Ensuring employees' IT compliance: Carrot or stick?

Information Systems Research

Volumn 24, Issue 2, 2013, Pages 279-294

  Liang, Huigang ^a   Xue, Yajiong ^a   Wu, Liansheng ^b  

^a EAST CAROLINA UNIVERSITY   (United States)

^b Peking University   (China)

Author keywords

Compliance; organizational control; Prevention focus; Promotion focus; Punishment; Regulatory focus; Reward

Indexed keywords

ENTERPRISE RESOURCE PLANNING; REGULATORY COMPLIANCE;

COMPLIANCE; ORGANIZATIONAL CONTROLS; PUNISHMENT; REGULATORY FOCUS; REWARD;

COMPLIANCE CONTROL;

EID: 84878829108     PISSN: 10477047     EISSN: 15265536     Source Type: Journal    
DOI: 10.1287/isre.1120.0427     Document Type: Article

References (99)

1. Aiken L, West S (1991) Multiple Regression: Testing and Interpreting Interactions (Sage, Newbury Park, CA).
2. Ajzen I (1991) The theory of planned behavior. Organ. Behav. Decision Processes 50(2):179-211.
3. Ajzen I, Fishbein M (1980) Understanding Attitudes and Predicting Behavior (Prentice Hall, Englewood Cliffs, NJ).
4. Andreoni J, Harbaugh W, Vesterlund L (2003) The carrot or the stick: Rewards, punishments, and cooperation. Amer. Econom. Rev. 93(3):893-902.
5. Armstrong JS, Overton T (1976) Estimating nonresponse bias in mail surveys. J. Marketing Res. 14(3):396-402.
6. Arvey RD, Ivancevich JM (1980) Punishment in organizations: A review, propositions, and research suggestions. Acad. Management Rev. 5(1):123-132.
7. Arvey RD, Davis GA, Nelson SM (1984) Use of discipline in an organization: A field study. J. Appl. Psych. 69(3):448-460.
8. Bandura A (1971) Social Learning Theory (General Learning Press, Morristown, NJ).
9. Bass B (1985) Leadership and Performance Beyond Expectations (Free Press, New York).
10. Beaudry A, Pinsonneault A (2005) Understanding user responses to information technology: A coping model of user adaptation. MIS Quart. 29(3):493-524.
11. Boss SR, Kirsch LJ, Angermeier I, Shingler RA, Boss RW (2009) If someone is watching, I'll do what I'm asked: Mandatoriness, control, and information security. Eur. J. Inform. Systems 18(2):151-164.
12. Boudreau M-C, Robey D (2005) Enacting integrated information technology: A human agency perspective. Organ. Sci. 16(1):3-18.
13. Brislin R (1980) Translation and content analysis of oral and written materials. Triandis H, Berry J, eds. Handbook of Cross-Cultural Psychology (Allyn & Bacon, Boston), 389-444.
14. Brown SA, Massey AP, Montoya-Weiss MM, Burkman JP (2002) Do I really have to? User acceptance of mandated technology. Eur. J. Inform. Systems 11(4):283-295.
15. Bulgurcu BH, Cavusoglu I, Benbasat I (2010) Information security policy compliance: An empirical study of rationalitybased beliefs and information security awareness. MIS Quart. 34(3):523-548.
16. Burns JM (1978) Leadership (Harper and Row, New York).
17. Burton-Jones A (2009) Minimizing method bias through programmatic research. MIS Quart. 33(3):445-471.
18. Burton-Jones A, Gallivan MJ (2007) Toward a deeper understanding of system usage in organizations: A multilevel perspective. MIS Quart. 31(4):657-679.
19. Cesario J, Grant H, Higgins ET (2004) Regulatory fit and persuation: Transfer from "feeling right." J. Personality Soc. Psych. 86(3):388-404.
20. Chae B, Poole MS (2005) Mandates and technology acceptance: A tale of two enterprise technologies. J. Strategic Inform. Systems 14(2):147-166.
21. Chin WW, Marcolin BL, Newsted PR (2003) A partial least squares latent variable modeling approach for measuring interaction effects: Results from a Monte Carlo simulation study and an electronic mail emotion/adoption study. Inform. Systems Res. 14(2):189-217.
22. Choudhury V, Sabherwal R (2003) Portfolios of control in outsourced software development projects. Inform. Systems Res. 14(3):291-314.
