The measurement of impaired independence may be difficult, but the potential organizational benefits from fostering a closer relationship between the internal audit and information systems security functions are likely to follow an inverted-U pattern