Donna K. Cooke

Managing Employee Compliance with Information Security Policies: The Critical Role of Top Management and Organizational Culture*

We develop an individual behavioral model that integrates the role of top management and organizational culture into the theory of planned behavior in an attempt to better understand how top management can influence security compliance behavior of employees. Using survey data and structural equation modeling, we test hypotheses on the relationships among top management participation, organizational culture, and key determinants of employee compliance with information security policies. We find that top management participation in information security initiatives has significant direct and indirect influences on employees’ attitudes towards, subjective norm of, and perceived behavioral control over compliance with information security policies. We also find that the top management participation strongly influences organizational culture which in turn impacts employees’ attitudes towards and perceived behavioral control over compliance with information security policies. Furthermore, we find that the effects of top management participation and organizational culture on employee behavioral intentions are fully mediated by employee cognitive beliefs about compliance with information security policies. Our findings extend information security research literature by showing how top management can play a proactive role in shaping employee compliance behavior in addition to the deterrence oriented remedies advocated in the extant literature. Our findings also refine the theories about the role of organizational culture in shaping employee compliance behavior. Significant theoretical and practical implications of these findings are discussed.

The role of external and internal influences on information systems security - a neo-institutional perspective

This research is an attempt to better understand how external and internal organizational influences shape organizational actions for improving information systems security. A case study of a multi-national company is presented and then analyzed from the perspective of neo-institutional theory. The analysis indicates that coercive, normative, and mimetic isomorphic processes were evident, although it was difficult to distinguish normative from mimetic influences. Two internal forces related to work practices were identified representing resistance to initiatives to improve security: the institutionalization of work mobility and the institutionalization of efficiency outcomes expected with the adoption of company initiatives, especially those involving information technology. The interweaving of top-down and bottom-up influences resulted in an effort to reinforce, and perhaps reinstitutionalize the systems component of information security. The success of this effort appeared to hinge on top management championing information system security initiatives and propagating an awareness of the importance of information security among employees at all levels of the company. The case shows that while regulatory forces, such as the Sarbanes-Oxley Act, are powerful drivers for change, other institutional influences play significant roles in shaping the synthesis of organizational change.

The relationship between graduate student attitudes and attrition

Abstract Although much is known about undergraduate student attrition in the United States, very little is known about graduate student attrition. In this study, researchers sought to identify a set of personal variables to predict graduate student attrition, emphasizing variables that universities can influence. The results indicated that in this sample, graduate student attitudes and intentions were significant factors in attrition: Intent to remain, affective commitment, met expectations, and need for achievement were important predictors of attrition 18 months later.

Validity of an Honesty Test in Predicting Theft Among Convenience Store Employees

A 1990 review of the research on the validity of integrity-honesty tests performed by the U.S. Congresss Office of Technology Assessment found no studies conducted by independent researchers in wh...

The Role of External Influences on Organizational Information Security Practices: An Institutional Perspective

This paper describes the initial findings of a case study intended to identify important organizational catalysts and impediments to implementing and using security technologies and security policies. The study focuses on how institutional forces shaped and motivated managers and employees at different levels in different ways. We found that low priority of security technology investments and internal policy development to top management is likely the main reason for organizational inertia that leads to insecurity. Two types of institutional forces seem to be the most effective mechanisms for breaking the inertia: coercive forces exerted by regulatory agencies and the normative forces exerted through the influences of professionalism and professional networks. The case shows that with respect to security technologies and policies, regulatory forces, such as the Sarbanes-Oxley Act, are much more powerful drivers for change within the organization as compared to normative influence which disproportionately affects IT personnel rather than top level executives.

Measuring career stage

Abstract Age and tenure are inadequate measures of career stage. The use of arbitrary age and tenure groupings as indicators of career stage is theoretically unsound and could lead researchers and career counselors to make erroneous conclusions. It has not yet been shown empirically that classifications based on the age or tenure yield groups of individuals with anything in common other than their age and tenure. The purposes of this article are to point out the weaknesses of the psychometric properties of age and tenure as career stage measures (i.e., generalizability, validity, and reliability) and to propose an alternative way of measuring career stage. The article concludes with suggestions for future research in this area.

Discriminant Validity of the Organizational Commitment Questionnaire

The 15-item Organizational Commitment Questionnaires discriminant validity vis-à-vis a measure of withdrawal cognitions was estimated using LISREL. The data were provided by a sample of 176 air traffic controllers. The results of the analyses indicated that, although the Organizational Commitment Questionnaires discriminant validity problems are not considerable, some of its items should be eliminated. Examination of the factor structure is encouraged.

The Factor Structure and Predictive Validity of Burbach'S University Alienation Scale:

The purpose of the study was to assess the dimensionality, discriminant, and predictive validities of a 15-item version of Burbachs University Alienation Scale. A total of 228 graduate students completed a questionnaire containing measures of alienation, commitment, locus of control, perceived likelihood of leaving, and withdrawal cognitions. Based on the partial identification numbers that they furnished voluntarily, follow-up data were obtained on the status of 121 respondents 12 months later. The findings confirmed the three-factor structure of the Burbach Alienation Scale but indicated that two of its items should be deleted. Based on confirmatory factor analytic results and correlations with locus of control, alienation and affective commitment appear to be distinct constructs. Although alienation failed to correlate with graduate student attrition after 12 months (p > .05), commitment, perceived likelihood of leaving, and withdrawal cognitions did (r = -.36, .52, and .24, respectively, p < .005, one-tailed). Contrary to the popular assumption, minority graduate students at this predominantly White university did not report higher levels of alienation (p > .05).

EFFECTS OF PURPOSE OF APPRAISAL ON DISCRIMINABILITY AND ACCURACY OF RATINGS

Here we evaluate, replicate, and extend 1982 research by Zedeck and Cascio on the relationship between purpose and characteristics of rating. We propose and test an alternative explanation for the Zedeck and Cascio conclusion that discriminability in ratings is affected by their purpose. Results provide partial support for both explanations. Using a measure of rating accuracy as the criterion, no significant effect of purpose is obtained.

The Role of Public Service Motivation in Employee Work Engagement: A Test of the Job Demands-Resources Model

ABSTRACT The study investigates the nature of public service motivation’s (PSM) relationship to employee work engagement. Using the Job Demands-Resource Model, the authors compare whether PSM as a resource is an antecedent to employee work engagement or has a buffering effect on job hindrances of perceived red tape in explaining employee work engagement. They surveyed 388 supervisors and managers in a public-sector organization in the United States. The findings support PSM as an antecedent along with perceived job influence and perceived procurement red tape to employee work engagement.