Endowment payouts have become an increasingly important component of universities' revenues in recent decades. We study how universities respond to financial shocks to endowments and thus shed light on a number of existing models of endowment behavior. Endowments actively reduce payouts relative to their stated payout policies following negative, but not positive, shocks. This asymmetric behavior is consistent with “endowment hoarding,” especially among endowments whose current value is close to the benchmark value at the start of the university president's tenure. We also document the effect of negative endowment shocks on university operations, such as personnel cuts.

We develop and test a model that investigates how controlling shareholders' expropriation incentives affect firm values during crisis and subsequent recovery periods. Consistent with the prediction of our model, we find that, during the 1997 Asian financial crisis, Asian firms with weaker corporate governance experience a larger drop in their share values but, during the post-crisis recovery period, such firms experience a larger rebound in their share values. We also find consistent evidence for Latin American firms during the 2001 Argentine economic crisis. Our results support the view that controlling shareholders' expropriation incentives imply a link between corporate governance and firm value.

We develop a model where a firm has an optimal exposure to cyber risk. With rational, fully informed agents and with no hysteresis, a successful cyberattack should have no impact on a financially unconstrained target's reputation and post-attack policies. In contrast, when a successful attack involves the loss of personal financial information, there is a significant shareholder wealth loss, which is much larger than the attack's out-of-pocket costs. This excess loss is higher when the attack decreases sales growth more and lower when the board pays more attention to risk management before the attack. Further, an attack decreases a firm's risk appetite, as it beefs up its risk management and information technology and decreases the risk-taking incentives of management. Finally, successful cyberattacks adversely affect the stock price of firms in the target's industry. These results imply that successful attacks with personal financial information loss provide adverse information about cyber risk to target firms, their stakeholders, and their competitors.