In early 2010, in a study by Kyobe (2010), the authors raised concerns about compliance with information security policies across universities in South Africa. Twenty years later, Murire et al. (2020) cited a lack of awareness as a major contributor to non-compliance across South African businesses. As recently as this year, Mugwagwa Bhero and Chibaya (2024) pointed out that some of the strategies that should be implemented to curb cybersecurity threats include a ‘focus on compliance’. The Gauteng province hosts two large cities which include, Johannesburg, the largest city and Pretoria, the capital city. Gauteng attracts multinational and national financial institutions and businesses that are targets of serious cybercrimes, with employees playing a big part in contributing to cybersecurity risks. Employee behaviour across these institutions was raised as a concern. Workaround behaviour across businesses in Gauteng, South Africa, that are seen as contributing to non-compliance with information security policies and, therefore, contributing to risk is explained in the next section.

Workarounds refer to employees’ ability to seek solutions to problems through bypassing policies when these policies are not perceived to be working. In efforts to circumvent an established information security protocol or procedure and initiate a workaround, an employee may introduce a system weakness known as a vulnerability that can be, at a later stage, exploited by an attacker with nefarious intentions. It is, therefore, necessary to understand what individual, cultural or institutional factors motivate employees to carry out workarounds. This research endears to the following problem:

Adhering to information security policies is central to good information security practices (Siponen 2006). Unfortunately, workarounds seen as a form of non-complaint information security behaviour are becoming common because of perceived benefits (Azad & King 2008). Little is known regarding why this is so. This research explores the reasons behind this trend, with a focus on how workarounds threaten the integrity of information systems.

Considering the concern scholars raise regarding the non-compliance behaviour that characterises workarounds, this research undertook to examine the following:

This research is therefore structured as follows: Section one has outlined the context of research and articulated the research problem and research objectives. Section two that follows examines the literature regarding workarounds, and the impact this behaviour has on the integrity of information. Section three explains the research methodology used in this study, and the penultimate sections discusses how data were analysed and the results that followed. The conclusion follows thereafter presenting the research work’s contribution and way forward.

Confidentiality, integrity and availability (CIA) triad forms the fundamental basis for information security that stresses information protection against unauthorised access, alteration or destruction (Liu et al. 2020). Part of maintaining information integrity requires that measures to protect information by reducing breaches through continuous monitoring, secure authentication practices and training to raise user awareness (Da Veiga & Martins 2015). Studies point to the advancing of understanding regarding information integrity and the protection of data, but a crucial concern has been the organisations lack a way of standardising this understanding. Many scholars talk of information integrity (Harley & Cooper 2021) or of data integrity (Duggineni 2023), which mostly considers similar aspects. It is, therefore, crucial that the integrity of information be better understood. Studies point out that human factors such as behaviour may compromise the integrity of information, particularly those employees working in the organisations (Wong et al. 2019). The next section details some of these human factors specifically focusing on workaround behaviour.

Though mentioned in management, organisational and technology literature, workarounds are under theorised in information security literature. The theory of workarounds postulated by Alter (2014) explains workarounds in organisational settings, pointing to how these occur and, importantly, assists management efforts in policy compliance (or non-compliance). Woltjer (2017) has pointed out that workarounds-as-improvisation correlated with information systems expertise, and although those skilled individuals intended to achieve work quality and integrity, the unintended consequence was non-compliance as the trade-off. Indeed, scholars have raised the concern that the trade-offs in workarounds, bypassing established policies and procedures, may constitute an information security risk (Slabbert et al. 2021). Workarounds overwhelm information security practitioners in organisations because they may not know which policies have been violated and how they have been violated when workarounds are initiated. When employees are under pressure because of time or lack of resources and initiate workarounds, this is often detrimental to information security integrity (Van Offenbeek et al. 2024). Workarounds primarily stem from personality traits such as self-efficacy or organisational traits such as culture and collegiality (Rooney et al. 2021), propagating shortcuts to tasks. To this end, the following hypothesis is proposed:

Self-efficacy theory places a great emphasis on the importance of how individuals perceive their own abilities. In information systems research, studies show that employees with stronger ‘self-confidence for tackling IS security threats are more likely to adopt [information system] IS security innovation’ (Hameed & Arachchilage 2021). While in some parts, this innovation may be of important to the organisation, most times it is not, because the workaround was performed outside of policy and regulation. Self-efficacy most often influences intention and may result in abuse of computer systems tasks (Rhee et al. 2009). Self-efficacy may benefit organisations when employees are confident in themselves to initiate practical remedies against attempted information security breaches, finding solutions but staying within the limits of policy guidelines. According to Tamjidyamcholo et al. (2013), self-efficacy positively impacts the ability to identify and successfully respond to security threats and compliance. At times, the individual may lack self-regulating mechanisms that override these policies. This is where self-efficacy becomes detrimental. To this end, the following hypothesis is proposed:

