and Internal Control in Information Systems"},{"issue":"4","key":"2024082915391289200_i1558-7959-27-1-219-Preston1","doi-asserted-by":"crossref","first-page":"605","DOI":"10.1111\/j.1540-5915.2008.00206.x","article-title":"Examining the antecedents and consequences of CIO strategic decision-making authority: An empirical study","volume":"39","author":"Preston","year":"2008","journal-title":"Decision Sciences"},{"key":"2024082915391289200_i1558-7959-27-1-219-PricewaterhouseCoopersPwC1","unstructured":"PricewaterhouseCoopers (PwC). 2011.  Corporate Directors Increasing Their Focus on Executive Compensation, Risk Management and Succession Planning. New York, NY: PwC."},{"issue":"4","key":"2024082915391289200_i1558-7959-27-1-219-Santalo1","doi-asserted-by":"crossref","first-page":"1047","DOI":"10.1177\/0149206308329965","article-title":"Division director versus CEO compensation: New insights into the determinants of executive pay","volume":"35","author":"Santal\u00f3","year":"2009","journal-title":"Journal of Management"},{"key":"2024082915391289200_i1558-7959-27-1-219-Smaltz1","unstructured":"Smaltz, D. H., \n            \n              V. Sambamurthy, and R. Agarwal. \n          2004.  The Antecedents of CIO Role Effectiveness in Organizations: An Empirical Study in the Healthcare Sector. Proceedings of the Conference on Information Systems and Technology, Denver, CO."},{"issue":"18","key":"2024082915391289200_i1558-7959-27-1-219-Strassmann1","first-page":"70","article-title":"CIOs should get back to basics","volume":"40","author":"Strassmann","year":"1994","journal-title":"Datamation"},{"issue":"2","key":"2024082915391289200_i1558-7959-27-1-219-Thong1","doi-asserted-by":"crossref","first-page":"248","DOI":"10.1287\/isre.7.2.248","article-title":"Top management support, external expertise and information systems implementation in small businesses","volume":"7","author":"Thong","year":"1996","journal-title":"Information Systems Research"},{"issue":"1","key":"2024082915391289200_i1558-7959-27-1-219-Vafeas1","doi-asserted-by":"crossref","first-page":"113","DOI":"10.1016\/S0304-405X(99)00018-5","article-title":"Board meeting frequency and firm performance","volume":"53","author":"Vafeas","year":"1999","journal-title":"Journal of Financial Economics"},{"issue":"4","key":"2024082915391289200_i1558-7959-27-1-219-Vafeas2","doi-asserted-by":"crossref","first-page":"1093","DOI":"10.1506\/1QYN-2RFQ-FKYX-XP84","article-title":"Audit committees, boards, and the quality of reported earnings","volume":"22","author":"Vafeas","year":"2005","journal-title":"Contemporary Accounting Research"},{"issue":"1","key":"2024082915391289200_i1558-7959-27-1-219-Wallace1","doi-asserted-by":"crossref","first-page":"185","DOI":"10.2308\/jis.2011.25.1.185","article-title":"Information security and Sarbanes-Oxley compliance: An exploratory study","volume":"25","author":"Wallace","year":"2011","journal-title":"Journal of Information Systems"},{"key":"2024082915391289200_i1558-7959-27-1-219-Wang1","unstructured":"Wang, T., and C. Hsu. \n          2010\n          a.  The Impact of Board Structure on Information Security Breaches. Proceedings of the Pacific Asia Conference on Information Systems (PACIS), Taipei, Taiwan."},{"key":"2024082915391289200_i1558-7959-27-1-219-Wang2","unstructured":"Wang, T., and C. Hsu. \n          2010\n          b.  The Composition of Top Management Team on the Effectiveness of Information Security Management. Proceedings of the Americas Conference on Information Systems (AMCIS), Buenos Aires, Argentina."},{"key":"2024082915391289200_i1558-7959-27-1-219-Wang3","unstructured":"Wang, T., and C. Hsu. \n          2012.  Board Composition and Operational Risk Events of Financial Institutions. Working paper, University of Hawaii at Manoa and National Taiwan University."},{"key":"2024082915391289200_i1558-7959-27-1-219-Wang4","unstructured":"Wang, T., \n            \n              J. Rees, and K. Kannan. \n          2012.  The Textual Contents of Media Reports of Information Security Breaches and Profitable Short-Term Investment Opportunities. Working paper, University of Hawaii at Manoa and Purdue University."},{"key":"2024082915391289200_i1558-7959-27-1-219-Wang5","article-title":"The association between the disclosure and the realization of information security risk factors","author":"Wang","year":"2012","journal-title":"Information Systems Research"},{"issue":"2","key":"2024082915391289200_i1558-7959-27-1-219-Wilkin1","doi-asserted-by":"crossref","first-page":"107","DOI":"10.2308\/jis.2010.24.2.107","article-title":"A review of IT governance: A taxonomy to inform accounting information systems","volume":"24","author":"Wilkin","year":"2010","journal-title":"Journal of Information Systems"},{"key":"2024082915391289200_i1558-7959-27-1-219-Yayla1","doi-asserted-by":"crossref","unstructured":"Yayla, A., and Q. Hu. \n          2008. Determinants of CIO Compensation Structure and Its Impact on Firm Performance Proceedings of the 41st Hawaii International Conference on System Sciences, Big Island, Hawaii.","DOI":"10.1109\/HICSS.2008.118"}],"container-title":["Journal of Information Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/publications.aaahq.org\/jis\/article-pdf\/27\/1\/219\/12018\/isys-50339.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/publications.aaahq.org\/jis\/article-pdf\/27\/1\/219\/12018\/isys-50339.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,8,29]],"date-time":"2024-08-29T17:30:41Z","timestamp":1724952641000},"score":1,"resource":{"primary":{"URL":"https:\/\/publications.aaahq.org\/jis\/article\/27\/1\/219\/1587\/The-Association-between-Top-Management-Involvement"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2012,10,1]]},"references-count":53,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2012,10,1]]},"published-print":{"date-parts":[[2013,6,1]]}},"URL":"https:\/\/doi.org\/10.2308\/isys-50339","relation":{},"ISSN":["0888-7985","1558-7959"],"issn-type":[{"value":"0888-7985","type":"print"},{"value":"1558-7959","type":"electronic"}],"subject":[],"published":{"date-parts":[[2012,10,1]]}}}