The role of deterrability for the effect of multi-level sanctions on information security policy compliance: Results of a multigroup analysis

This paper offers a new perspective on the effectiveness of sanctions in influencing information security policy compliance. We observe compliance from a group perspective to identify undeterrable employees who comply based on inner conviction and deterrable employees who comply because of external coercion. Drawing upon survey data, we show that multilevel sanctions (i.e., formal, social, and personal sanctions) have a varying impact on the compliance of inclined and disinclined employees. We also find that multilevel sanction perceptions are differently influenced by information security policy awareness. This group-based deterrability perspective opens up new avenues to study the value of sanctions.