Individuality places greater emphasis on the independence and rights of individuals than collective entities. The idea of individuality fosters personal freedom and the pursuit of personal goals with minimal intrusion from external forces (Twenge & Campbell 2018). Locke and Latham (2002) state that individual attitudes advance effective goal-setting processes, which enhance employee motivation and job satisfaction by emphasising individual accomplishments rather than group outcomes in performance appraisals. Kshetri (2017) has studied information security integrity in healthcare and observed that integrity might be hindered by individuality because employees might prioritise self-interests over organisational security protocols in their efforts to work around challenges. According to Chua et al. (2020), independence and personal well-being can be promoted through individual cultures but also hinder industry-wide information-sharing initiatives while encouraging competition, leading to a decline in overall safety postures. Another problem is that information system sectors are faced with competition based on culture, which makes it difficult for them to share knowledge about cyber-attacks (Chua et al. 2020). In their study, Huuskonen and Vakkari (2013) examined social workers who undertook workarounds and exhibited individualism by employing small-scale tricks within their Information Technology (IT) department to maintain a continuum of positive trajectory for their clients. Though this saved time, the social workers either ignored policies entirely or merged information, a clear policy violation. To this end, the following hypothesis is proposed:

An organisation’s ability to gather, interpret, transform and disseminate information is referred to as organisational information processing capabilities (IPC) (Chen & Nath 2018). Employees may sometimes assume that the current systems or procedures do not fit or accommodate their needs, and they often resort to workarounds to ‘fix’ these processes. The problem is that organisations usually spot abnormalities or patterns that point to potential security breaches if they have the necessary processing power, but this ‘fixing’ may affect IPC (Wei et al. 2023).

Information processing capability and information security can be affected by issues like increasing data volume and complexity, information system vulnerabilities, poor infrastructure, human error and data protection law compliance (Beerepoot et al. 2019a). As workarounds may cause breaches of business standards that can give rise to unauthorised entry or loss of data because of system restrictions or inefficiencies, among others, they establish extra risks to information security (Alshammari 2023).

Organisations usually confront difficulties in processing information where processes have been ‘worked around’, and this affects the integrity of information security, as proposed by Beerepoot et al. (2019b). Investing in cutting-edge IT infrastructure and personnel training is necessary to manage the workarounds and foster proper data handling using best practices. Organisations should emphasise compliance with data protection regulations to reduce the risks associated with compromised information integrity. To this end, the following hypothesis is proposed:

Freedman (2012) reviewed the boundaries of collegiality by examining what collegiality means in the context of organisational settings and considered the contradictory and opposing sides of collegiality. Collegial decision-making has been important because of the joint decisions that are to be made regarding resource allocation and support from senior executives or supervisors towards ensuring that organisational goals are met. Supportive leadership and cooperative decision-making are the main drives of collegiality in organisations (Sharpe et al. 1997). Bissett and Saunders (2015) argue that collegiality results from managers and supervisors taking an active role at work and being dedicated to creating a friendly environment that promotes growth, productivity and employee development. To this end, the following hypothesis is proposed:

It is important to understand how job characteristics might influence employee behaviour and workarounds, partly because employees are now faced with an ever-growing reliance on technology and the always-changing information security threat landscape. Task relevance and skill variety, because of the changing technology requirements for tasks, are important job characteristics that have been observed to affect motivation to carry out workarounds (D’Arcy et al. 2009).

Employees may turn to solutions outside of their area of expertise when they feel underutilised or lack a variety of skills (Alter 2014), which could lead to unintentional information security vulnerabilities (Woltjer 2017). As proposed by Huang et al. (2016), organisations should concentrate on neutralising and resolving fundamental job characteristics concerns that would likely lead to workarounds to lessen the negative impact on information security integrity. To this end, the following hypothesis is proposed:

