Linking Operational IT failures to IT control weaknesses

Operational IT failures have significant negative impacts on firms but little is known about their origins. Building on accounting research linking adverse operational events to SOX-disclosed control weaknesses (CWs) over financial reporting, we study the origins of IT failures in relation to IT-CWs. We use a sample of 212 operational IT failures where the confidentiality, integrity, or availability of data assets and functional IT assets (hardware, networks, etc.) has been compromised. We find that IT failures are linked to a relatively small set of IT-CWs, where each IT failure type is linked to a distinctly different subset of IT-CWs. Moreover, IT failures that are more harmful to the firm are found to be associated with IT-CWs that are more severe in the sense that they are more difficult to remediate.