Do Good and Do No Harm Too: Employee-Related Corporate Social (Ir)responsibility and Information Security Performance
Qian Wang, Dan Pienta, Shenyang Jiang, Eric W.T. Ngai, Jason Bennett Thatcher · Journal of the Association for Information Systems · 2025
This study draws upon the principal-agent theory to investigate the relationship between employee-related social performance and information security. This exploration encompasses both positive and negative dimensions of such performance: employee-related socially responsible activities (employee-related CSR) and employee-related socially irresponsible activities (employee-related CSiR). We employed a multistudy approach. First, we analyzed an eight-year sample of publicly listed firms, revealing a negative association between firms’ engagement in employee-related CSR and information security risks, while their involvement in employee-related CSiR is positively linked to such risks. Our exploratory analysis uncovered additional intriguing findings, demonstrating that the uniqueness of employee-related social performance can amplify its impact on security. In a subsequent study, we conducted a scenario-based experiment to provide empirical evidence for our proposed principal-agent-based theory.