Going Beyond Deterrence: A Middle-Range Theory of Motives and Controls for Insider Computer Abuse

Reports indicate that employees are willing to share sensitive information under certain circumstances, and one-third half of security breaches tied insiders. These statistics reveal organizational efforts, which most often rely on deterrence-based sanctions address the insider threats security, insufficient. Thus, insiders’ computer abuse (ICA)—unauthorized deliberate misuse resources by insiders—remains a significant issue for industry. We present motive–control theory ICA distinguishes among instrumental expressive motives internal external controls. Specifically, we show deterrents (e.g., sanctions) do not create ICA, but weaken existing financial benefits). Conversely, benefits psychological contract violations perform self-control diminishes influence these motives. The implications practice threefold: (1) organizations should make efforts reduce breach increasing congruence between expectations reality ICA; (2) seek maintain personnel with adequate diminish impact harmful they arise; (3) develop targeted committing control