Ransbotham and Mitra (2009) focus on the role of the information systems security function in
implementing all three types of controls. However, as normative guidance (IIA, 2005; ITGI, 2007: CoBiT sections DS 5.5 and ME2) suggests, the organization's internal audit function should periodically assess the effectiveness of internal controls, including those related to information systems security. Therefore, Ransbotham and Mitra's (2009) logic concerning the value of monitoring controls suggests by extension that internal audit review can improve the effectiveness of an organization's information security efforts.