23. Cohen J (1988) Statistical Power Analysis for the Behavioral Sciences, 2nd ed. (Lawrence Erlbaum, Hillsdale, NJ).
24. Cohen J, Cohen P, West S, Aiken L (2003) Applied Multiple Regression/ Correlation Analysis for the Behavioral Sciences, 3rd ed. (Lawrence Erlbaum Associates, Hillsdale, NJ).
25. D'Arcy J, Hovav A, Galletta DF (2009) User awareness of security countermeasures and its impact on information systems misuse: A deterrence approach. Inform. Systems Res. 20(1):79-98.
26. Eisenhardt KM (1985) Control: Organizational and economic approaches. Management Sci. 31(2):134-149.
27. Eisenhardt KM (1989a) Agency theory: An assessment and review. Acad. Management Rev. 14(1):57-74.
28. Eisenhardt KM (1989b) Control: Organizational and economic approaches. Management Sci. 31(2):134-149.
29. Fishbein M, Ajzen I (1975) Belief, Attitude, Intention and Behavior: An Introduction to Theory and Research (Addison-Wesley, Reading, MA).
30. Fornell C, Bookstein FL (1982) Two structural equation models: LISREL and PLS applied to consumer exit-voice theory. J. Marketing Res. 19(4):440-452.
31. Galletta DF, Hufnagel EM (1992) A model of end-user computing policy. Inform. Management 22(1):1-18.
32. Gefen D, Rigdon EE, Straub D (2011) An update and extension to SEM guidelines for administrative and social science research. MIS Quart. 35(2):iii-xiv.
33. Gefen D, Straub D, Boudreau M-C (2000) Structural equation modeling and regression: Guidelines for research practice. Comm. Assoc. Inform. Systems 4(1):Article 7. http://aisel.aisnet.org/cais/vol4/iss1/7.
34. Green SG, Welsh MA (1988) Cybernetics and dependence: Reframing the control concept. Acad. Management Rev. 13(2):287-301.
35. Guzzo RA (1979) Types of rewards, cognitions, and work motivation. Acad. Management Rev. 4(1):75-86.
36. Hair J, Anderson R, Tatham R, Black W (1998) Multivariate Data Analysis, 5th ed. (Prentice Hall, Englewood Cliffs, NJ).
37. Herath T, Rao HR (2009) Protection motivation and deterrence: A framework for security policy compliance in organizations. Eur. J. Inform. Systems 18(2):106-125.
38. Higgins ET (1997) Beyond pleasure and pain. Amer. Psychologist 52(12):1280-1300.
39. Higgins ET (1998) Promotion and prevention: Regulatory focus as a motivational principle. Zanna MP, ed. Advances in Experimental Social Psychology (Academic Press, San Diego), 1-46.
40. Higgins ET (2000) Making a good decision: Value from fit. Amer. Psychologist 55(11):1217-1230.
41. Higgins ET (2001) Regulatory focus theory: Implications for the study of emotions at work. Organ. Behav. Human Decision Processes 86(1):35-66.
42. Higgins ET (2006) Value from hedonic experience and engagement. Psych. Rev. 113(3):439-460.
43. Higgins ET, Friedman R, Harlow RE, Chen IL, Ayduk ON, Taylor A (2001) Achievement orientations from subjective histories of success: Promotion pride versus prevention pride. Eur. J. Soc. Psych. 31:3-23.
44. Hofstede G (1978) The poverty of management control philosophy. Acad. Management Rev. 3:450-461.
45. Hofstede G (2001) Culture's Consequences, 2nd ed. (Sage, Thousand Oaks, CA).
46. Jensen MC, Meckling WH (1976) Theory of the firm: Managerial behavior, agency costs and ownership structure. J. Financial Econom. 3(4):305-360.
47. Johnson RE, Chang CD, Yang L (2010) Commitment and motivation at work: The relevance of employee identity and regulatory focus. Acad. Management Rev. 35(2):226-245.
48. Kark R, Van Dijk D (2007) Motivation to lead, motivation to follow: The role of the self-regulatory focus in leadership processes. Acad. Management Rev. 32(2):500-528.
49. Ke W, Wang X, Wei KK (2008) User motivation to explore enterprise system features: An exploratory study of its organizational antecedents and consequences. ICIS 2008 Proc., Paris, France (Assoc. Inform. Systems).
