Miscommunication between internal audit and information security may have a negative impact on
the relationship between these functions. Indeed, there is considerable evidence that communication
problems which reflect differences in background and knowledge underlie many of the disagreements
that often occur between CFOs and CIOs (CFO Europe Research Services 2008). Differences in department
size, culture, resources, and unit management's attitudes are other potential causes of relationship problems
between organizational units (Smith et al. 2010). Finally, differences in access to top management may
influence the relationship between internal audit and information security. The internal audit function typically
reports functionally to the Board of Directors and administratively to seniormanagement (IIA 2009). In contrast,
the information systems security function often does not have a direct reporting relationship to