Information Security Governance model to enhance zakat information management in Malaysian Zakat Institutions

Information Security Governance model to enhance zakat information management in Malaysian Zakat Institutions Hidayah Sulaiman Information Systems Department, College of Information Technology Universiti Tenaga Nasional (UNITEN) Selangor, Malaysia hidayah@uniten.edu.my Norziana Jamil Systems & Networking Department College of Information Technology Universiti Tenaga Nasional (UNITEN) Selangor, Malaysia Norziana@uniten.edu.my Abstract Zakat or better known as almsgiving is one of the major Islamic principles which is obligated to qualified Muslims. The almsgiving principle aims to assist the needy and eliminate poverty in the society whilst promoting the elimination of greed and selfishness among the Muslim community. The government also holds the responsibility of creating a zakat institution to ensure effective management of the zakat distribution and management. However, due to the growing number of working Muslims and various sources of zakat providers to be managed, this creates an overwhelming amount of information to be carefully managed by the zakat institution and its appointed zakat fund trustee. There exist and information gap when the public demands the zakat institutions to have better transparency in the distribution of zakat especially when various issues are identified with the validity of the zakat information. Hence, there is a need for the zakat institution to have better information security mechanism between the zakat institution and the zakat fund trustee offices. This study proposes an information security governance model for the management of zakat information by testing the correlation between human behavior traits and security governance mechanism with goal congruence and reduction of information. The proposed model also aims to provide the zakat institution with a more structured processes of managing the security of the information in order to provide better reporting transparency, making well-informed decisions and instill better trust from the Islamic community with regard to better zakat management and distribution. Keywords zakat; trustee; security; governance; goal congruence; information I. INTRODUCTION There are five primary obligations of a Muslim or better known as the pillars of faith, that each Muslim must fulfill in their lifetime. Zakat or almsgiving being one of the five pillars of Islam, is considered as a social responsibility of one's service to God. Zakat is the payment from a prescribed proportion of a qualified Muslim's income or possessions for the welfare of the community particularly the neediest members of the Muslim community. In order to have an organized distribution and management of zakat, the zakat institution has to be established within the Muslim society appointed by the Government under the advice of the Muslim Shariah council of the country [39]. The roles if these institution does not only revolve around collecting zakat but also managing and distributing to the needy. There are various sources from which the zakat can be collected such as the individuals, corporate organizations and private business owners. With the advent of emerging technologies and trends, zakat collection can be made easy with individual online payment, automated salary reduction and online banking transfer between corporate organizations to the zakat institution. Due to the increasing amount of zakat collection from various sources, there is an overwhelming amount of information to be managed and secured by the zakat institution. The zakat institution holds the responsibility of managing these collection and pressured by the community to hold the highest level of transparency in managing the distributions. Some of the efforts carried out by the zakat institution to better manage the zakat distribution is to appoint special assistance unit as trustee within an organization for the collection, management and distribution of zakat. Such effort has been carried out by the Malaysian zakat institution in appointing various trustees or better known as Zakat Fund Trustees across higher education throughout Malaysia. The goal of the Zakat Fund Trustee is to provide alternative financial resources to help students who are eligible and included in the zakat recipients to receive assistance for their studies. This is seen as a great effort in assisting local neediest community of the higher education institution (HEI) to seek help with financial assistance. However, with the numerous zakat fund trustees appointed the zakat institutions is still bombarded with the continuous transparency issues and further questioned with the security of the information shared between the payers to the trustee and the trustee to the zakat institution. Various research have indicated that information security is a critical factor for successful organizations [23],[41],[48] and information security governance is an important issue to address that requires the commitment of the entire organization s workforce to uphold their responsibility in protecting the organization s valuable information assets [40],[2],[4]. Given the increasing challenges of information security, it is critical that the zakat institution implements a reliable information security governance framework which acts as a key strategy to control and safeguard zakat information. The information security governance efforts are imperative to 205

