IA relates more to the business level and strategic risk management of information and related systems, rather than the creation and application of security controls.
Therefore, IA is best thought of as a superset of information security (i.e. umbrella term), and as the business outcome of Information Risk Management.
