Informal control responses to information security policy violations: A factorial survey on insurance employees’ moral licensing of insider threats

• Informal controls help reduce non-malicious ISP violations and insider threats • Employees may tolerate ISP violations by high-status, competent, spotless colleagues • ISP violations aiding group success are more likely to be accepted • Stronger informal controls boost employees’ willingness to address violations • Aligning ISPs with goals, engaging valued staff, and training improve compliance Most organizations implement information security policies (ISPs) to protect their data and systems. However, these policies are only effective if employees follow them—including reporting or discouraging violations by others. Beyond formal control mechanisms, informal controls play a crucial role in shaping employees’ responses to ISP violations. These informal controls can either reduce security risks by discouraging misconduct or, conversely, reinforce insider threats by signaling approval of violations. Despite their importance, little is known about how informal controls develop and function. This study investigates key factors influencing employees’ informal control responses to non-malicious ISP violations, focusing on moral licensing—the tendency to permit rule-breaking based on a violator’s past behavior or status. Using a factorial survey of 1,024 insurance sector employees and analyzing 4,607 vignette-based observations through multilevel structural equation modeling, we find that employees are more likely to tolerate ISP violations when the violator has a history of compliance, possesses high task competence, holds a higher hierarchical status, or when the violation appears to benefit the team. By emphasizing the human factor in information security, this study reveals how cognitive biases in informal controls can weaken ISP compliance and increase insider threats. The findings provide actionable recommendations for security managers, including strategies to align ISPs with organizational goals, engage influential employees, and enhance security training. Strengthening informal controls can help create a more secure and compliant workplace.