However, Ransbotham and Mitra (2009) did not test, but only postulated the potential value of
monitoring controls in improving the effectiveness of other information security procedures. Moreover,
their model implicitly assumes the existence of a feedback process that uses the information collected by
monitoring controls to modify and improve the organization's configuration and access controls. Feedback
from internal audits can improve the effectiveness and efficiency of information security processes only to
the extent that individuals responsible for the security function take corrective actions in response to any
audit findings or recommendations. Information security managers' willingness to respond to an internal
audit report may be determined, at least in part, by the quality of the relationship they have with the
internal audit function. Although a good relationship between the internal audit and information security
functions has been found to improve an organization's level of compliance with the IT-related internal
control requirements of the Sarbanes–Oxley Act (Wallace et al. 2011), there is also abundant evidence that
the relationship between internal audit and other functions within organizations is often strained (Tucci
2009; Dittenhofer et al. 2010). Thus, it is important to understand the factors that influence the nature of
the relationship between the internal audit and information security functions.