Prompted by the weaknesses of standardized risk-management approaches in the aftermath of the 2008 financial crisis, scholars, regulators, and practitioners alike emphasize the importance of creating a risk-aware culture in organizations. Recent insights highlight the special role of tone from the top as a crucial driver of risk awareness. In this study, we take a systems perspective on control system design to investigate the role of tone from the top in creating risk awareness. In particular, we argue that both the interactive and the diagnostic use of budgets and performance measures interact with tone from the top in managing risk awareness. Our results show that interactive control strengthens the effect of tone from the top on risk awareness, whereas tone from the top and diagnostic control are empirically not interrelated with regard to creating risk awareness. To shed light on the boundary conditions of the proposed interdependencies, we further investigate whether the predicted interdependencies are sensitive to the level of perceived environmental uncertainty. We find that the effect of tone from the top and interactive control becomes significantly stronger in a situation of high perceived environmental uncertainty. Most interestingly, tone from the top and diagnostic control are complements with regard to risk awareness in settings of low perceived environmental uncertainty and substitutes at high levels of perceived environmental uncertainty.

Approaches to risk governance are not homogeneous across organizations. Some organizations invest heavily in building formal and strategically focused enterprise-wide risk governance processes whereas others exhibit reduced formality and focus, allowing risk governance to be less structured. We argue that risk governance may best be described as a service dependent upon a network (or ecosystem) of participants who include users of risk information and providers who design and implement risk governance processes. Using a survey sample of 2,380 observations from 2011 to 2016, we find that external calls for enhanced risk governance are positively associated with risk governance processes having greater formality and strategic focus. We find this relationship is partially mediated by internal demands for enhanced risk governance. Further, we find that the positive association between internal demands and enhanced risk governance is reduced by resource constraints and that a risk-seeking attitude is negatively associated with enhanced risk governance. Data Availability: Contact the authors.