Many organizations have a problem with synchronizing individual values regarding information security with expectations set by the relevant security policy. Such discordance leads to failure in compliance or simply subversion of existing or imposed controls. The problem of the mismatch in understanding the security policies amongst individuals in an organization has devastating effect on security of the organization. Different individuals hold different understanding and knowledge about IS security, which is reflected on IS security policies design and practice (Vaast, 2007). Albrecthsen and Hovdena (2009) argue that users and managers practice IS security differently because they have different rationalities. This difference in rationalities may reflect the mismatch between the security policies and individuals’ values. In this research, we argue that occurrence of security breach can change individuals’ values in light of security policy of organization. These changes in the values can be reflected on the compliance between individuals’ norms and security rules and standards. Indeed, organizations need to guarantee the compliance between security policy and values of their employees. Thus, they can alleviate or prevent violations of security of organization. However, it is difficult to find a common method that all organizations can adopt to guarantee the synch between security rules and individuals’ norms. The main aim of this research is to investigate how people perceive information security policy and how their perceptions change in response to security breaches. Besides, this research aims to investigate the relationship between individuals’ values and security policy. Thus, organizations can have the intended level of compliance between individual norms and security rules and standards. With the aid of the Repertory Grid technique, this research examines how a security breach shapes people’s values with respect to security policy of an organization. To conduct the argument, this research offers an assessment mechanism that aids the organization to evaluate employees’ values in regard to security policy. Based on that evaluation, the organization can develop a proper mechanism to guarantee compliance between individuals’ norms and security rules. The results of this research show that employees in an organization hold different perceptions regarding the security policy. These perceptions change in response to security incident. This change in perceptions dose not necessarily result in better compliance with the security policy. Factors like the type of breach and people’s experience can affect the amount of change in the perceptions. Contributions, implications, and directions for future research of this study will be discussed.

Bakgrund Som statsanställda ska lärare vid Sveriges statliga universitet och högskolor lojalt följa de regler som gäller för verksamheten. Mer kunskap behövs dock kring de faktorer som predicerar högskolelärares förhållningssätt till och arbete i enlighet med det regelverk som gäller i kontakten med studenterna och vid bedömning av studentprestationer. Metod En webbenkätundersökning (n = 3625 svar) genomfördes med syfte att genom bivariat korrelation och multipel regressionsanalys predicera svenska universitets- och högskolelärares (1) rapporterade a-steg från det nationella regelverket i förvaltningslagen och högskoleförordningen respektive (2) intention att följa regelverket. Följande prediktorer ingick i analysen: Upplevda konsekvenser för (3) läraren själv respektive (4) andra om regelverket inte följdes; (5) kollegornas regelefterlevnad; (6) upplevd förmåga och möjlighet att följa regelverket; (7) upplevelse att regelverket är betungande, onödigt och ineffektivt (överbyråkratisering); utbildning i (8) juridik respektive (9) statsvetenskap; (10) organisatorisk rättvisa; (11) studenternas bemötande av läraren; (12) negativ attityd till studenternas rättigheter och ställning. Därutöver ingick de demografiska variablerna (13) kön, (14) ålder och (15) anställningstid. Resultat De erhållna multipla regressionsmodellerna förklarade 25 % av variansen i intention att följa regelverket (ej signifikant bidrag från prediktorerna 8 och 11) respektive 11 % av variansen i avsteg från regelverket (endast signifikant bidrag från prediktorerna 2, 3, 5, 6, 8, 11 och 14). Intention att följa regelverket förklarade ensamt 5 % av variansen i avsteg från regelverket. Slutsats Intention att följa regelverket och avsteg från regelverket kan i viss utsträckning förklaras av studiens prediktorer. Stor andel varians förblir dock oförklarad och effektstorlekarna var genomgående små. Mer preciserade beteenden förmodas ge högre förklaringsvärde i fortsatta studier. / Background According to the Swedish Instrument of Government (regeringsformen), “public power is exercised under the law” (chap. 1, art. 1, sec. 3). This states that, being public servants, teachers at Sweden’s public-sector universities and university colleges must loyally abide by the rules that are applicable to their sector. Despite the higher education sector being the largest public service sector in Sweden (with 76 000 employees and 350 000 students), and a very great deal of discretion is given to the teachers – when giving grades, for instance, as the student is not allowed to appeal against the grading decision to a higher institution – there is an apparent lack of research dealing with university teachers’ relation to the regulations. The aim of this study is to investigate variables that predict university teachers’ intention to comply with the regulations and act in accordance with the national rules that apply in the meeting with students and when assessing student performances. Method A web survey (n = 3625 received responses; response rate: 14.8 %; 1822 females, 1775 males, 28 other; age M = 51.1 years, SD = 9.3 years) was conducted in April of 2020 with the aim of predicting Swedish university and university-college teachers’ (1) self-reported breach of national regulations found in the Swedish Administrative Procedure Act (förvaltningslag) and Higher Education Ordinance (högskoleförordning) and their (2) intention to comply with the regulations. The following predictors were included in the analysis: Perceived consequences for (3) the teacher and for (4) others (i.e. students, the higher education institution itself and society) if regulations were not followed; (5) the extent of rule abidance among the teacher’s colleagues (descriptive norms); (6) perceived ability and possibility to abide by the rules (behavioral control); (7) perception of the rules being burdensome, unnecessary and ineffective (level of red tape); education in (8) law or (9) political science (“1” coded as having an education in the field); (10) organizational justice; (11) how the students treat the teacher (interpersonal justice); (12) negative attitude towards the students’ rights and position.In addition, the demographic variables (13) gender (“1” coded as female), (14) age and (15) years of employment were included as control variables. Results Breach of national regulations The ten most common rule-breaking behaviors performed by the teachers included Assessing a student without being able to distinguish the student’s performance from that of other students, for instance in group exams (39.3 %) Using derogative expressions (e.g. made fun of, using