The influence of a good relationship between the internal audit and information security functions on information security outcomes

Paul John Steinbart, Robyn L. Raschke, Graham Gal and William N. Dilla

Accounting, Organizations and Society, 2018, vol. 71, issue C, 15-29

Abstract: Given the increasing financial impact of cybercrime, it has become critical for companies to manage information security risk. The practitioner literature has long argued that the internal audit function (IAF) can play an important role both in providing assurance with respect to information security and in generating insights about how to improve the organization's information security. Nevertheless, there is scant empirical evidence to support this belief. Using a unique data set, this study examines how the quality of the relationship between the internal audit and the information security functions affects objective measures of the overall effectiveness of an organization's information security efforts. The quality of this relationship has a positive effect on the number of reported internal control weaknesses and incidents of noncompliance, as well as on the numbers of security incidents detected, both before and after they caused material harm to the organization. In addition, we find that higher levels of management support for information security and having the chief information security officer (CISO) report independently of the IT function have a positive effect on the quality of the relationship between the internal audit and information security functions.

Keywords: Information security; Internal audit; IT audit; Governance; Risk management; Security metrics (search for similar items in EconPapers)
Date: 2018
References: View references in EconPapers View complete reference list from CitEc
Citations: View citations in EconPapers (7)

Downloads: (external link)
http://www.sciencedirect.com/science/article/pii/S0361368218302113
Full text for ScienceDirect subscribers only

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:eee:aosoci:v:71:y:2018:i:c:p:15-29

DOI: 10.1016/j.aos.2018.04.005

Access Statistics for this article

Accounting, Organizations and Society is currently edited by Christopher Chapman

More articles in Accounting, Organizations and Society from Elsevier
Bibliographic data for series maintained by Catherine Liu ().