Exploring the effects of organizational justice, personal ethics and sanction on internet use policy compliance

TLDR

Internet security risks largely arise from employees’ non‑compliance with internet use policies, yet prior research has largely overlooked the role of intrinsic motivation in shaping compliance intentions. The study proposes a theoretical model that combines intrinsic self‑regulatory and extrinsic sanction‑based approaches to examine employees’ internet‑use‑policy compliance intention. The model centers on how organizational justice and personal ethical objections foster self‑regulation, contrasting this with sanction‑based command‑and‑control oversight. Results show that the self‑regulatory approach outperforms sanction‑based command‑and‑control, with organizational justice influencing compliance both directly and indirectly through ethical objections, confirming organizational justice and personal ethics as effective levers for enhancing policy compliance.

Abstract

Abstract Internet security risks, the leading security threats confronting today's organizations, often result from employees' non‐compliance with the internet use policy (IUP). Extant studies on compliance with security policies have largely ignored the impact of intrinsic motivation on employees' compliance intention. This paper proposes a theoretical model that integrates an intrinsic self‐regulatory approach with an extrinsic sanction‐based command‐and‐control approach to examine employees' IUP compliance intention. The self‐regulatory approach centers on the effect of organizational justice and personal ethical objections against internet abuses. The results of this study suggest that the self‐regulatory approach is more effective than the sanction‐based command‐and‐control approach. Based on the self‐regulatory approach, organizational justice not only influences IUP compliance intention directly but also indirectly through fostering ethical objections against internet abuses. This research provides empirical evidence of two additional effective levers for enhancing security policy compliance: organizational justice and personal ethics.