support critical business processes, mitigate risk, proper accountability, making informed decisions and improve the zakat institutions business process. II. LITERATURE REVIEW There are two main categories of zakat which are zakat al- Fitr and zakat of wealth. The Zakat al-fitr is paid once by Muslims every year during the fasting month of Ramadhan. The main category of zakat is known as the zakat of wealth is further sub-categorized into zakat of business, zakat of savings, zakat of income, zakat of gold, and zakat of investment just to name a few. Malaysia being one of the country with the largest number of working Muslims, the zakat of income and business are the main sources of zakat to be carefully managed by the zakat institution. As stated in the Quran there are eight groups of qualified people who should receive the zakat. They are whom identified as the needy, the poor, the appointed collector of zakat or better known as amil, the new Muslim converts, people in debt, people who are in the state of Allah s cause (fisabilillah), the slave, and the traveler without a home (Ibn as- Sabil) [5]. These recipients of zakat as its further clarification through the Sharia law and shall not be taken literally on how it is defined. The officers of zakat institutions are trained by Islamic scholars to recognize and identify qualified zakat recipients based on the stated Islamic guideline. Nevertheless, the difficulty with the zakat distribution to the qualified and unqualified zakat recipients still poses a problem with poverty which continuously happen even though zakat distribution has been implemented. Research indicate that some zakat institutions reported on shortage of zakat fund whereas some having surplus which requires the need of a more effective distribution management and strategy [29],[1],[25]. The Malaysian government has taken the effort to privatize the zakat institution in order to enhance the awareness of zakat payment and provide a better platform between the payers and the amil as well as the amil and the zakat recipients to communicate. These privatization then leads to the initiatives by the local zakat institutions of appointing trustee zakat funds within organizations such as the HEI to better manage the distribution of zakat within their designated context [26],[27]. However, many studies have indicated that zakat payers are not satisfied with the management of zakat especially in terms of the distribution to qualified or unqualified zakat recipients [29], [37],[15],[16],[25]. In order to provide a better transparency and management of zakat, it is imperative for the Zakat institutions to know every aspect of the management and distribution of zakat from the Zakat fund trustees under their appointment. The information provided to the zakat authorities and government has to be transparent and secured without any malicious threats of fabrication or falsifications of data to justify the unused or unjustified utilization of zakat funds. The protection of information can be achieved only through effective management on oversight, and accountability of information security which is also known as information security governance. Information security governance is seen as an effective strategy to organizations namely in justifying employee s lawful conduct [40],[33]. The information security governance is also important as an awareness program to the employees as zakat institution personnel are often unaware of the appropriate security policies and standards to comply. Hence, the information security governance provides a predominant strategic solution to the zakat institution in order to optimize and ensure security and integrity of key information on zakat distribution and management that are critical to be properly and ethically managed. With the implementation of a solid information security governance, this will enhance zakat recipient s benefits, increase the business performance and productivity of zakat institutions, and thus provide greater assurance to zakat payers on the transparency of zakat management. III. CONCEPTUAL MODEL Various literature have adopted the use of agency theory in relation to the study of corporate governance [28],[45],[43],[18],[12]. Agency theory involves the ubiquitous agency relationship, in which one party (the principal) delegates work to another (the agent), who performs that work [13]. The theory also focuses on resolving problems that may occur in agency relationship pertaining to goal alignment between principle and agent, as well as the occurrence of information between principle and agent. Hence, this theory is deemed suitable to be used for this study due to studying the relationship between the zakat institution and the zakat fund trustees namely in aligning the information security goals between the two entities as well as reducing the zakat information. Moreover, since