A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> 4.1 <s> Information security was the main topic in this paper. An investigation of the compliance to information security policies were discussed. The author mentions that the insignificant relationship between rewards and actual compliance with information security policies does not make sense. Quite possibly this relationship results from not applying rewards for security compliance. Also mentions that based on the survey conducted, careless employee behavior places an organization's assets and reputation in serious jeopardy. The major threat to information security arises from careless employees who fail to comply with organizations' information security policies and procedures. <s> BIB001 </s> A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> 4.1 <s> This meta-analysis explored the efficacy of the Theory of Planned Behaviour (TPB) dependent on behaviour and methodological moderators. A lack of hierarchical analysis in previous reviews risks confounding these moderators. Here moderating roles of behaviour type, length of follow-up, sample age and behavioural measure are explored hierarchically amongst prospective tests of the TPB, controlling for past behaviour where possible. Searching identified 237 prospective tests from 206 articles. Random-effects meta-analytic procedures were used to correcting correlations for sampling and measurement error. Behaviour type moderated the model; physical activity and diet behaviours were better predicted (23.9% and 21.2% variance explained, respectively) whilst risk, detection, safer sex and abstinence from drugs were poorly predicted (between 13.8 and 15.3% variance explained). Methodological moderators were also apparent: age of sample moderated relations with student samples better predicted for physical activi... <s> BIB002 </s> A Review of the Theory of Planned Behaviour in the Context of Information Security Policy Compliance <s> 4.1 <s> The corporate information systems users often engage in risky behavior that can threaten the security and integrity of an organization by exposing sensitive information or weakening the existing technological perimeter security. This risky user behavior can be intentional or unintentional, but in either case can cause severe damage to an organization's reputation as well as potentially extending harm to the organization's clients and customers. Information systems users not following the corporate security policies, even though they know the policies, is known as user omissive behavior, also known as the knowing-doing gap. This research examines the information assurance understanding and security awareness at the user level by developing a structured model of the user knowing-doing gap. The model examines the role of organizational narcissism and its affect on user attitudes towards following the organization's information security policies and procedures. It also includes perceived threat as a factor affecting user attitudes towards following information security rules, as well as subjective norms and perceived behavior control consistent with the theory of planned behavior. This structured model provides a framework and description of user information security behavior and the knowing-doing gap. <s> BIB003
How well does the theory of planned behaviour explain information security policy compliance and violation? The TPB proposes that three variables (ATN, SN, and PBC) determine intentions and that intentions and PBC determine actual behaviour. Thus, it should be possible to explain the variance in intentions and actual behaviour with these variables. Table 2 includes the regression and correlation coefficients for the antecedents of intentions; Table 3 includes the antecedents of behaviour. The last three rows of Table  2 provide the unweighted and sample-weighted means for the regression coefficients and the correlation coefficients in addition to the combined sample size (N) for the studies that include the corresponding coefficient. Eight studies measured intentions and all its antecedents according to the TPB. Table  4 presents the explained variance (coefficient of determination, R 2 ) for seven of these studies. The values are calculated based on the cross-correlation matrixes reported from the studies (the correlation between predictors is missing in BIB001 ). The ability of the TPB to explain information security policy compliance and violation is perhaps best judged by considering how well the TPB explains behaviours in general (i.e., behaviours in other fields). In the meta analysis by Armitage and Conner  , which covered a total of 154 studies based on the TPB, the mean explained variance in intentions was 0.39. Rivis and Sheeran  were able to explain variance of 0.39 in data from 5,810 samples. In a recent meta-analysis of 237 prospective studies regarding health behaviours, McEachan et al. BIB002 found that the theory, on average, explained variance of 0.44. The explained variance in information security policy compliance and violation intentions suggests that the efficacy of the TPB is similar for information security intentions/behaviours and intentions/behaviours in general. The magnitude of the regression coefficients also supports this conclusion. The median regression coefficients reported in  Table 2 . Only Cox BIB003  and Siponen et al. BIB001 included both antecedents to behaviour and cross correlations and thereby enable calculation of the explained variance in behaviour. The explained variance (R 2 ) in behaviour reported in BIB003 is 0.25, and the explained variance offered by BIB001 is 0.31. These results can be compared with the result of Armitage and Conner  and McEachan et al. BIB002 (R 2 of 0.27 and 0.19). The mean values of the correlations found (I=0.85 and PBC=0.35) should be compared with those found in the broader reviews of  (I=0.47 and PBC=0.18) and BIB002 (I=0.43 and PBC=0.31). Overall, the influence of both Intentions and PBC on behaviour appears to be stronger for information security policy compliance and violation than what is reported in broader reviews.