Cybersecurity Awareness, Policy Compliance, and Financial Data Protection in Accounting Information Systems: Evidence from Somali Financial Institutions

Technical Summary: Cybersecurity Awareness, Policy Compliance, and Financial Data Protection in Accounting Information Systems

Problem Statement
Financial data protection has evolved from a purely technical challenge into a core accounting problem. Accounting Information Systems (AIS) are no longer isolated record-keeping tools but are deeply integrated with payment channels, customer databases, and audit trails. Consequently, the integrity of financial records depends not only on technical controls but on the daily behavioral conduct of employees who process, approve, and reconcile data. While recent literature connects cybersecurity to internal controls and audit governance, there is a lack of empirical evidence regarding the specific employee-level control behaviors that precede breaches. This is particularly critical in developing financial environments, such as Somalia, where institutions rely heavily on human adherence to procedures due to evolving regulatory frameworks and rapid digitalization. The study addresses the gap in understanding whether cybersecurity awareness and policy compliance function as effective behavioral internal controls within AIS.

Methodology
The study employs a quantitative, cross-sectional survey design targeting 415 permanent employees across Somali banking and financial institutions, including Islamic banks, conventional banks, mobile money providers, and microfinance institutions. The sample encompasses diverse roles (operations, accounting, ICT, compliance, audit) to capture the full spectrum of the accounting information-processing chain.

• Data Collection: A self-administered paper questionnaire was distributed between February and March 2025 to ensure anonymity and reduce social-desirability bias.
• Constructs:
  • Independent Variables: Five dimensions of cybersecurity awareness and behavior: General Cybersecurity Awareness, Password Security Practices, Phishing Awareness, Device Security Practices, and Policy Compliance.
  • Dependent Variable: Financial Data Protection, defined as employee-reported behavior and perceived control discipline regarding the safeguarding of financial and customer information (confidentiality, integrity, and auditability).
• Analysis: Data were analyzed using Python. The study utilized Pearson correlation analysis to examine bivariate relationships and multiple linear regression to test the independent predictive power of each awareness dimension on financial data protection. Diagnostic tests (VIF, Shapiro-Wilk, Breusch-Pagan, Durbin-Watson) confirmed the model's validity, with no significant multicollinearity or assumption violations.

Key Results
The analysis reveals a moderate positive association between overall cybersecurity awareness and financial data protection ($r = 0.447, p < 0.001$). However, the multivariable regression model ($R^2 = 0.287$) indicates that not all awareness dimensions contribute equally when considered simultaneously:

1. Significant Predictors:
   • General Cybersecurity Awareness: Remains a significant positive predictor ($\beta = 0.287, p < 0.001$).
   • Policy Compliance: Emerges as the strongest predictor in the model ($\beta = 0.335, p < 0.001$).
2. Non-Significant Predictors (Adjusted):
   • Password Security Practices, Phishing Awareness, and Device Security Practices: While these showed positive correlations in bivariate analysis, they lost statistical significance in the adjusted regression model.

The results suggest that specific technical habits (passwords, phishing detection, device handling) do not independently predict financial data protection once broader risk understanding and formal rule-following behavior are accounted for.

Key Contributions
The paper makes three specific contributions to accounting research:

1. Reframing Cybersecurity: It positions cybersecurity awareness not merely as a technical training issue but as a behavioral component of the AIS control environment.
2. Employee-Level Evidence: It provides empirical evidence linking employee conduct directly to financial data protection, a control outcome situated between system security and accounting information reliability.
3. Role of Compliance: It identifies policy compliance as the strongest driver of data protection, supporting the view that cyber knowledge is most effective when translated into formal rules, routines, and accountability mechanisms within the internal control system.

Significance and Claims
The study concludes that financial data protection in AIS is secured less by isolated security habits and more by a broad understanding of cyber risks and consistent adherence to formal policies. The authors argue that for financial institutions, particularly in resource-constrained settings, cybersecurity compliance should be treated as a behavioral internal-control mechanism rather than a peripheral IT concern.

The paper modestly acknowledges its limitations: the cross-sectional design precludes causal inference, the reliance on self-reported data introduces potential bias, and the model explains only 28.7% of the variance, indicating that technical and governance factors outside the scope of employee behavior also play significant roles. The authors do not claim to measure actual breach reduction but rather the behavioral precursors to a robust control environment.