most approaches to IT governance are grounded in agency theory [21],[22] the theoretical approach for this study will be developed from an agency theory perspective. The alignment of information security goals for this study will adopt the goal congruence element as reported in various studies on the relative importance of key performance criteria [31],[46], including the achievability of goals [19],[20]. With regard to information security governance, information is deemed to be reduced when there are monitoring activities of information security effectiveness through security assessments and IT audits to detect IT security vulnerabilities and gaps [9]. Results of the assessment can be used by the established governing committee appointed by the management to corroborate decisions on whether the existing security program is addressing all identified security risks. Hence, reduces information between IT and the employees. This research also attempts to find a correlation between three parameters of governing information systems in an organization also known as process-based, structural and relational [34],[35],[36],[12] with the information and goal congruence [48],[12][46],[24]. A study by Hedstrom et. al [17] argues that the traditional management of information security is informed by a controlbased compliance model, which assumes that human behavior needs to be controlled and regulated. However, the study then reveals that the value-based compliance model is more effective as compared with the control-based compliance model for implementing information security compliance in an organization. Myyry et al. [30] further elaborates this and found that values and moral reasoning result in better compliance to information security. Based on the study of Dhillon, Tejay, & Hong [11], the ethics, trust, integrity and authentic variables will be tested in this study on the 206

relationship with overall information security governance concept of goal congruence and information. These variables and the description are addressed in Table I: ICIMµ2014 TABLE I. HUMAN BEHAVIOR VARIABLES Variable Ethics Trust Integrity Description Existence of company code of ethics. Compliance with company code of ethics. Existence of standard ethical work practices. Compliance with standard ethical work practices. People responsible for the data are trustworthy. People responsible for data do not misrepresent. People responsible for data are not negligent. People with high integrity are recognized. People responsible for data are rewarded. People responsible for data comply with organizational norms. People responsible for data are loyal to the organization. Authentic People responsible for managing the data can be authenticated. People responsible for managing the data are accessible. People responsible for managing the data are bounded with regulations. In order to ensure that information security provides the maximum strategic benefit to the organization, it is therefore imperative to have an organizational culture that builds upon a foundation of core values of trust, integrity, and ethics. The process-based governance relates to the alignment of IT and organizational goals by providing an effective IT management techniques to ensure employee s daily behavior aligns with the organizational IT policies. These policies involves adherence to the requirements of information security in terms of dissemination and monitoring, security guidelines and procedures, risk control, and monitoring and tracking of IT performance in terms of service delivery and business benefit realization [35],[32],[8]. Structural governance describes the roles and responsibilities, IT organizational standards and management as well as the setting up of the governance steering committee structure in the organization [33]. This is imperative in order to address issues relating to IT and business goals alignment across different departments of the organization. Hence, it is essential to form a group of governing committees, councils, or task forces which can be of temporary or permanent in order to carry out the responsibilities of advising and making decisions on organization governance policy [35],[44],[3],[33]. Fig. 1 below illustrates the conceptual model for this study. Fig. 1. Zakat Information Security Governance Conceptual Model Relational governance mechanisms for information security would involve high level of trust, knowledge sharing and common goal settings to promote effective communication channels among the various stakeholders in the organization [10],[35],[33]. In order to have employees adhering to the security policies, the management has to play an important role in instituting and communicating the security governance practices clearly across different business entities. This would indicate support and portray the seriousness of the management in securing organization information assets. With better understanding across different business domains on the expectations and security requirements, this then leads to better standardization of every aspect of governance and security decision making [33]. Variable Process TABLE II. SECURITY GOVERNANCE MECHANISM Description Employee s awareness Knowledge of information security and security solutions Employee s behavior of security practices and motivation Level of compliance to the established information security policy requirements Structural Security accountability and responsibility Decision making initiatives to address or improve information security. Continuous security audit and assessment. Relational Establishment and reinforcement of security policies Acceptance, adoption, focus, and implementation of security measures to promote a proactive security culture. 207