50. Kirsch LJ (1996) The management of complex tasks in organizations: Controlling the systems development process. Organ. Sci. 7(1):1-21.
51. Kirsch LJ (1997) Portfolios of control modes and IS project management. Inform. Systems Res. 8(3):215-239.
52. Kirsch LJ (2004) Deploying common systems globally: The dynamics of control. Inform. Systems Res. 15(4):374-395.
53. Kirsch LJ, Sambamurthy V, Ko D-G, Purvis RL (2002) Controlling information systems development projects: The view from the client. Management Sci. 48(4):484-498.
54. Klein HJ (1989) An integrated control theory model of work motivation. Acad. Management Rev. 14(2):150-172.
55. Kohli R, Kettinger WJ (2004) Informating the clan: Controlling physicians' costs and outcomes. MIS Quart. 28(3):363-394.
56. Komaki J (2003) Reinforcement theory at work: Enhancing and explaining what employees do. Porter LW, Steers RM, eds. Motivation and Work Behavior, 7th ed. (Irwin/McGraw-Hill, Burr Ridge, IL) 95-113.
57. Lapointe L, Rivard S (2005) A multilevel model of resistance to information technology implementation. MIS Quart. 29(3):461-491.
58. Lee AY, Aaker JL, Gardner WL (2000) The pleasures and pains of distinct self-construals: The role of interdependence in regulatory focus. J. Personality Soc. Psych. 78:1122-1134.
59. Liang H, Xue Y (2004) Coping with ERP-related contextual issues in SMEs: A vendor's perspective. J. Strategic Inform. Systems 13(4):399-415.
60. Liang H, Xue Y (2009) Avoidance of information technology threats: A theoretical perspective. MIS Quart. 33(1):71-90.
61. Liang H, Xue Y (2010) Understanding security behaviors in personal computer usage: A threat avoidance perspective. J. Assoc. Inform. Systems 11(7):394-413.
62. Liang H, Saraf N, Hu Q, Xue Y (2007) Assimilation of enterprise systems: The effect of institutional pressures and the mediating role of top management. MIS Quart. 31(1):59-87.
63. Liang H, Xue Y, Boulton WR, Byrd TA (2004) Why western vendors don't dominate China's ERP market? Comm. ACM 47(7):69-72.
64. Liang H, Xue Y, Ke W, Wei KK (2010) Understanding the influence of team climate on IT use. J. Assoc. Inform. Systems 11(8):414-432.
65. Meyer JP, Becker TE, Vandenberghe C (2004) Employee commitment and motivation: A conceptual analysis and integrative model. J. Appl. Psych. 89(6):991-1007.
66. Myyry L, Siponen M, Pahnila S, Vartiainen T, Vance A (2009) What levels of moral reasoning and values explain adherence to information security rules? An empirical study. Eur. J. Inform. Systems 18(2):126-139.
67. Neubert MJ, Kacmar KM, Carlson DS, Chonko LB (2008) Regulatory focus as a mediator of the influence of initiating structure and servant leadership on employee behavior. J. Appl. Psych. 93(6):1220-1233.
68. Niazkhani Z, Pirnejad H, van der Sijs H, Aarts J (2011) Evaluating the medication process in the context of CPOE use: The significance of working around the system. Internat. J. Medical Informatics 80(7):490-506.
69. Nunnally J (1978) Psychometric Theory, 2nd ed. (McGraw-Hill, New York).
70. O'Reilly III CA, Puffer SM (1989) The impact of rewards and punishments in a social context: A laboratory and field experiment. J. Occupational Psych. 62(1):41-53.
71. Orlikowski WJ, Scott SV (2008) Sociomateriality: Challenging the seperation of technology, work, and organization. Acad. Management Ann. 2(1):433-474.
72. Ouchi WG (1979) A conceptual framework for the design of organizational control mechanisms. Management Sci. 25(9):833-848.
73. Pahnila S, Siponen M, Mahmood A (2007) Employees' behavior towards IS security policy compliance. Proc. 40th Annual Hawaii Internat. Conf. System Sci. Waikoloa, Big Island, Hawaii, (IEEE Comput. Soc., Washington, D.C.).
74. Podsakoff PM, Organ DW (1986) Self-reports in organizational research: Problems and prospects. J. Management 12(4):531-544.
