CCAC Theses and Dissertations
Campus Access Only
All rights reserved. This publication is intended for use solely by faculty, students, and staff of Nova Southeastern University. No part of this publication may be reproduced, distributed, or transmitted in any form or by any means, now known or later developed, including but not limited to photocopying, recording, or other electronic or mechanical methods, without the prior written permission of the author or the publisher.
Date of Award
2026
Document Type
Dissertation - NSU Access Only
Degree Name
Doctor of Philosophy in Information Systems (DISS)
Advisor
Ling Wang
Keywords
Audit trustworthiness; Cybersecurity culture; Organizational cultural change; Organizational trust; Procedural justice; Security governance
Abstract
Many organizations recognize the importance of information security policies and training initiatives, but struggle to cultivate a strong cybersecurity culture. While audits are commonly used to evaluate compliance with security standards, their potential to address deeper behavioral and cultural dynamics that influence user engagement with security practices is often overlooked. Traditional auditing approaches often focus on identifying technical vulnerabilities and formal policy violations, but overlook how audits can affect employee behavior and the organization's overall cybersecurity culture. This study investigated how trusted security audits, characterized by perceived fairness, transparency, and collaboration, contribute to enhancing an organization's cybersecurity culture. While previous research has highlighted the importance of employee behavior, leadership engagement, and training in fostering security compliance, the potential of audit practices to drive cultural transformation remained underexplored. This study addressed that gap by examining how employees' perceptions of audit fairness, transparency, and collaboration influenced the overall strength of the organization's cybersecurity culture, operationalized through employee attitudes and behaviors toward cybersecurity, their understanding of the organization's cybersecurity requirements, their sense of organizational support and communication, and their adherence to secure behaviors. The study employed an embedded single-case study design situated within a mid-sized educational software organization that had undergone six consecutive years of external security audits. Quantitative survey data, grounded in the Information Security Culture Change Management (ISCCM) model and the ADKAR framework, measured relationships between perceived audit trustworthiness and cultural outcomes among 113 employees. Qualitative interviews with 22 employees explored their lived experiences and interpretations of audit processes, yielding 997 coded references used to triangulate the quantitative findings. Regression analyses demonstrated that perceived audit trustworthiness was a statistically significant predictor of cybersecurity culture overall (R² = .481) and of each of its five dimensions individually, with the strongest effect observed for cybersecurity communication (R² = .547) and the weakest for security attitudes (R² = .158). Among the three trustworthiness dimensions, fairness emerged as the most consistent individual predictor across outcomes, whereas transparency and collaboration contributed more variable effects depending on the specific cultural dimension examined. Qualitative findings converged with and extended these results, revealing that employees experienced trusted audits as catalysts for organizational learning rather than solely as compliance mechanisms, with particularly rich evidence describing a shift from secretive to openly collaborative security dialogue. These findings provide actionable insights for organizations seeking to align compliance-driven audit processes with sustainable, human-centered approaches to developing a cybersecurity culture.
NSUWorks Citation
Jeffrey S. Janover. 2026. The Role of Trusted Security Audits in Driving Organizational Cultural Change. Doctoral dissertation. Nova Southeastern University. Retrieved from NSUWorks, . (1220)
https://nsuworks.nova.edu/gscis_etd/1220.