{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,27]],"date-time":"2026-06-27T01:48:46Z","timestamp":1782524926224,"version":"3.54.5"},"reference-count":50,"publisher":"American Accounting Association","issue":"1","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2023,3,1]]},"abstract":"<jats:title>ABSTRACT<\/jats:title>\n               <jats:p>With the growing role of information technology (IT), many organizations have incorporated IT governance practices that include keeping executives apprised of IT risks. To perform this function, organizations rely upon their internal audit staff to obtain an independent evaluation of IT risks. Although both general and IT auditors are involved in assessing IT risks, they may not be equally adept at identifying such risks. We draw on the expert versus nonexpert perspective to understand how general and IT auditors perceive IT risks differently. Through a quasi experiment with 70 internal auditors of a financial institution, we found that general auditors perceived IT risks to be lower than their IT audit colleagues. We also found that personal IT risk preferences influenced the level of IT risks that general auditors perceived. Personal IT risk preferences did not affect the risk perceptions of IT auditors. Implications for both research and practice are discussed.<\/jats:p>","DOI":"10.2308\/isys-2020-040","type":"journal-article","created":{"date-parts":[[2022,11,22]],"date-time":"2022-11-22T21:32:49Z","timestamp":1669152769000},"page":"67-83","source":"Crossref","is-referenced-by-count":3,"title":["Internal Auditors\u2019 Perceptions of Information Technology-Related Risks: A Comparison Between General Auditors and Information Technology Auditors"],"prefix":"10.2308","volume":"37","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6701-8040","authenticated-orcid":false,"given":"Arno L. P.","family":"Nuijten","sequence":"first","affiliation":[{"name":"Erasmus University Rotterdam"},{"name":"The Open University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mark","family":"Keil","sequence":"additional","affiliation":[{"name":"Georgia State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6845-5445","authenticated-orcid":false,"given":"Bert","family":"Zwiers","sequence":"additional","affiliation":[{"name":"Erasmus University Rotterdam"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1112","published-online":{"date-parts":[[2023,4,4]]},"reference":[{"key":"2024082918035157900_B1","volume-title":"Multiple Regression: Testing and Interpreting Interactions","author":"Aiken","year":"1991"},{"issue":"2","key":"2024082918035157900_B2","doi-asserted-by":"crossref","first-page":"203","DOI":"10.1080\/07421222.1993.11518006","article-title":"Toward an assessment of software development risk","volume":"10","author":"Barki","year":"1993","journal-title":"Journal of Management Information Systems"},{"issue":"1","key":"2024082918035157900_B3","doi-asserted-by":"crossref","first-page":"138","DOI":"10.1016\/j.im.2013.11.004","article-title":"Incident-centered information security: Managing a strategic balance between prevention and response","volume":"51","author":"Baskerville","year":"2014","journal-title":"Information & Management"},{"issue":"1","key":"2024082918035157900_B4","doi-asserted-by":"crossref","first-page":"198","DOI":"10.1111\/j.1911-3846.1991.tb00842.x","article-title":"Expertise and its relation to audit decision quality","volume":"8","author":"B\u00e9dard","year":"1991","journal-title":"Contemporary Accounting Research"},{"issue":"2","key":"2024082918035157900_B5","doi-asserted-by":"crossref","first-page":"147","DOI":"10.1111\/j.1099-1123.2005.00267.x","article-title":"Information systems risk and audit planning","volume":"9","author":"Bedard","year":"2005","journal-title":"International Journal of Auditing"},{"issue":"2","key":"2024082918035157900_B6","first-page":"1","article-title":"A descriptive analysis of computer audit specialists' decision-making behavior in advanced computer environments","volume":"6","author":"Biggs","year":"1987","journal-title":"Auditing: A Journal of Practice & Theory"},{"key":"2024082918035157900_B7","volume-title":"Business Research Methods","author":"Blumberg","year":"2008"},{"issue":"4","key":"2024082918035157900_B8","doi-asserted-by":"crossref","first-page":"1059","DOI":"10.1506\/car.24.4.1","article-title":"An examination of auditor planning judgements in a complex accounting information system