The rationale for selecting a positivist and objective approach was for the researchers to be able to determine the causal relationship between constructs derived from the literature review: information security integrity as the dependent variable with workaround. The causal relationship between the independent variables, self-efficacy, individuality, collegiality, information processing capability and job characteristics with workaround was also considered. This called for drawing inferences of these relationships using the deductive approach, beginning with hypotheses development and leading towards the testing of these hypotheses. To this end, an online web-based survey was administered to 207 participants, using online platforms such as LinkedIn and Facebook, targeting participants aged between 18 years and 65 years who resided in Gauteng, South Africa. A purposeful, non-probability sampling strategy was used, with the size determined using Equation 1 provided by Raosoft (2004) as follows: x=Z(c/100)2r(100−r)n=Nx/((N−1)E2+x)E=Sqrt[(N−n)x/n(N−1)][Eqn 1]

Raosoft (2004) designed a web-based, scientific sample size calculator that embeds the above formula, which the researchers applied to determine the optimal sample of 212. The researchers used this recommendation in conjunction with defining the possible number of potential Information Technology professionals in the Gauteng province who met the criteria of the research as 1500 (N). Dada et al. (2022) estimated that at least 3355 Information Technology jobs were published by LinkedIn, suggesting that 46.7% (or 1543.4) of these were domiciled in Gauteng. We, therefore, used N as 1500 active LinkedIn and Facebook (assuming the same participants used both platforms) IT professionals to be targeted. We applied a 5% margin of error, with a 95% confidence level, and a low response distribution of 20%, resulting in a recommended size of 212. The researchers managed to get 207 participants who completed the web-based survey.

A study’s most important component is gathering data, and there are several ways to do it based on the resources available, the financial implications and the time the researcher must complete (Kothari 2004). With Internet usage proliferating in Gauteng, it would be possible to target these groups of IT professionals using web-based surveys, saving on time and costs and, importantly, uploading data into software for analysis. Web-based surveys have their own benefits, like low costs, quick data gathering and design flexibility (Lawrence Neuman 2014). A Likert scale of five points was used to structure the closed-ended questions on the web-based survey, which was then separated into each of the three sections:

Participants who required ethical protection were filtered out using the first two screening questions. A pilot study was carried out using preliminary data from 20 participants to assess the validity of the research instrument and guarantee that bias or impact is minimised.

The collected data were analysed using SPSS (Statistical Package of Social Sciences, version 24). A total number of 207 participant data points was analysed after missing and filtered out data. Participants who did not reply were removed from the study. The initial round of online inquiries aimed to gather demographic information about the participants.

Research ethics was a key consideration while developing the data collection instrument, deciding on the approach to use in the research process and, importantly, analysing data. The ethical principles guided the participants’ rights in providing data and how data were to be used once collected. The research was granted ethical clearance by the University of Johannesburg and issued with the reference number 2023AIS012.

All participants were required to give their informed consent to participate; the consent included the following:

Most of the participants in the sample had over 30 years of IT experience in various IT roles. The distribution of the duration of service suggests that there is a significant presence of experienced IT participants, which suggests a mature workforce. This distribution is as follows: those working for less than 10 years were 20.8%, those working for more than 10 years to 20 years were 15.5%, those working for more than 20 years to 30 years were 28.5%, while those working for more than 30 years were 33.3%. The results are provided in Table 2.

Statistical Package of Social Sciences derived a graphical representation of the role the IT participants played in various industries across Gauteng, South Africa. The shape and size of the various data points for the role in the industry suggest that many of the participants worked in positions that were not generally defined. This is because of the nature of the technological advancements in the field pointing to emerging new roles, particularly in the fields of retail, pharmaceuticals, healthcare and human resources. Most participants with clearly defined roles were technicians who worked in the engineering sector. There were legal practitioners who played a role both in IT and in the legal profession (e.g., forensic experts, eDiscovery specialists, cybersecurity experts and legal IT support) who also participated in the research. These professionals also constituted an averagely higher sample size. The study also sampled a few IT and telecommunication industry chief information officers. The results are provided in Figure 1.

Research results may at times be skewed, and this may lead to interpretation errors. One way of addressing this concern is to carry out a common method variance (CMV) test as suggested by Craighead et al. (2011). To see whether CMV was going to be a concern before further analysis was to be carried out. An exploratory factor analysis (EFA) was carried out to see whether there would be any single factor that would account for a substantial portion (more than 50%) of the total variance. Using SPSS EFA generated the total variance explained table shown by Table 3.

Statistical Package of Social Sciences results of the EFA using principal component analysis (PCA) reveal that the first component explained 24.109% of the total variance, followed by the second component explaining 17.476% resulting in a cumulative 41.586% across two components. This falls short of the rule-of-thumb threshold of 50% for one component, and that common method bias would not be a concern for this study. The extraction of the 23 other factors indicates that the variance is distributed across multiple factors, suggesting that further data analysis was possible.