Based on previous studies of corporate and IT governance pertaining to the outcome of the process, structural and relational governance mechanism, this study will also address the influencing factors relating to information security governance as described in Table II [34],[35],[36],[12],[33],[8]. IV. METHODOLOGY This study will explore the correlation between human attributes and governance mechanism with the attributes of goal congruence and information. The human attributes identified to be of importance to information security governance are ethics, integrity and trust, whereas the governance mechanism will look into the process, structure and relational parameters in order to ensure that information can be reduced and goal congruence can be enhanced. The relationship illustrated in the research conceptual model will be tested by employing confirmatory factor analysis (CFA) and structural equation modeling (SEM). The study will be testing twelve hypothesis as stated below: H1: Trust is positively related to goal congruence H2: Integrity is positively related to goal congruence H3: Ethics is positively related to goal congruence H4: Authentic is positively related to goal congruence H5: Process is positively related to goal congruence. H6: Relational is positively related to goal congruence H7: Structure is positively related to goal congruence. H8: Trust is positively related to information H9: Integrity is positively related to information H10: Ethics is positively related to information H11: Authentic is positively related to information H12: Process is positively related to information. H13: Relational is positively related to information H14: Structure is positively related to information Results of the analysis will be used to confirm or refute the theoretical understanding that enhancing goal congruence and reducing information through the human attributed and governing mechanisms in the context of information security can result in effective governance of information security. The research will first undergo a pilot study with subject matter expert interview in the area of information security and governance to validate the conceptual framework and survey instrument. Upon completion of the interview and subject matter expert s recommendations, the instrument will be refined and survey will be distributed across all higher education Zakat Trustee Fund employees and the main zakat institution corresponding departments governing the trustees. Results of the survey will be statistically analyzed for descriptive statistics and will go through the Confirmatory Fit Analysis (CFA) to test the validity of the constructs and model fit [42],[38],[6]. Finally, the model will be tested for validity using the Structured Equation Modeling (SEM) techniques. The SEM will also be used to analyze the relationships between latent variables and the corresponding fit of the data to a theoretically derived model [38],[7]. V. CONCLUSION The establishment of zakat institution by the government aims to ease the fulfilment of third pillar of the Islamic practices. With the overwhelming amount of information to be managed by the institution due to the increase of Malaysian Muslim workforce, there is a need to have a better management of the zakat distribution and management. The privatization of zakat institution and appointment of Zakat Trustee Funds within major corporations and organizations aims to provide better management to the zakat distribution. Nevertheless, these relentless effort still receive major criticism namely in the transparency of the information on the distribution of zakat to the qualified zakat recipients. There exist a gap between the information reported by the government that the zakat funds are well distributed to the needy however various local zakat fund trustee offices have been criticized with unjustified expenditure of the zakat fund, zakat distributed to unqualified recipients and surplus in the zakat collection when there are still qualified zakat recipients in the local community. In order to promote transparency, data that is stored in both trustee fund offices and the main zakat institution has to be consistent, verified and trustworthy. The information has to be secured in order to avoid fabrication and falsification of data. Hence, there is a need to establish an information security governance between the zakat institution and the zakat fund trustees in order to have precise information to be used for better decision making and zakat management. This study has identified 7 contributing factors to the information security governance goal alignment and information reduction. These factors include the human attribute variables and governance mechanism which will be tested by conducting a survey. Statistical data from the survey will be used to test the validity of constructs and model fit through the Confirmatory Fit Analysis (CFA) and the model will also be tested for validity using Structured Equation Modeling (SEM). It is anticipated that this study will result in the positive correlation between all variables in order to prove that these variables could enhance goal congruence and reduce information between the main zakat institution with the appointed zakat fund trustee in the context of information security thus promote effective governance of information security. 208