environment","volume":"24","author":"Brazel","year":"2007","journal-title":"Contemporary Accounting Research"},{"issue":"2","key":"2024082918035157900_B9","doi-asserted-by":"crossref","first-page":"83","DOI":"10.2308\/aud.2000.19.2.83","article-title":"An investigation of multidimensional knowledge structure and computer auditor performance","volume":"19","author":"Curtis","year":"2000","journal-title":"Auditing: A Journal of Practice & Theory"},{"issue":"1","key":"2024082918035157900_B10","doi-asserted-by":"crossref","first-page":"79","DOI":"10.2308\/jis.2009.23.1.79","article-title":"Auditors\u2019 training and proficiency in information systems: A research synthesis","volume":"23","author":"Curtis","year":"2009","journal-title":"Journal of Information Systems"},{"key":"2024082918035157900_B12","doi-asserted-by":"crossref","DOI":"10.1007\/978-3-319-14547-1","volume-title":"Enterprise Governance of Information Technology: Achieving Alignment and Value, Featuring COBIT 5","author":"De Haes","year":"2015"},{"issue":"1","key":"2024082918035157900_B11","doi-asserted-by":"crossref","first-page":"307","DOI":"10.2308\/isys-50422","article-title":"COBIT 5 and enterprise governance of information technology: Building blocks and research opportunities","volume":"27","author":"De Haes","year":"2013","journal-title":"Journal of Information Systems"},{"issue":"4","key":"2024082918035157900_B13","doi-asserted-by":"crossref","first-page":"225","DOI":"10.1016\/S0022-4375(99)00018-3","article-title":"Hazard and Risk perception among young novice drivers","volume":"30","author":"Deery","year":"1999","journal-title":"Journal of Safety Research"},{"issue":"1","key":"2024082918035157900_B14","doi-asserted-by":"crossref","first-page":"269","DOI":"10.1016\/j.dss.2006.10.002","article-title":"Attention-shaping tools, expertise, and perceived control in IT project risk assessment","volume":"43","author":"Du","year":"2007","journal-title":"Decision Support Systems"},{"issue":"2","key":"2024082918035157900_B15","doi-asserted-by":"crossref","first-page":"151","DOI":"10.2307\/249356","article-title":"A comparison of judgement, skills, and prompting effects between auditors and systems analysts","volume":"11","author":"Grabski","year":"1987","journal-title":"MIS Quarterly"},{"issue":"1","key":"2024082918035157900_B16","doi-asserted-by":"crossref","first-page":"35","DOI":"10.1080\/13669870010029639","article-title":"The role of expertise in risk communication: Laypeople\u2019s and expert\u2019s perception of the millennium bug risk in The Netherlands","volume":"5","author":"Gutteling","year":"2002","journal-title":"Journal of Risk Research"},{"key":"2024082918035157900_B17","volume-title":"Multivariate Data Analysis","author":"Hair","year":"1998"},{"issue":"9","key":"2024082918035157900_B18","doi-asserted-by":"crossref","first-page":"1781","DOI":"10.1111\/risa.12992","article-title":"The value of performance weights and discussion in aggregated expert judgments","volume":"38","author":"Hanea","year":"2018","journal-title":"Risk Analysis"},{"key":"2024082918035157900_B20","volume-title":"Control Objectives for Information and Related Technology: COBIT","author":"Information Systems Audit and Control Foundation (ISACF)","year":"1994"},{"key":"2024082918035157900_B19","volume-title":"International Professional Practices Framework. Supplemental Guidance","author":"Institute of Internal Auditors (IIA)","year":"2019"},{"issue":"6","key":"2024082918035157900_B21","doi-asserted-by":"crossref","first-page":"1141","DOI":"10.1037\/0022-3514.50.6.1141","article-title":"Group polarization: A critical review and meta-analysis","volume":"50","author":"Isenberg","year":"1986","journal-title":"Journal of Personality and Social Psychology"},{"key":"2024082918035157900_B22","volume-title":"CobiT 4.1 - Control Objectives of Information and Related Technology","author":"IT Governance Institute (ITGI)","year":"2007"},{"key":"2024082918035157900_B23","doi-asserted-by":"crossref","DOI":"10.4135\/9781412984522","volume-title":"Interaction Effects in Multiple Regression","author":"Jaccard","year":"2003"},{"issue":"3","key":"2024082918035157900_B24","doi-asserted-by":"crossref","first-page":"219","DOI":"10.1080\/07421222.1999.11518262","article-title":"Supervisor support and career anchor impact on the career satisfaction of the entry-level information systems professional","volume":"16","author":"Jiang","year":"1999","journal-title":"Journal