Cybercrime can have a significant, direct economic impact on organizations through asset misappropriation, theft of sensitive private information, disruption of online operations, and legal costs to settle consumer claims about harm (Hong, 2016; ISACA, 2016; Minaya, 2015; PWC, 2016a, 2016b). It can also have an indirect economic effect, given that the disclosure of information security risk factors, governance policies, and information security breaches can significantly impact firm value (Gordon, Loeb, & Sohail, 2010; Higgs, Pinsker, Smith, & Young, 2016; Wang, Kannan, & Ulmer, 2013). In addition, cybercrime poses “a different focal point of concern [and] a different ‘subject’ of risk”, (Power, 2013, p. 538), because perpetrators are often unknown agents outside the organization. This is in contrast to asset theft and financial disclosure risks, where the focus is typically on the actions of identifiable individuals within the organization. Hence, it is not surprising that information security ranks as one of the top concerns for both accounting professionals (Drew, 2015; Hill, 2015) and senior management (Luftman & Ben-Zvi, 2010). Who should be responsible for managing information security risks? The obvious answer would seem to be a dedicated group within the IT function. An ISACA (2011) report, however, suggests that information security risk management is the responsibility of not just a dedicated group within the information technology (IT) function, but also should involve other functions within organizations, including the internal audit function (IAF). The problem of information security risk management therefore provides an important context for research on internal audit as a governance and risk management mechanism. Sarens (2009) argues “… the IAF can have a positive impact on the quality of risk management and internal control processes” (p. 4). Indeed, top management expects the IAF to compensate for the loss of control that comes through increased organizational complexity by both “providing independent assurance” and by “actively contributing to improving of processes and internal controls” (Sarens & De Beedle, ۲۰۰۶, p. 238). Similarly, the practice literature indicates that two of the most important responsibilities of the IAF are to provide assurance about process effectiveness and insights about how to improve performance (Seago, 2017). Despite this consensus among academics, managers, and internal audit professionals that an effective IAF should improve governance and risk management, there is little research that addresses whether the IAF actually does improve governance and risk management outcomes (Carcello, Hermanson, & Ye, 2011; Eden & Moriah, 1996; Gramling, Maletta, Schneider, & Church, 2004). Instead, prior research has tended to focus on respondents’ perceptions of the efficacy of the IAF in improving risk management processes, without reporting objective data on the outcomes from these processes (e.g., Arena, Arnaboldi, & Azzone, 2010; Carcello, Eulerich, Masli, & Wood, 2017; de Zwaan, Stewart, & Subramaniam, 2011; Ma’ayan & Carmeli, 2016; Paape & Spekle, 2013
). This study addresses the aforementioned gap in the literature. We use a unique data set obtained through the cooperation of the Information Management and Technology Assurance (IMTA) section of the AICPA that provides objective measures of leading and lagging information security outcomes. The leading measures are the number of internal control weaknesses related to information security and the number of IT-related noncompliance issues that were material enough to be brought to the attention to executive management or the Board of Directors.