Understanding the Effects of Formal and Informal Controls on Employee Information Security Policy Compliance: A Meta-Analysis

This research analyzed 183 studies to compare how organizations can get employees to follow information security policies (rules about protecting data and systems). The study found that informal controls, like peer influence and self-motivation, are more effective than formal controls like rules and monitoring. Formal controls work indirectly by helping employees develop informal controls through learning and accepting the organization's values.