REFERENCES [1] Abdullah Ibrahim 1999, Agihan zakat menurut prinsip siasah shariyyah, Proceedings of Kolokium Keberkesanan Zakat Negeri Selangor. [2] Abu-Musa, A. (2010). Information security governance in Saudi organizations: an empirical study. Information Management & Computer Security, 18(4), 226-276. [3] Alves, Carlos R. C.; Riekstin, Ana C.; Carvalho, Tereza C. M. B.; and Vidal, Antonio G. R., "IT governance frameworks: A literature review of Brazilian publications" (2013). CONF-IRM 2013 Proceedings. Paper 34.http://aisel.aisnet.org/confirm2013/34 [4] Awwad, M. S., & Omoush, K. S. A. (2012). Governance of information technology business relationship quality and performance outcomes. Electronic Government, an International Journal, 9(4), 350-369 [5] Bakar, M. A., & Ghani, A. A. (2011). Towards achieving the quality of life in the management of zakat distribution to the rightful recipients (the poor and needy). International Journal of Business and Social Science, 2(4), 237-245. [6] Brown, T. A. (2012). Confirmatory factor analysis for applied research. Guilford Press. [7] Byrne, B. M. (2013). Structural equation modeling with AMOS: Basic concepts, applications, and programming. Routledge. [8] Clohessy, T., Morgan, L., & Acton, T. (2014). An exploratory study into it governance implementations in living laboratory ecosystems and their impact on open innovation effectiveness. Proceedings of the European Conference on Information Systems (ECIS) 2014, Tel Aviv, Israel, June 9-11, 2014, ISBN 978-0-9915567-0-0. [9] Cormier, D., Ledoux, M. J., Magnan, M., & Aerts, W. (2010). Corporate governance and information between managers and investors.corporate Governance, 10(5), 574-589 [10] De Haes, S., & Van Grembergen, W. (2004). IT governance and its mechanisms. Information Systems Control Journal, 1, 27-33. [11] Dhillon, G., Tejay, G., & Hong, W. (2007, January). Identifying governance dimensions to evaluation information systems security in organizations. Paper presented to the Proceedings of the 40th Annual Hawaii International Conference on System Sciences. IEEE, 157b. [12] Edwards, CK. (2014). A Framework for the Governance of Information Security, PhD Dissertation, Graduate School of Computer and Information Sciences, Nova Southeastern University, UMI 3607548, Proquest Information and Learning [13] Eisenhardt, K. M. (1989). Agency theory: An assessment and review. Academy of management review, 14(1), 57-74. [14] Frey, T. (2014). IT governance Structures, processes, and relationships in IT decision-making. In Governance Arrangements for IT Project Portfolio Management (pp. 7-34). Springer Fachmedien Wiesbaden. [15] Hairunnizam Wahid & Radiah Abdul Kader 2010, Localization of Malaysian zakat distribution: perception of amil and zakat recipients, Proceedings of Seventh International Conference The Tawhidi Epistemology: Zakat and Waqf Economy. [16] Hairunnizam Wahid, Sanep Ahmad & Radiah Abdul Kader 2008, Pengagihan zakat oleh institusi zakat di Malaysia: mengapa masyarakat Islam tidak berpuas hati, Proceedings of Seminar Kebangsaan Ekonomi Malaysia 2008. [17] Hedstrom, K., Kolkowska, E., Karlsson, F., & Allen, J. P. (2011). Value conflicts for information security management. Journal of Strategic Information Systems, 20(4), 373 384. [18] Ilsever, J., & Leung, R. (2013, November). Review of Evidence between Corporate Governance and Mandatory IFRS Adoption from the Perspective of Agency Theory and Information Symmetry. In KNOWLEDGE GLOBALIZATION CONFERENCE (p. 157). [19] Jap, S. D. (1999). Pie-expansion efforts: Collaboration processes in buyer-supplier relationships. Journal of Marketing Research, 36(4), 461-475. [20] Jap, S. D., & Anderson, E. (2003). Safeguarding inter-organizational performance and continuity under ex post opportunism. Management Science, 49(12), 1684-1701. [21] Jensen, M., & Meckling, W. (1976). Theory of the firm: Managerial behavior, agency costs and ownership structure. Journal of Financial Economics, 3(4), 305-360. [22] Jensen, M., & Meckling, W. (1994).The nature of man. Journal of Applied Corporate Finance, 7(2), 4-19. [23] Kankanhalli, A., Teo, H. H., Tan, B. C., & Wei, K. K. (2003). An integrative study of information systems security effectiveness. International journal of information management, 23(2), 139-154. [24] Kravets, J., & Zimmermann, K. (2012). Inter-organizational Information Alignment: A Conceptual Model of Structure and Governance for