Response biases in policy compliance research. (4th October 2019)

• Record Type: Journal Article
• Authors: Kurowski, Sebastian
• Is Part Of: Information and computer security. Volume 28:Number 3(2020)
• Page Start: 445
• Page End: 465
• Publication Date: 2019-10-04
• Subjects: Surveys -- Information security -- Human behaviour -- Policy compliance -- Identity theory -- Response biases; Computer security -- Management -- Periodicals; Computer networks -- Security measures -- Periodicals; Data protection -- Management -- Periodicals; 658.47
• DOI: 10.1108/ICS-02-2019-0025
• Languages: English
• ISSNs: 2056-4961

Abstract

Abstract : Purpose: The purpose of this study is to use a developed and pre-tested scenario-based measurement instrument for policy compliance and determine whether policy compliance measurements in the current policy compliance research are biased as has been postulated during a pre-study. The expected biases are because of social desirability and because of biases based on identity theory. Design/methodology/approach: A survey was conducted (n = 54) that used policy compliance scales from literature and the developed self-reporting policy compliance (SRPC) scale, along with the Marlow–Crowne social desirability (MC-SDB) scale. Differences between the policy compliance scales were assessed. Moreover, a transformation of the SRPC measurements into the literature-based scales was examined using pair-wise t-testing. Finally, correlations between the MC-SDB and the policy compliance scales were examined. Findings: There are no significant influences on the desire for social approval of the respondents as was exhibited by the MC-SDB values and policy compliance on either scale. However, the SRPC scale measurements show deviations from the literature-based policy compliance scales. Individuals that exhibit secure behaviour, which is not rooted in a policy but rather in anything but the policy, are also captured as being policy compliant in the current scales. This shows that a response bias exists in current scales. Respondents, who perceive to exhibit secure behaviours, may think that they are in compliance with the policy, even when they are not. Practical implications: These findings mean that several contributions in the field of policy compliance must be questioned and that a revisit of several factors influencing policy compliance may be required. Originality/value: To the best of the authors' knowledge, response biases in policy compliance research have not been considered to date.