This paper reports the results of a study that takes the first steps to fill this gap in
the literature. We conducted a series of semi-structured interviews with both internal auditors and
information systems security professionals to identify the factors that determine the nature of the
relationship between the internal audit and information security functions. The dearth of prior research
makes such an exploratory approach appropriate.