Information Security Professionals’ Perceptions about the Relationship between the Information Security and Internal Audit Functions

• In Event: Control, Audit and Information Systems Security

Abstract

Internal auditors and information security professionals both play important roles in protecting an organization’s assets. The relationship between the two functions, however, is not always supportive. This paper presents the results of a survey of information security professionals’ perceptions about the nature of the relationship between the information security and internal audit functions in their organization. We find that information security professionals’ perceptions about the level of technical expertise possessed by internal auditors, the extent of internal audit review of information security, and top management support are positively related to their assessment about the quality of the relationship between the two functions. We also find that the quality of the relationship between the internal audit and information security functions is positively associated with perceptions about the value provided by internal audit and with measures of overall effectiveness of the organization’s information security endeavors. We discuss the implications of our findings for both research and practice.

Authors

• Paul J Steinbart, Arizona State University

• Robyn L Raschke, University of Nevada, Las Vegas

• Graham Gal, University of Massachusetts

• William N Dilla, Iowa State University