Integrating risk into control system design: The complementarity between risk-focused results controls and risk-focused information sharing

In this study, I investigate how firms design risk-focused control practices to embed risk considerations in employee decision making. The firm's objective is to make sure that employee behavior is aligned with firm risk appetite. To investigate how firms go about this control problem, I consider the use of risk-focused results controls (i.e., expanding results controls by risk aspects). Despite the advantages of jointly managing risk and performance through risk-focused results controls, prior literature indicates that their isolated use has also some drawbacks. Recent research hints at the crucial role of risk culture in this regard. In a next step, I present risk-focused information sharing as tangible and manageable dimension of risk culture that alleviates the weaknesses of risk-focused results controls while leaving the benefits of the latter intact. I also posit that risk-focused results controls make risk-focused information sharing more effective. Drawing on complementarity theory, I argue theoretically and show empirically that there is a complementarity between risk-focused results controls and risk-focused information sharing irrespective of the level of risk appetite a firm displays. Furthermore, I identify firm risk appetite as a system-specific contextual variable that drives the degree of complementarity between the two risk-focused control practices. Consistent with my prediction, the results indicate that the complementarity between risk-focused results controls and risk-focused information sharing is significantly stronger for firms displaying a high level of risk appetite. Using data from a survey of 202 companies, I find empirical support for my hypotheses.