FAYETTEVILLE, Ark. — Computers are the life-blood of business — affecting everything from parts to payroll, sales to shipping. Information technology (IT) professionals create and control these essential processes, but they also engage in illegal or inappropriate activities that cost their employers billions of dollars each year.

In a recent study, University of Arkansas researcher Paul Cronan found that six individual and situational characteristics of ethical behavior account for more than half of all IT misuse. The study was conducted with Lori Leonard, assistant professor of management information systems at the University of Tulsa. Their findings are reported in the current issue of the Journal of the Association for Information Systems.

"Misuse of IT causes serious losses to business and society," said Cronan, professor of information systems and M.D. Matthews Research Chair in the Walton College of Business. "Using conservative estimates, businesses lose more than $265 billion each year from inappropriate or illegal use of IT."

IT misuse can include illegal copying of computer software, accessing and using personal data or unauthorized use of a company computer for personal gain. Some IT misuses, such as identity theft, can have a direct impact on individuals as well as businesses.

In this study, which included 1,995 observations, the researchers found four psychological factors — attitude toward ethical situation, feeling of moral obligation, strength of convictions and the individual’s stage of moral development — were most important in predicting ethical behavior intention. The other significant factors were the respondent’s gender and the ethical situation itself.

"Gender was found to be a significant indicator of one’s intention to behave ethically or unethically," Cronan said. "Women had a greater intention to behave ethically than men in this study."

After evaluating IT ethical behavior models and determining the psychological factors and personal variables linked to IT misuse and behavior, Cronan will develop a screening instrument that employers can use to measure the state of awareness in their organization. This will allow employers to adapt their training to meet the employee’s needs and reduce the overall costs arising from IT misuse.

"For example, if the instrument identifies moral judgement as a problem area, training programs on IT ethical issues could reduce computer misuse," Cronan explained. "Past ethical situations can be used to provide direction for both new and current employees. Most people learn by example, so it takes an ethical dilemma to reinforce company policies."

Several models have been proposed to explain ethical IT behavior, but research results have been inconsistent. Although some studies found gender to be an influential component, other studies did not collect gender data at all. In addition, earlier studies had small sample populations and included six different organizations, which made accurate data comparisons more difficult.

In a study designed to address the shortcomings of this research, Cronan and Leonard surveyed 423 respondents to determine their intention to behave ethically. Each person was given five scenarios involving IT misuse and asked to indicate if the IT professional’s actions were acceptable or unacceptable and to estimate the probability that the respondent would do the same thing in a similar situation.

Each person was also given a set of standardized questions to assess the characteristic associated with ethical behavior. These characteristics were: 1) intention to behave ethically, 2) attitude toward ethical behavior (evaluation of the behavior in question), 3) personal normative beliefs (the person feels a moral obligation to behave in a certain way), 4) ego strength (ability to follow their convictions and resist influence), 5) locus of control (whether the person believes that life events are determined by their own behavior or by events beyond their control), 6) moral judgement (the way an individual reasons when faced with a moral dilemma) and 7) gender.

"If we can understand which components influence the behavior, we can develop effective responses," explained Cronan. "Controllable components, such as awareness of company policies, can be addressed through training. Other components may require more IT controls, including implementing deterrents such as informing individuals that they are being monitored as well as other safeguards."