A Theoretical Basis for Defining Internal Control Objectives for Information Systems Security

In the literature it has been argued that individual values play an important role in creation and implementation of internal controls for information systems security. However majority of approaches that help in designing internal control overlook the importance of individual values. In this paper we argue that individual values should form the basis for defining internal control objectives. We propose Value Theory (Catton 1952) as an appropriate basis for conducting the argument. The theory helps in identifying the objectives, which are the guiding principles for design of internal controls. By adopting such a theoretical basis, it will be possible to develop internal controls that are congruent with the organizational objectives.