Although a good relationship between the internal audit and information security
functions has been found to improve an organization's level of compliance with the IT-related internal
control requirements of the Sarbanes–Oxley Act (Wallace et al. 2011), there is also abundant evidence that
the relationship between internal audit and other functions within organizations is often strained (Tucci
2009; Dittenhofer et al. 2010). Thus, it is important to understand the factors that influence the nature of
the relationship between the internal audit and information security functions.