Reducing Fraud in Organizations Through Information Security Policy Compliance: An Information Security Controls Perspective

Jul 12, 2026

Upload by Ezra

Digitization increases misuse of computer resources for fraudulent activity, with trusted insiders causing substantial damage compared with external actors. The study investigates how compliance with organizations’ technology controls, focusing on information security, affects computer-based occupational fraud. Drawing on general deterrence and fraud triangle theories, it models information security control proficiency (ISCP) as the combined quality of information security policy and its enforcement. Empirical results show compliance mediates ISCP’s effect, and stronger policy compliance reduces fraud.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages17

Reading Time43 min

Introduction

Background and Motivation

Research Gap and Study Focus

Key Theoretical Lens and Objectives

Computers & Security 144 (2024) 103958 Contents lists available at ScienceDirect Computers & Security journal [homepage: www.elsevier.com/locate/cose](homepage: www.elsevier.com/locate/cose) | Reducing fraud in organizations through information security policy compliance: An information security controls perspective * Dennis Brown , Gunjan Batra , Humayun Zafar , Khawaja Saeed Kennesaw State University, Kennesaw, GA, USA | | | | | --- | --- | --- | --- | | A R T I C L E I N F O | | A B S T R A C T | | | Keywords: Information security control proficiency Information security policy quality Information security Enforcement Computer based occupational fraud Information security policy compliance | | As more business processes and information assets are digitized, computer resources are increasingly being misused to perpetrate fraudulent activities. Research shows that fraud committed by (or with) trusted insiders (called occupational fraud or internal organizational fraud) is responsible for significantly more damage than that committed by external actors (for example, cyber fraud). Current fraud research has primarily focused on the person perpetuating the fraud instead of the internal mechanisms organizations can employ in reducing fraud. The study examines the relationship between compliance with organizations’ technology controls (primarily focused on information security) and its impact on computer-based occupational fraud. Based on general deterrence and fraud triangle theories, the study proposes information security control proficiency (ISCP) modeled as an integration of the quality of information security policy and its enforcement as a key factor that influences information security policy compliance. We further postulate that compliance with information security policy mediates the relationship between information security control proficiency and computer-basedoccupational fraud. Empirical assessment supports the structure of the information security control proficiency construct. Model testing shows that information security control proficiency positively impacts information security policy compliance, which further deters the use of a company’s computer systems and resources to conduct fraudulent activities. Thus, if an organization establishes high-quality information security policies and supports the policies with effective enforcement, it correspondingly leads to better compliance. Furthermore, less fraud is committed when compliance with information security controls is high. We offer various managerial implications and future research extension ideas. | | 1. Introduction Fraud makes up 63 % of all white-collar crimes in the United States (Crimestats, 2022). Among different fraud types, occupational fraud has a higher occurrence, which, with increasing digitization, is primarily occurring as computer-based occupational fraud. This occurs when an employee, manager, or executive of the organization deceives the organization for personal gains, using its computer resources. Association of Certified Fraud Examiners (ACFE) report states that organizations lose about 5 % of their revenue to occupational fraud every year ($4.7 trillion dollars/year globally) (ACFE, 2022), nearly 50 % of which occurred due to internal control weaknesses (see Appendix 1) highlighting the importance of internal controls as a mechanism to tackle fraud. Scandals such as Enron and Worldcom resulted in the enactment of the Sarbanes Oxley Act of 2002 (SOX), which enacted requirements for internal controls for financial reporting and financial information systems in organizations to reduce the possibility of corporate misconduct and to curtail corporate insider’s ability to do fraud and financial corruption (Gorshunov et al., 2020). Proficiency in the internal audit function enables organizations to improve oversight of processes and implement internal controls to reduce fraud (Sarens, 2006; Steinbart et

FAQs

What problem does the study address?

The study addresses the rise of computer-based occupational fraud and the limited empirical evidence on how internal controls tied to security policies and enforcement reduce fraud in organizations.

How does the study define information security control proficiency (ISCP)?

ISCP is modeled as an integration of the quality of an organization’s information security policy and the effectiveness of its enforcement.

What is the relationship between ISCP, policy compliance, and occupational fraud?

Information security control proficiency increases information security policy compliance, and this compliance further helps deter fraudulent use of company computer systems and resources; compliance mediates the ISCP–fraud relationship.

Jul 12, 2026

Upload by Ezra