of Management Information Systems"},{"issue":"3","key":"2024082918035157900_B25","first-page":"235","article-title":"Expertise and error in diagnostic reasoning","volume":"5","author":"Johnson","year":"1981","journal-title":"Cognitive Science"},{"issue":"2","key":"2024082918035157900_B28","doi-asserted-by":"crossref","first-page":"103","DOI":"10.1046\/j.1365-2575.2002.00121.x","article-title":"Reconciling user and project manager perceptions of IT project risk: A Delphi study","volume":"12","author":"Keil","year":"2002","journal-title":"Information Systems Journal"},{"issue":"2","key":"2024082918035157900_B26","doi-asserted-by":"crossref","first-page":"299","DOI":"10.2307\/3250940","article-title":"A cross-cultural study on escalation of commitment behavior in software projects","volume":"24","author":"Keil","year":"2000","journal-title":"MIS Quarterly"},{"issue":"2","key":"2024082918035157900_B27","doi-asserted-by":"crossref","first-page":"145","DOI":"10.1016\/S0164-1212(00)00010-8","article-title":"An investigation of Risk perception and risk propensity on the decision to continue a software development project","volume":"53","author":"Keil","year":"2000","journal-title":"Journal of Systems and Software"},{"key":"2024082918035157900_B29","unstructured":"KPMG. 2013. KPMG\u2019s 2013 IT Internal Audit Survey. https:\/\/assets.kpmg\/content\/dam\/kpmg\/pdf\/2013\/10\/it-internal-audit-survey2013.pdf"},{"issue":"3","key":"2024082918035157900_B30","doi-asserted-by":"crossref","first-page":"1051","DOI":"10.1287\/isre.2019.0853","article-title":"The effect of IT project managers\u2019 mental construal on IT project risk management activities","volume":"30","author":"Lee","year":"2019","journal-title":"Information Systems Research"},{"issue":"8","key":"2024082918035157900_B31","doi-asserted-by":"crossref","first-page":"701","DOI":"10.1016\/0361-3682(94)90030-2","article-title":"Modeling the determinants of audit expertise","volume":"19","author":"Libby","year":"1994","journal-title":"Accounting, Organizations and Society"},{"issue":"4","key":"2024082918035157900_B32","doi-asserted-by":"crossref","first-page":"319","DOI":"10.1111\/j.1365-2575.2009.00333.x","article-title":"Comparing senior executive and project manager perceptions of IT project risk: A Chinese Delphi study","volume":"20","author":"Liu","year":"2010","journal-title":"Information Systems Journal"},{"issue":"4","key":"2024082918035157900_B33","doi-asserted-by":"crossref","first-page":"720","DOI":"10.1037\/0022-3514.50.4.720","article-title":"Social identification effects in group polarization","volume":"50","author":"Mackie","year":"1986","journal-title":"Journal of Personality and Social Psychology"},{"issue":"2","key":"2024082918035157900_B34","doi-asserted-by":"crossref","first-page":"157","DOI":"10.1080\/1366987032000123856","article-title":"Personality and domain-specific risk taking","volume":"8","author":"Nicholson","year":"2005","journal-title":"Journal of Risk Research"},{"issue":"1","key":"2024082918035157900_B35","doi-asserted-by":"crossref","first-page":"80","DOI":"10.1016\/j.im.2017.04.002","article-title":"IT managers\u2019 vs. IT auditors\u2019 perceptions of risks: An actor\u2013observer asymmetry perspective","volume":"55","author":"Nuijten","year":"2018","journal-title":"Information & Management"},{"issue":"4","key":"2024082918035157900_B36","doi-asserted-by":"crossref","first-page":"363","DOI":"10.2307\/249191","article-title":"A stochastic dominance approach to risk analysis of computer systems","volume":"10","author":"Post","year":"1986","journal-title":"MIS Quarterly"},{"issue":"2","key":"2024082918035157900_B37","doi-asserted-by":"crossref","first-page":"182","DOI":"10.1080\/03634528609388339","article-title":"Risk-taking and polarization in small group communication","volume":"35","author":"Rothwell","year":"1986","journal-title":"Communication Education"},{"issue":"1","key":"2024082918035157900_B38","doi-asserted-by":"crossref","first-page":"9","DOI":"10.1080\/07421222.1998.11518195","article-title":"Differences between novice and expert systems analysts: What do we know and what do we do?","volume":"15","author":"Schenk","year":"1998","journal-title":"Journal of Management Information Systems"},{"issue":"4","key":"2024082918035157900_B39","doi-asserted-by":"crossref","first-page":"5","DOI":"10.1080\/07421222.2001.11045662","article-title":"Identifying software project risks: An international Delphi