Do Good and Do No Harm Too: Employee-Related Corporate Social (Ir)responsibility and Information Security Performance
Wang, Qian, Pienta, Dan, Jiang, Shenyang, Ngai, Eric W. T., Thatcher, Jason Bennett
Journal of the Association for Information Systems · 2025 · Volume 26 · Issue 1
Abstract
This study draws upon the principal-agent theory to investigate the relationship between employee-related social performance and information security. This exploration encompasses both positive and negative dimensions of such performance: employee-related socially responsible activities (employee-related CSR) and employee-related socially irresponsible activities (employee-related CSiR). We employed a multistudy approach. First, we analyzed an eight-year sample of publicly listed firms, revealing a negative association between firms’ engagement in employee-related CSR and information security risks, while their involvement in employee-related CSiR is positively linked to such risks. Our exploratory analysis uncovered additional intriguing findings, demonstrating that the uniqueness of employee-related social performance can amplify its impact on security. In a subsequent study, we conducted a scenario-based experiment to provide empirical evidence for our proposed principal-agent-based theory.
Keywords
Information Security, Data Breach, Employee-Related Social Performance, Employee-Related Corporate Social (Ir)responsibility, Agency Theory, Principal-Agent Framework
Enable JavaScript for citation tools and additional paper interactions.