How Much IT Investment Is Too Much? IT 투자, 얼마가 적정한가 — 비선형 관계와 IT 거버넌스
우청원 Chung-Won Woo (국립창원대학교 회계학과, 단독저자) 회계와정책연구 (Review of Accounting and Policy Studies), 31(2), 123–149, 2026 · DOI: 10.21737/RAPS.2026.05.31.2.123
TL;DR — Using 1,512 firm-years of Korean information-security-disclosing firms (2018–2024): IT investment and firm value follow an inverted U, with the turning point estimated at about 11.66% of total assets. Information security investment is generally value-positive but without a significant inverted U. Crucially, dedicated CISO and CPO roles significantly mitigate the inefficiency of over-investment.
Key findings
1. More is not always better — there is a turning point. IT investment raises firm value up to roughly 11.66% of total assets, after which the relationship reverses. A concrete benchmark for IT budget review.
2. Security spending behaves differently. Information security investment is generally positively associated with firm value, but its inverted-U pattern is not statistically significant — security spending does not show the same over-investment penalty in this sample.
3. Governance changes the return on the same money. Dedicated (not concurrent) CISO and CPO appointments both interact significantly and positively with the squared IT investment term: firms with dedicated IT governance absorb over-investment inefficiency better.
Method in one line
Multiple regression on 1,512 firm-year observations of firms filing under Korea's information security disclosure system (2018–2024), testing squared terms for IT and information security investment and interacting them with dedicated-CISO / dedicated-CPO indicators; turning point obtained from marginal effect analysis.
국문 요약
[연구목적] 한국 정보보호 공시제도 데이터를 활용해 IT 투자와 정보보안투자가 기업가치에 미치는 영향을 분석하고, IT 거버넌스의 조절효과를 실증적으로 검증한다.
[연구방법] 2018년부터 2024년까지 정보보호 공시 기업 1,512개 기업-연도 표본을 대상으로, IT 투자 및 정보보안투자와 기업가치의 비선형 관계와 IT 거버넌스의 조절효과를 검증하기 위해 다중회귀분석을 실시했다.
[연구결과] IT 투자 수준은 기업가치와 역U자형 관계를 보였으며, 한계효과분석에서 추정된 전환점은 총자산 대비 약 11.66%로 나타났다. 정보보안투자 수준은 대체로 양(+)의 관련성을 보였으나 역U자형 관계는 통계적으로 유의하지 않았다. 최고정보보안책임자 전담여부와 개인정보보호책임자 전담여부는 모두 IT 투자 제곱항과의 상호작용항에서 유의한 양(+)의 계수를 보여, 전담 IT 거버넌스 체계를 갖춘 기업일수록 IT 투자 비효율성을 완화시킨다는 것을 확인했다.
[정책적 시사점] IT 투자의 전환점 존재 가능성과 IT 거버넌스 강화의 중요성을 실증적으로 제시한다. 또한 정보보호 공시제도의 확대·고도화와 전담 IT 거버넌스 체계 구축의 필요성을 시사한다.
FAQ
Q. What should a CFO do with the 11.66% figure? Treat it as a benchmark, not a rule: track IT investment as a share of total assets and know where the firm sits relative to the estimated turning point when reviewing the IT budget.
Q. Why does a "dedicated" CISO matter more than simply having one? The interaction is with the dedicated (non-concurrent) designation. Where security leadership is a real full-time function rather than an added title, the same level of IT investment converts into firm value more efficiently.
Q. Related work by the author? See Woo & Jung (2025), which uses DEA to show that information-security-disclosing firms have higher cost efficiency and that IT investment and dedicated IT personnel improve technical efficiency.
How to cite
APA: 우청원. (2026). IT 투자 및 정보보안투자가 기업가치에 미치는 영향: 비선형 관계와 IT 거버넌스의 조절효과를 중심으로. 회계와정책연구, 31(2), 123–149. https://doi.org/10.21737/RAPS.2026.05.31.2.123
English: Woo, C.-W. (2026). The impact of IT and information security investments on firm value: Focusing on the non-linear relationship and the moderating effect of IT governance. Review of Accounting and Policy Studies, 31(2), 123–149.
BibTeX:
@article{woo2026itvalue,
title={The Impact of IT and Information Security Investments on Firm Value: Focusing on the Non-linear Relationship and the Moderating Effect of IT Governance},
author={Woo, Chung-Won},
journal={Review of Accounting and Policy Studies},
volume={31}, number={2}, pages={123--149}, year={2026},
doi={10.21737/RAPS.2026.05.31.2.123}}