foul language) about a student internally in the organization towards a colleague (30.0 %) Refraining from responding to a student’s questions, e.g. in an e-mail or in a conversation (17.8 %) Taking other factors into consideration than the student’s expressed knowledge when deciding to pass a student. For instance, considering lack of time and resources; the student’s need for student financial aid to make a living, which depends on the student’s completed courses; your department’s need of state funding based on the student’s completed education (12.0 %) Giving different supplementary assignments based on the reason for the student’s missing attendance (11.4 %) Giving a single student the possibility for a retake, without offering the same opportunity to the other students in the course being in a similar situation (10.4 %) Refraining from notifying the vice-chancellor of there being grounds for suspecting that a student has attempted to deceive during an examination (9.6 %) Using a different examination format from the one/those stipulated in the course syllabus (9.2 %) In the document containing the grading decision, refraining from stating the names of all teachers that have helped with the assessment of a test (8.9 %; 10.4 % of the examiners) With the purpose of easing your workload, informing a student that a supplementary assignment will be more laborious than the ordinary assignment (7.0 %) Predicting intention to comply with the regulations All variables had a significant bivariate correlation with intention to comply with the regulations, having directions of the relationships that were in accordance with those hypothesized. However, some relations changed when combining all variables using a linear multiple regression. The linear multiple regression model explained 25 % of the variance in intention to comply with the regulations. The following predictors had a significant negative association with intention: (3) Consequences for the teacher if regulations were not followed (β = −0.05) (4) Consequences for others if regulations were not followed (β = −0.23) (7) Red tape (β = −0.08) (9) Education in political science (β = −0.03) – contrary to what was expected (12) Negative attitude towards the students’ rights and position (β = −0.04) (14) Age (β = −0.04) (15) Time of employment (β = −0.04) The following predictors had a significant positive association with intention: (5) The extent of rule abidance among colleagues (β = 0.08) (6) Perceived ability and possibility to abide by the rules (β = 0.15) (10) Organizational justice (β = 0.04) (13) Gender (β = 0.14) Contrary to expectation, these predictors did not have any significant contribution: (8) Education in law (11) How the students treat the teacher Predicting breach of regulations All variables, except (9) education in political science, had a significant bivariate correlation with breach of regulations, having directions that were expected from the hypotheses. However, many variables were found to have a non-significant contribution when combining all variables using a linear multiple regression. Intention to comply with regulations, by itself using bivariate correlation, explained 5 % of the variance in breach of regulations (r = −0.23). The linear multiple regression model explained 11 % of the variance in breach of regulations. The following predictors had a significant positive association with breach of regulations: (3) Consequences for the teacher if regulations were not followed (β = 0.06) (8) Education in law (β = 0.04) – contrary to what was expected The following predictors had a significant negative association with intention: (2) Intention to comply with the regulations (β = −0.15) (5) The extent of rule abidance among colleagues (β = −0.05) (6) Perceived ability and possibility to abide by the rules (β = −0.10) (11) How the students treat the teacher (β = −0.11) (14) Age (β = −0.08) Contrary to what was expected, these predictors did not have any significant contribution: (4) Consequences for others if regulations were not followed (7) Red tape (9) Education in political science (10) Organizational justice (12) Negative attitude towards the students’ rights and position (13) Gender (15) Time of employment Limitations The following limitations should be considered and accounted for in future research: Due to assumed response bias and socially desirable responding, the reported level of intention to comply with the regulations is probably inflated while the reported number of rules broken is probably deflated. Differing specificity levels of the behaviors have been studied, resulting in a difference in compatibility. Variables 2–7 included more general questions about the regulations, while actual breach of regulations (variable 1) have included more specific rule-breaking behaviors. Some rule-breaking behaviors included in this survey fall within a gray area. Some respondents, for instance, report it being difficult to determine when criticism towards a student could be perceived as offensive. Thus, there is room for improvement regarding the wording of the items in the developed instrument. What constitutes a violation of the rules is ultimately decided by a legal institution (e.g. a court of law). The assumptions for the linear multiple regressions were not met in terms of homoscedasticity and normality of the residuals due to extreme skewness of the data. This affects the reliability of the multiple-regression models. The internal consistency of the measure of negative attitude towards students’ rights and position was low (Cronbach’s α = −0.60) and the items should be improved to increase the reliability. Conclusion The intention to comply with the regulations and the breaches of the regulations can to some extent be explained by the predictors included in this study. However, a large portion of the variance remains unaccounted for and the general effect sizes were small. More specific behaviors are assumed to contribute to better reliability in future studies.

The purpose of this dissertation is to provide its readers with a detailed and comprehensive look at the institute of duty of care, business judgment rule and related civil and partly also criminal liability of members of (not only) statutory bodies of capital business companies, and in this respect also to introduce an internal compliance program as one of the main instruments of good and effective corporate governance. The main objective of this dissertation is therefore to verify or refute the hypothesis whether, and if so in what particular form, can an internal compliance program be seen as an institute helping members of statutory bodies of capital business companies in fulfilling specific requirements and obligations of their duty to carry out the statutory function with due (managerial) care. The existence (implementation) of an internal compliance program is quite commonly connected with so called regulated markets and also with individual business corporations whose ownership structure extends the boundaries of the Czech Republic (typically British or American business corporations seated in the Czech Republic). But what about a wide neutral zone of Czech business corporations, i.e. especially small and medium-sized capital business companies? Shall these implement an internal compliance program as well? And, if so, on what grounds and with what benefits?