Despite the importance of and the value that may be derived from the relationship between internal
audit and information security, there has been no empirical research investigating how well the two
functions work together. This paper reports the results of a study that takes the first steps to fill this gap in
the literature. We conducted a series of semi-structured interviews with both internal auditors and
information systems security professionals to identify the factors that determine the nature of the
relationship between the internal audit and information security functions. The dearth of prior research
makes such an exploratory approach appropriate.