A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> Possible cause Analysis <s> The construct of possible selves was used to examine when, in the adult life span, health-related goals become dominant. It was predicted that by middle age most adults would have health-related possible selves and that the strength of self-regulatory variables associated with health-related possible selves would be related to reported health behaviors. Data collected from 171 young and middleaged adults showed that health-related possible selves become predominant in midlife. In addition, both young and middle-aged adults reported more feared than hoped-for selves in the realm of health. Perceived self-efficacy and number of goal-oriented activities to avoid feared health-relevant selves were significant predictors of health behaviors <s> BIB001 </s> A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> Possible cause Analysis <s> AbstractEnterprises establish computer security policies to ensure the security of information resources; however, if employees and end-users of organisational information systems (IS) are not keen or are unwilling to follow security policies, then these efforts are in vain. Our study is informed by the literature on IS adoption, protection-motivation theory, deterrence theory, and organisational behaviour, and is motivated by the fundamental premise that the adoption of information security practices and policies is affected by organisational, environmental, and behavioural factors. We develop an Integrated Protection Motivation and Deterrence model of security policy compliance under the umbrella of Taylor-Todd's Decomposed Theory of Planned Behaviour. Furthermore, we evaluate the effect of organisational commitment on employee security compliance intentions. Finally, we empirically test the theoretical model with a data set representing the survey responses of 312 employees from 78 organisations. Our r... <s> BIB002 </s> A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> Possible cause Analysis <s> Information security was the main topic in this paper. An investigation of the compliance to information security policies were discussed. The author mentions that the insignificant relationship between rewards and actual compliance with information security policies does not make sense. Quite possibly this relationship results from not applying rewards for security compliance. Also mentions that based on the survey conducted, careless employee behavior places an organization's assets and reputation in serious jeopardy. The major threat to information security arises from careless employees who fail to comply with organizations' information security policies and procedures. <s> BIB003 </s> A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> Possible cause Analysis <s> Current studies on compliance with security policies have largely ignored the impact of the perceived benefits of deviant behavior, personal norms, and organizational context. Drawing on the literature in criminology, this paper applies rational choice theory to examine how employees' intention to comply with Internet use policy is driven by cost-benefit assessments, personal norms and organizational context factors. The results indicate that employees' compliance intention is the result of competing influences of perceived benefits, formal sanctions, and security risks. Furthermore, the effect of sanction severity is found to be moderated by personal norms. <s> BIB004
In some studies, PBC has little effect on intentions. The behaviour is more volitional in the studies in which PBC has little effect  . Likely. The study investigating PBC and violation intention (which is arguably more volitional than compliance) has the lowest regression coefficient of 0.15 (the mean of the regression coefficient for compliance intention is 0.25). The correlation coefficients point in the same direction, with 0.22 for violation vs. 0.46 for compliance. In some studies, the effects of ATT and SN seem small. The theory is used for beliefs concerning an object or goal and not behaviour with an "action element"  . Likely. When the questions clearly concern behaviour (in [8-10, 14, 17, 19] ), the unweighted mean correlation coefficients (ATT=0.43 and SN=0.66) are greater than when the questions concern the goal or state "compliance" (in BIB003 BIB002  BIB004 In some studies, the SN is comparably important. Violation (i.e., risky behaviour) is modelled instead of compliance (healthy behaviour).  BIB001 Likely. SN has a stronger mean correlation in the two studies of violation (r=0.57) than in the other studies that report correlations (r=0.47). Also, the mean regression coefficient is greater for violation (β=0.35) than for compliance (β=0.30). The influence of antecedents on security policy compliance is high compared with other behaviours (e.g., health-related). Self-reports, rather than objective observations or predictions of future behaviour, are used to measure behaviour. Or/and the predicted behaviour is measured at the same occasion, not on a future occasion.  Likely. All studies used self-reports of behaviour, and all studies collected these self-reports at the same time that the other variables were assessed. Thus, relative to the average application of TPB, the importance of intention and PBC may be inflated in the present studies because of how behaviour was measured.