In this study, I investigate how firms design risk-focused control practices to embed risk considerations in employee decision making. The firm’s objective is to make sure that employee behavior is aligned with firm risk appetite. To investigate how firms go about this control problem, I consider the use of risk-focused results controls (i.e., expanding results controls by risk aspects). Despite the advantages of jointly managing risk and performance through risk-focused results controls, prior literature indicates that their isolated use has also some drawbacks. Recent research hints at the crucial role of risk culture in this regard. In a next step, I present risk-focused information sharing as tangible and manageable dimension of risk culture that alleviates the weaknesses of risk-focused results controls while leaving the benefits of the latter intact. I also posit that risk-focused results controls make risk-focused information sharing more effective. Drawing on complementarity theory, I argue theoretically and show empirically that there is a complementarity between risk-focused results controls and risk-focused information sharing irrespective of the level of risk appetite a firm displays. Furthermore, I identify firm risk appetite as a system-specific contextual variable that drives the degree of complementarity between the two risk-focused control practices. Consistent with my prediction, the results indicate that the complementarity between risk-focused results controls and risk-focused information sharing is significantly stronger for firms displaying a high level of risk appetite. Using data from a survey of 202 companies, I find empirical support for my hypotheses.

Prompted by the weaknesses of standardized risk-management approaches in the aftermath of the 2008 financial crisis, scholars, regulators, and practitioners alike emphasize the importance of creating a risk-aware culture in organizations. Recent insights highlight the special role of tone from the top as a crucial driver of risk awareness. In this study, we take a systems perspective on control system design to investigate the role of tone from the top in creating risk awareness. In particular, we argue that both the interactive and the diagnostic use of budgets and performance measures interact with tone from the top in managing risk awareness. Our results show that interactive control strengthens the effect of tone from the top on risk awareness, whereas tone from the top and diagnostic control are empirically not interrelated with regard to creating risk awareness. To shed light on the boundary conditions of the proposed interdependencies, we further investigate whether the predicted interdependencies are sensitive to the level of perceived environmental uncertainty. We find that the effect of tone from the top and interactive control becomes significantly stronger in a situation of high perceived environmental uncertainty. Most interestingly, tone from the top and diagnostic control are complements with regard to risk awareness in settings of low perceived environmental uncertainty and substitutes at high levels of perceived environmental uncertainty.