Cooperations. [25] Lubis, M., Yaacob, N. I., Omar, Y., Dahlan, A., & Rahman, A. (2011, April). Enhancement of zakat distribution management system: case study in Malaysia. In International Management Conference 2011 Proceedings (pp. 1-10). University Sultan Zainal Abidin. [26] LZS (2010), Uniten IPTS pertama dilantik ejen kutipan zakat LZS, Lembaga Zakat Selangor, http://www.e-zakat.com.my/terkini/unitenipts-pertama-dilantik-ejen-kutipan-zakat-lzs/ [27] LZS (2011), MMU meterai perjanjian sebagai ejen kutipan LZS, http://www.e-zakat.com.my/terkini/lzs-%e2%80%93-mmu-meteraiperjanjian-ejen-zakat-ipts-ke-2/ [28] McColgan, P. (2001). Agency theory and corporate governance: a review of the literature from a UK perspective. Department of Accounting and Finance Working Paper, 6, 0203 [29] Mohamed Dahan Abdul Latif 1998, Zakat management and administration in Malaysia, Proceedings of Seminar of Zakat and Taxation. [30] Myyry, Liisa.,Siponen, M., Pahnila, S., Vartiainen, T., & Vance, A. (2009). What levels of moral reasoning and values explain adherence to information security rules? An empirical study. European Journal of Information Systems, 18(2), 126 139. [31] Neely, A., & Wilson, J. (1992). Measuring product goal congruence: An exploratory case study. International Journal of Operations and Production Management, 12(4),45-52. [32] Novotny, A; Bernroider, E.; and Koch,S, "Dimensions and Operationalisations of IT Governance: A Literature Review and Meta- Case Study" (2012). CONF-IRM 2012 Proceedings. Paper 23. http://aisel.aisnet.org/confirm2012/23 [33] Patnayakuni, R., & Patnayakuni, N. (2014). Information Security in Value Chains: A Governance Perspective. Twentieth Americas Conference on Information Systems, Savannah [34] Peterson, R. R. (2003). Information strategies and tactics for information technology governance. W. Van Grembergen (Ed.). Strategies for Information Technology Governance. Hershey, PA: Idea Group Publishing. [35] Peterson, R. R. (2004). Crafting information technology governance. Information Systems Management, 21(4), 7-22. [36] Peterson, R. R., O Callaghan, R., & Ribbers, P. M. A. (2000, December). Information technology governance by design: Investigating hybrid configurations and integration mechanisms. Proceedings of the 20th International Conference on Information Systems (435-452). Association for Information Systems, Brisbane, Australia. [37] Sanep Ahmad, Hairunnizam Wahid & Adnan Mohamad 2006, Penswastaan institusi zakat dan kesannya terhadap pembayaran secara formal di Malaysia, International Journal of Management Studies, Vol. 13, No. 2, pp. 175-196. [38] Schmitt, T. A. (2011). Current methodological considerations in exploratory and confirmatory factor analysis. Journal of Psychoeducational Assessment, 29(4), 304-321. [39] Shawal Kaslam 2009, The advancement of e-zakat for delivering better quality service and enhancing governance sphere of zakat institution in Malaysia, Proceedings of World Zakat Forum [40] Swindle, O., & Conner, B. (2004). The link between information security and corporate governance. Retrieved September 8, 2011, from http://www.computerworld.com/securitytopics/security/story/0,10801, 92915,00.html>. [41] Torres, J. M., Sarriegi, J. M., Santos, J., & Serrano, N. (2006). Managing information systems security: critical success factors and indicators to 209

measure effectiveness. In Information Security (pp. 530-545). Springer Berlin Heidelberg. [42] Ulrich, J. W. (2009). Test of a structural model to investigate the impact of instructor knowledge, attitudes, and contextual constraints on intent to use web 2.0 in online courses. Doctoral Dissertation,Western Carolina University, Cullowhee, NC. [43] Van Puyvelde, S., Caers, R., Du Bois, C., & Jegers, M. (2012). The governance of nonprofit organizations integrating agency theory with stakeholder and stewardship theories. Nonprofit and Voluntary Sector Quarterly, 41(3), 431-451. [44] Weill, P., & Ross, J. W. (2004). IT governance: How top performers manage IT decision rights for superior results. Boston, MA: Harvard Business School Press. [45] Westphal, J. D., & Zajac, E. J. (2013). A behavioral theory of corporate governance: Explicating the mechanisms of socially situated and socially constituted agency. The Academy of Management Annals, 7(1), 607-661. [46] Whipple, J. M., & Roh, J. (2010). Agency theory and quality fade in buyer-supplier relationships. International Journal of Logistics Management, The, 21(3), 338-352 [47] Wickramasinghe, N., & Ginzberg, M. J. (2001). Integrating knowledge workers and the organization: The role of IT. International Journal of Health Care Quality Assurance, 14(6), 245-253. [48] Wu, Y. (2007). Effects of IT governance on information security. Published Doctoral Thesis. Department of Management Information Systems in the College of Business Administration at the University of Central Florida, Orlando, Florida. UMI Number: 3377838, Proquest Information and Learning. 8-148 Yang, T. M., & Maxwell, T. A. (2011). Information-sharing in public organizations: A literature review of interpersonal, intra-organizational and inter-organizational success factors. Government Information Quarterly, 28(2), 164-175 210