Finally, differences in access to top management may influence the relationship between internal audit and information security. The internal audit function typically reports functionally to the Board of Directors and administratively to senior management (IIA 2009). In contrast, the information systems security function often does not have a direct reporting relationship to