It Security Auditing: A Performance Evaluation Decision Model

H.S.B. Herath, T.C. Herath / Decision Support Systems 57 (2014) 54–63

Posted: 26 Feb 2018

See all articles by Hemantha Herath

Hemantha Herath

Brock University

Tejaswini Herath

Brock University - Department of Finance, Operations and Information Systems (FOIS)

Date Written: February 14, 2018

Abstract

Compliance with ever-increasing privacy laws, accounting and banking regulations, and standards is a top priority for most organizations. Information security and systems audits for assessing the effectiveness of IT controls are important for proving compliance. Information security and systems audits, however, are not mandatory to all organizations.

Given the various costs, including opportunity costs, the problem of deciding when to undertake a security audit and the design of managerial incentives becomes an important part of an organization's control process. In view of these considerations, this paper develops an IT security performance evaluation decision model for whether or not to conduct an IT security audit. A Bayesian extension investigates the impact of new information regarding the security environment on the decision. Since security managers may act in an opportunistic manner, the model also incorporates agency costs to determine the incentive payments for managers to conduct an audit. Cases in which the agency model suggests that it is optimal not to conduct an IT security audit are also discussed.

Keywords: Auditing, Information Security, Assurance

JEL Classification: M15, M1

Suggested Citation

Herath, Hemantha and Herath, Tejaswini, It Security Auditing: A Performance Evaluation Decision Model (February 14, 2018). H.S.B. Herath, T.C. Herath / Decision Support Systems 57 (2014) 54–63, Available at SSRN: https://ssrn.com/abstract=3123862

Hemantha Herath (Contact Author)

Brock University ( email )

St. Catharines, Ontario L2S 3A1
Canada

Tejaswini Herath

Brock University - Department of Finance, Operations and Information Systems (FOIS) ( email )

Ontario, L2S 3A1
Canada

Do you have a job opening that you would like to promote on SSRN?

Paper statistics

Abstract Views
638
PlumX Metrics