A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> Data extraction and synthesis of results <s> In Causes of Delinquency, Hirschi attempts to state and test a theory of delinquency, seeing in the delinquent a person relatively free of the intimate attachments, the aspirations, and the moral beliefs that bind most people to a life within the law. In prominent alternative theories, the delinquent appears either as a frustrated striver forced into delinquency by his acceptance of the goals common to us all, or as an innocent foreigner attempting to obey the rules of a society that is not in position to make the law or define conduct as good or evil. Hirschi analyzes a large body of data on delinquency collected in Western Contra Costa County, California, contrasting throughout the assumptions of the strain, control, and cultural deviance theories. He outlines the assumptions of these theories and discusses the logical and empirical difficulties attributed to each of them. Then draws from sources an outline of social control theory, the theory that informs the subsequent analysis and which is advocated here. Often listed as a "Citation Classic," Causes of Delinquency retains its force and cogency with age. It is an important volume and a necessary addition to the libraries of sociologists, criminologists, scholars and students in the area of delinquency. <s> BIB001 </s> A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> Data extraction and synthesis of results <s> The literature agrees that the major threat to IS security is constituted by careless employees who do not comply with organizations' IS security policies and procedures. To address this concern, different approaches for ensuring employees' IS security policy compliance have been proposed. Prior research on IS security compliance has criticized these extant IS security awareness approaches as lacking theoretically and empirically grounded principles to ensure that employees comply with IS security policies. To fill this gap, this study proposes a theoretical model that contains the factors that explain employees' IS security policy compliance. Data (N=245) from a Finnish company provides empirical support for the model. The results suggest that information quality has a significant effect on actual IS security policy compliance. Employees' attitude, normative beliefs and habits have significant effect on intention to comply with IS security policy. Threat appraisal and facilitating conditions have significant impact on attitude towards complying, while coping appraisal does not have a significant effect on employees' attitude towards complying. Sanctions have insignificant effect on intention to comply with IS security policy and awards do not have a significant effect on actual compliance with IS security policy <s> BIB002 </s> A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> Data extraction and synthesis of results <s> Research on methods of meta-analysis (the synthesis of related study results) has dealt with many simple study indices, but less attention has been paid to the issue of summarizing regression slopes. In part this is because of the many complications that arise when real sets of regression models are accumulated. We outline the complexities involved in synthesizing slopes, describe existing methods of analysis and present a multivariate generalized least squares approach to the synthesis of regression slopes. <s> BIB003 </s> A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> Data extraction and synthesis of results <s> AbstractEnterprises establish computer security policies to ensure the security of information resources; however, if employees and end-users of organisational information systems (IS) are not keen or are unwilling to follow security policies, then these efforts are in vain. Our study is informed by the literature on IS adoption, protection-motivation theory, deterrence theory, and organisational behaviour, and is motivated by the fundamental premise that the adoption of information security practices and policies is affected by organisational, environmental, and behavioural factors. We develop an Integrated Protection Motivation and Deterrence model of security policy compliance under the umbrella of Taylor-Todd's Decomposed Theory of Planned Behaviour. Furthermore, we evaluate the effect of organisational commitment on employee security compliance intentions. Finally, we empirically test the theoretical model with a data set representing the survey responses of 312 employees from 78 organisations. Our r... <s> BIB004 </s> A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> Data extraction and synthesis of results <s> Information security was the main topic in this paper. An investigation of the compliance to information security policies were discussed. The author mentions that the insignificant relationship between rewards and actual compliance with information security policies does not make sense. Quite possibly this relationship results from not applying rewards for security compliance. Also mentions that based on the survey conducted, careless employee behavior places an organization's assets and reputation in serious jeopardy. The major threat to information security arises from careless employees who fail to comply with organizations' information security policies and procedures. <s> BIB005
Only one of the identified studies covered all the relationships described by the TPB, and only eight studies included all the antecedents of intentions. The models used in 16 studies are thus incomplete with respect to the TPB. The aim is to synthesise the results of the studies to answer the two research questions based on approximations of the overall effectiveness of the TPB. It should be noted that although the variable descriptive norm is currently included in SN of the TPB  , it is treated as an external variable in our analysis to allow straightforward synthesis and comparison among the studies (only one study, BIB004 , includes the variable descriptive norm). Variables used as dependent and independent variables must share similar definitions and measurements scales for a synthesised result to be meaningful. The authors reviewed the measurement scales used in the different studies to assess their similarity. For the 16 studies, the scales are judged sufficiently similar to motivate a synthesis, although differences do exist. The possible influence of differences in definitions on measurement scales are addressed as part of the answer to research question 2, whether reasonable explanations for divergent results can be determined. A common and practical effect size to use when results of multiple studies are synthesised is the Pearson correlation between variables. If correlation coefficients were missing in the papers, the authors were contacted and the coefficients or the raw data of the study were requested. Seppo Pahnila kindly provided us with additional data from BIB005 and explained the dependencies between the studies reported in BIB002 and BIB005 . Unfortunately, none of the other authors contacted were able to complement their results with correlation coefficients because they did not retain the data. To offer a more complete review and be able to include all results obtained, the regression coefficients were also synthesised. All studies used linear regression models to test the modelled relationships and, consequently, reported the regression coefficients. However, using simple mean values for regression coefficients is only meaningful if the regression models they come from are sufficiently similar to avoid the bias due to multicollinearity, i.e., if two correlated variables are included as predictors in a regression model, their regression coefficients will be different than if each of them were included in separate models. Many of the regression models included additional variables and relationships that are not included in the TPB, and many lacked variables of the TPB. For instance, the model used by Herath and Rao BIB004 includes variables drawn from deterrence theory  and social control theory BIB001 . Thus, there is an apparent risk of bias due to differences in the regression models. The importance of differences between regression models is, however, unclear BIB003 . The use of mean values is considered reasonable for models with low numbers of variables and relationships, such as those included in this review BIB003 . Consequently, although the mean values of regression coefficients are less reliable than the mean values of the correlation coefficients, they are meaningful indicators of the strength of the relationships and serve as a complement to the correlation coefficients. The regression coefficients and correlation coefficients were aggregated as unweighted mean values and mean values weighted by sample size. The correlation coefficients were rescaled via the Fisher transformation before the mean values were calculated. No dramatic differences existed between these aggregates (cf. Table 2 , Table 3 , and Table 4 ). We will therefore only address the unweighted means in the discussions. A potential issue in systematic reviews is the publication bias, i.e., the general tendency to publish significant and positive results more often than insignificant or negative results. A Funnel plot was created over the studies sample size and correlation coefficients. The studies did not appear to be biased because large samples (i.e., those with small variance) are close to the average correlation coefficients and studies with small samples (i.e., those with large variance) have more varied results.