study","volume":"17","author":"Schmidt","year":"2001","journal-title":"Journal of Management Information Systems"},{"issue":"3","key":"2024082918035157900_B40","doi-asserted-by":"crossref","first-page":"291","DOI":"10.1177\/002224378101800303","article-title":"Identification and analysis of moderator variables","volume":"18","author":"Sharma","year":"1981","journal-title":"Journal of Marketing Research"},{"issue":"1","key":"2024082918035157900_B41","doi-asserted-by":"crossref","first-page":"9","DOI":"10.2307\/258646","article-title":"Reconceptualizing the determinants of risk behavior","volume":"17","author":"Sitkin","year":"1992","journal-title":"The Academy of Management Review"},{"issue":"6","key":"2024082918035157900_B42","doi-asserted-by":"crossref","first-page":"1573","DOI":"10.2307\/256844","article-title":"Determinants of risky decision-making behavior: A test of the mediating role of Risk perceptions and propensity","volume":"38","author":"Sitkin","year":"1995","journal-title":"Academy of Management Journal"},{"issue":"1","key":"2024082918035157900_B43","doi-asserted-by":"crossref","first-page":"17","DOI":"10.1057\/jit.2011.29","article-title":"Information technology project risk management: Bridging the gap between research and practice","volume":"27","author":"Taylor","year":"2012","journal-title":"Journal of Information Technology"},{"issue":"6","key":"2024082918035157900_B44","doi-asserted-by":"crossref","first-page":"1585","DOI":"10.1111\/j.0272-4332.2004.00552.x","article-title":"Aviation Risk perception: A comparison between experts and novices","volume":"24","author":"Thomson","year":"2004","journal-title":"Risk Analysis"},{"key":"2024082918035157900_B45","unstructured":"Van Grembergen, W.\n          . 2002. Introduction to the minitrack: IT governance and its mechanisms. Proceedings of the 35th Annual Hawaii International Conference on System Sciences, Big Island, HI, January 7\u201310."},{"issue":"1","key":"2024082918035157900_B46","doi-asserted-by":"crossref","first-page":"115","DOI":"10.1016\/j.im.2003.12.007","article-title":"Understanding software project risk: A cluster analysis","volume":"42","author":"Wallace","year":"2004","journal-title":"Information & Management"},{"issue":"4","key":"2024082918035157900_B47","doi-asserted-by":"crossref","first-page":"263","DOI":"10.1002\/bdm.414","article-title":"A domain-specific risk-attitude scale: Measuring Risk perceptions and risk behaviors","volume":"15","author":"Weber","year":"2002","journal-title":"Journal of Behavioral Decision Making"},{"issue":"1","key":"2024082918035157900_B48","doi-asserted-by":"crossref","first-page":"205","DOI":"10.2308\/jis.2006.20.1.205","article-title":"Research opportunities in information technology and internal auditing","volume":"20","author":"Weidenmier","year":"2006","journal-title":"Journal of Information Systems"},{"issue":"3","key":"2024082918035157900_B49","doi-asserted-by":"crossref","first-page":"1598","DOI":"10.1111\/1911-3846.12568","article-title":"Intuition versus analytical thinking and impairment testing","volume":"37","author":"Wolfe","year":"2020","journal-title":"Contemporary Accounting Research"},{"issue":"4","key":"2024082918035157900_B50","doi-asserted-by":"crossref","first-page":"584","DOI":"10.1111\/j.1464-0597.2005.00236.x","article-title":"The role of risk in making decisions under escalation situations","volume":"54","author":"Wong","year":"2005","journal-title":"Applied Psychology"}],"container-title":["Journal of Information Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/publications.aaahq.org\/jis\/article-pdf\/37\/1\/67\/90110\/i0888-7985-37-1-67.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/publications.aaahq.org\/jis\/article-pdf\/37\/1\/67\/90110\/i0888-7985-37-1-67.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,8,29]],"date-time":"2024-08-29T22:00:38Z","timestamp":1724968838000},"score":1,"resource":{"primary":{"URL":"https:\/\/publications.aaahq.org\/jis\/article\/37\/1\/67\/10142\/Internal-Auditors-Perceptions-of-Information"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,3,1]]},"references-count":50,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2023,4,4]]},"published-print":{"date-parts":[[2023,3,1]]}},"URL":"https:\/\/doi.org\/10.2308\/isys-2020-040","relation":{},"ISSN":["0888-7985","1558-7959"],"issn-type":[{"value":"0888-7985","type":"print"},{"value":"1558-7959","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,3,1]]}}}