75. Podsakoff PM, Bommer WH, Podsakoff NP, MacKenzie SB (2006) Relationships between leader reward and punishment behavior and subordinate attitudes, perceptions, and behaviors: A meta-analytic review of existing and new research. Organ. Behav. Human Decision Processes 99(2):113-142.
76. Podsakoff PM, MacKenzie SB, Lee JY, Podsakoff NP (2003) Common method biases in behavioral research: A critical review of the literature and recommended remedies. J. Appl. Psych. 88(5):879-903.
77. Podsakoff PM, Todor WD, Grover RA, Huber VL (1984) Situational moderators of leader reward and punishment behavior: Fact or fiction? Organ. Behav. Human Performance 34(1):21-63.
78. Ringle CM, Wende S, Will A (2005) SmartPLS, 2.0 (beta), Hamburg, Germany, http://smartpls.de.
79. Shah J, Higgins ET, Friedman R (1998) Performance incentives and means: How regulatory focus influences goal attainment. J. Personality Soc. Psych. 74(2):285-293.
80. Sheeran P (2002) Intention-behavior relations: A conceptual and empirical review. Eur. Rev. Soc. Psych. 12(1):1-36.
81. Sia SK, Neo BS (1997) Reengineering effectiveness and the redesign of organizational control: A case study of the inland revenue authority in Singapore. J. Management Inform. Systems 14(1):69-92.
82. Sia SK, Tang M, Soh C, Boh WF (2002) Enterprise resource planning (ERP) systems as a technology of power: Empowerment or panoptic control? Database Adv. Inform. Systems 33(1):23-37.
83. Siemsen E, Roth A, Oliveira P (2010) Common method bias in regression models with linear, quadratic, and interaction effects. Organ. Res. Methods 13(3):456-476.
84. Sims HP (1980) Further thoughts on punishment in organizations. Acad. Management Rev. 5(1):133-138.
85. Skinner BF (1953) Science and Human Behavior (Macmillan, New York).
86. Steers RM, Mowday RT, Shapiro DL (2004) The future of work motivation theory. Acad. Management Rev. 29(3):379-387.
87. Thorndike EL (1911) Animal Intelligence (Macmillan, New York).
88. Trevino LK (1992) The social effects of punishment in organizations: A justice perspective. Acad. Management Rev. 17(4):647-676.
89. Tyler TR, Blader SL (2005) Can businesses effectively regulate employee conduct? The antecedents of rule following in work settings. Acad. Management J. 48(6):1143-1158.
90. Venkatesh V (2000) Determinants of perceived ease of use: Integrating control, intrinsic motivation, and emotion into the technology acceptance model. Inform. Systems Res. 11(4):342-365.
91. Venkatesh V, Brown SA, Maruping LM, Bala H (2008) Predicting different conceptualizations of system use: The competing roles of behavioral intention, facilitating conditions, and behavioral expectation. MIS Quart. 32(3):483-502.
92. Venkatesh V, Morris MG, Davis GB, Davis FD (2003) User acceptance of information technology: Toward a unified view. MIS Quart. 27(3):425-478.
93. Vroom VH (1964) Work and Motivation (Wiley, New York).
94. Wold H (1985) Systems analysis by partial least squares. Nijkamp P, Leitner H, Wrigley N, eds. Measuring the Unmeasurable (Martinus Nijhoff, Dordrecht, The Netherlands), 221-251.
95. Xue Y, Liang H, Wu L (2011) Punishment, justice, and compliance with mandatory IT usage. Inform. Systems Res. 22(2):400-414.
96. Xue Y, Liang H, Boulton W, Snyder C (2005) ERP implementation failures in China: Case studies with implications for ERP vendors. Internat. J. Production Econom. 97(3):279-295.
97. Zhang Y, Mittal V (2007) The attractiveness of enriched and impoverished options: Culture, self-construal, and regulatory focus. Personality Soc. Psych. Bulletin 33(4):588-598.
98. Zimring FE, Hawkins G (1973) Deterrence (University of Chicago Press, Chicago).
99. Zuboff S (1988) In the Age of the Smart Machine: The Future of Work and Power (Basic Books, New York).