A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> Recommendations for researchers and for future work <s> Research dealing with various aspects of* the theory of planned behavior (Ajzen, 1985, 1987) is reviewed, and some unresolved issues are discussed. In broad terms, the theory is found to be well supported by empirical evidence. Intentions to perform behaviors of different kinds can be predicted with high accuracy from attitudes toward the behavior, subjective norms, and perceived behavioral control; and these intentions, together with perceptions of behavioral control, account for considerable variance in actual behavior. Attitudes, subjective norms, and perceived behavioral control are shown to be related to appropriate sets of salient behavioral, normative, and control beliefs about the behavior, but the exact nature of these relations is still uncertain. Expectancy— value formulations are found to be only partly successful in dealing with these relations. Optimal rescaling of expectancy and value measures is offered as a means of dealing with measurement limitations. Finally, inclusion of past behavior in the prediction equation is shown to provide a means of testing the theory*s sufficiency, another issue that remains unresolved. The limited available evidence concerning this question shows that the theory is predicting behavior quite well in comparison to the ceiling imposed by behavioral reliability. © 1991 Academic Press. Inc. <s> BIB001 </s> A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> Recommendations for researchers and for future work <s> The seven articles in this issue, and the accompanying meta-analysis in Health Psychology Review [McEachan, R.R.C., Conner, M., Taylor, N., & Lawton, R.J. (2011). Prospective prediction of health-related behaviors with the theory of planned behavior: A meta-analysis. Health Psychology Review, 5, 97–144], illustrate the wide application of the theory of planned behaviour [Ajzen, I. (1991). The theory of planned behavior. Organizational Behavior and Human Decision Processes, 50, 179–211] in the health domain. In this editorial, Ajzen reflects on some of the issues raised by the different authors. Among the topics addressed are the nature of intentions and the limits of predictive validity; rationality, affect and emotions; past behaviour and habit; the prototype/willingness model; and the role of such background factors as the big five personality traits and social comparison tendency. <s> BIB002
The TPB is a theory with impressive merits, and the results of this review clearly demonstrate that it is valid for the behaviours related to information security policy compliance and violation. Our opinion is that researchers should consider conducting studies focusing explicitly on the TPB to further explore and establish its efficacy for predicting and explaining information security behaviour before mixing multiple theories (and essentially creating new theories). Studies regarding the TPB can aim at establishing the relative importance of its variables, identifying its explanatory power under different circumstances and for different behaviours, and exploring extensions that are of particular relevance to inform security behaviour. To correctly appraise the relevance, accuracy, and importance of the TPB and its variables, researchers should attempt to follow the provided guidelines, caveats, and recommendations. For instance, clear guidelines concerning the design of questionnaires are provided on Azjen's website BIB001 , and the relevance of many theoretical ideas are discussed in  . These ideas may offer inspiration for research regarding the circumstances and behaviour-types that are relevant for exploration. The originators of the theory are (and have been) open to include additional variables in their theoretical framework if the proposed addition is (1) behaviour-specific,  possible to conceive as a causal factor of behaviour, (3) conceptually different from existing predictors, (4) applicable to a wide range of behaviours studied by social scientists, and (5) explains a sufficient amount of additional variance  BIB002 . Several additions have been proposed and dismissed on the basis of these requirements (see  BIB002 ). For instance, habits are not considered to fulfil (2) because past behaviour (which is used to measure habit) is not itself a causal factor  . Whereas many proposals have been dismissed on fair grounds, there may be extensions or adaptations that are especially suitable and meaningful for information security behaviours. Thus, extensions that comply with all requirements except for (4) may be relevant for the security community to explore. For instance, meaningful and promising ideas for extensions can be sought in literature regarding security economics and the human aspects of information security.