The degree to which a quantitative analysis test accurately measures a concept is known as validity, while reliability considers the consistency of any conclusions made by the researcher (Street & Ward 2012). The test of sampling adequacy performed by SPSS using Kaiser–Mayer–Olkin’s (KMO) measure showed that the KMO was 0.828, with the degree of freedom being 253, significant at < 0.001, confirming that factor analysis would be a good method to reduce underlying variables in the model. Table 4 provides KMO results.

To determine how well the factor items (10 questionnaire items) were related to each other and to assess the consistency of the responses to these questions, a reliability analysis that applied Cronbach alpha was matched to the 10 related items.

This Table 5 shows that items that did not load into their components were removed and not included for further analysis. The Cronbach’s alpha values were greater than 0.5 are deemed appropriate in information systems research (Street & Ward 2012).

A correlation test was carried out to determine whether there was any association between variables. This was a quick check to see whether further analysis in regression was worthwhile. The results are shown in Table 6.

Table 6 shows association, suggesting a further need to conduct a regression to present, examine and explain the model. The results show that the correlations were not high (close to 1 or –1), suggesting that multicollinearity would not be a major concern.

The hypotheses to be included in the model were tested using multiple linear regression analysis. This was done to test and determine whether there was an existing relationship between independent variables and the dependent variable, information security integrity (as well as workaround behaviour). Table 7 displays the regression analysis’s findings.

The results liner regression results for H1 indicated that the model significantly predicted the variable Information Security Integrity, (p < 0.001). It was observed that the predictor variable Workaround had a significant positive effect on Information Security integrity (β = 0.340, t = 5.165, p < 0.001). A multiple liner regression was done to test whether the other variables would predict workaround. The results are presented by Table 8.

The results of the multiple liner regression analysis also show that the model significantly predicted Workaround. Several predictors contribute to this, specifically Job Characteristics (β = 0.315, t = 4.464, p < 0.001) and Individuality (β = 0.208, t = 2.867, p = 0.005), which show a positive relationship with Workaround. However, it was observed that Self-efficacy (β = –0.150, t = –1.845, p = 0.067), Information Processing Capability (β = –0.114, t = –1.473, p = 0.142) and Collegiality (β = –0.078, t = –1.091, p = 0.276) did not significantly predict workaround.

Findings of the six hypotheses that were tested suggest that self-efficacy, collegiality and information processing capability are not crucial predictors to workarounds. This can be explained as follows: In the first instance, many organisations are observed to have started training their employees on information security risks that their employees expose their organisations when the employees bypass policies as temporary ‘fixes’, but in doing so compromise the integrity of information systems. However, because of the individual characteristics of skilled employees, as well as the nature and characteristics of the work they do, chances of experiencing workarounds from those employees remains high. The testing summary results are illustrated in Table 9.

Workarounds behaviour significantly affects information security integrity, and it remains crucial for management to be aware that this happens. Practitioners can handle information integrity risks necessitated by workarounds through effectively learning, improving user experience and developing a security-conscious culture. This research has brought this understanding to the fore, pointing out that workarounds create vulnerabilities that are potential entry points for those with nefarious intent to exploit. In practice, the existence of the policies is not enough to deter employees’ intent on workarounds; however, cultural change and raising awareness would be important starting points. Management may suggest that employees engage in transparency and truthfulness and uphold proper work ethics as they carry out their duties, lessening the need for workarounds.

While the goal of any research is to address a research issue or problem, this research study points to a crucial concern regarding how workarounds affect information security integrity. Although there is a dearth of work that points to workarounds being a concern, this research adds to the body of knowledge already available in the field of information security but addresses integrity concerns, particularly in the context of the Gauteng province, South Africa. Although the study was carried out in the Gauteng province, which can be a limitation regarding generalisability, the study is grounded in a strong theoretical framework that is applicable across broader contexts. By examining workarounds under this context, the study may assist those interested in the field in understanding how information security vulnerabilities occur. Organisations can, therefore, take the necessary steps, equipped with these insights, to establish training programs.

This research study lays a groundwork for future research and decision-making with insights into the dynamic around workarounds. In our study, we found that ‘collegiality’ did not significantly predict workaround behaviour. This may require further exploration as to why this is so for future research. The research findings provide a standard by which monitoring workaround behaviour can be established. While the work took a quantitative and objective approach, it fell short of new discoveries by asking participants to discuss their lived experiences. Qualitative research would, therefore, provide richer aspects of these lived experiences. Future research should employ qualitative techniques to elicit these insights.