A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> Issues when interpreting the puzzle left by mixed models and adaptations <s> Information security was the main topic in this paper. An investigation of the compliance to information security policies were discussed. The author mentions that the insignificant relationship between rewards and actual compliance with information security policies does not make sense. Quite possibly this relationship results from not applying rewards for security compliance. Also mentions that based on the survey conducted, careless employee behavior places an organization's assets and reputation in serious jeopardy. The major threat to information security arises from careless employees who fail to comply with organizations' information security policies and procedures. <s> BIB001 </s> A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> Issues when interpreting the puzzle left by mixed models and adaptations <s> The corporate information systems users often engage in risky behavior that can threaten the security and integrity of an organization by exposing sensitive information or weakening the existing technological perimeter security. This risky user behavior can be intentional or unintentional, but in either case can cause severe damage to an organization's reputation as well as potentially extending harm to the organization's clients and customers. Information systems users not following the corporate security policies, even though they know the policies, is known as user omissive behavior, also known as the knowing-doing gap. This research examines the information assurance understanding and security awareness at the user level by developing a structured model of the user knowing-doing gap. The model examines the role of organizational narcissism and its affect on user attitudes towards following the organization's information security policies and procedures. It also includes perceived threat as a factor affecting user attitudes towards following information security rules, as well as subjective norms and perceived behavior control consistent with the theory of planned behavior. This structured model provides a framework and description of user information security behavior and the knowing-doing gap. <s> BIB002
It is fair to say that the TPB has not been the focus of quantitative studies on information security policy compliance and violation despite its immense popularity in the behaviour sciences. This review was only able to identify 15 quantitative surveys that investigated one or more variables included in the TPB. Two studies (namely BIB002  and BIB001 ) included all the TPB variables, and other (potentially correlated) variables are included in most of the tested regression models. Furthermore, many of the studies did not follow the guidelines, caveats, and recommendations regarding how the TPB should be applied and tested (e.g., concerning the measurement instruments), most likely because the TPB was not the focus of these studies. Fishbein and Ajzen  find that "[e]ven though virtually hundreds of studies have tested variations of our theory, we were able to find only relatively few that contained all the elements required for a complete and valid test". Our conclusion is that this also applies to the studies that apply the TPB to information security policy compliance and violation. In our view, no study followed all the guidelines completely. The implication of these two factors (incomplete models and incompliance with guidelines) is that the results should be interpreted cautiously. When other variables are mixed with the TPB variables, the regression coefficients can be influenced. When departures are made from established guidelines, caveats, and recommendations, it should be expected that this theory's efficacy will be influenced. In Table 5 , some other possible explanations for differences in the results were explored, but no crystal clear explanations could be found. A larger sample of studies regarding the TPB and differences related to individuals' security behaviours (e.g., sampling differences) may explain the divergent results better.