Location
Level 0, Open Space, Owen G. Glenn Building
Start Date
12-15-2014
Description
In this in-progress study we explore whether aspects of a prior data security breach, along with prior audit performance, work to decrease auditor objectivity of information security (InfoSec) weaknesses in the subsequent audit period. We use SOX Section 404 as the contextual setting and our analysis is based on a unique dataset from publicly available sources. Preliminary results suggest that not only does former audit performance influence auditor judgments of InfoSec performance, but also the strength of this relationship changes based on public attention. We found no evidence for the influence of past breach severity on auditors’ judgments nor did we find that the influence of public attention is direct. Instead, it appears that auditors can be lured toward decreased objectivity in an indirect manner, based on the weight of public attention that increases their desire to validate past audit evaluations. Implications and plans for future research are discussed.
Recommended Citation
Basoglu, Asli and D'Arcy, John, "‘Breaching’ Auditor Judgments of Information Security Effectiveness" (2014). ICIS 2014 Proceedings. 29.
https://aisel.aisnet.org/icis2014/proceedings/ISSecurity/29
‘Breaching’ Auditor Judgments of Information Security Effectiveness
Level 0, Open Space, Owen G. Glenn Building
In this in-progress study we explore whether aspects of a prior data security breach, along with prior audit performance, work to decrease auditor objectivity of information security (InfoSec) weaknesses in the subsequent audit period. We use SOX Section 404 as the contextual setting and our analysis is based on a unique dataset from publicly available sources. Preliminary results suggest that not only does former audit performance influence auditor judgments of InfoSec performance, but also the strength of this relationship changes based on public attention. We found no evidence for the influence of past breach severity on auditors’ judgments nor did we find that the influence of public attention is direct. Instead, it appears that auditors can be lured toward decreased objectivity in an indirect manner, based on the weight of public attention that increases their desire to validate past audit evaluations. Implications and plans for future research are discussed.