Exploring risk culture controls: to what extent can the development of organizational risk culture be controlled and how?

Purpose This study aims to explore the controllability of risk culture, identify and categorize risk culture controls used in firms and explore how industry and ownership structure affect the use of different risk culture controls. Design/methodology/approach This explorative study is based on 32 semi-structured interviews with 37 participants who are heads of risk management or top managers in German firms from different industries with different ownership structures. Findings Interviewees perceive risk culture to be largely controllable. The authors identify a wide spectrum of risk culture controls, ranging from leadership and motivational controls to risk competence controls; in each category, the authors find value-, symbol- and clan-based controls. Leadership controls were most extensively discussed by the interviewees. The use of risk culture controls varied based on industry and ownership structure. Research limitations/implications Due to the explorative character of the approach, the authors cannot claim representativeness for the results. The study is limited to one point in time and to a German sample. The findings imply that companies should select risk culture controls according to their own context and that implementation requires support by the top and middle management. Originality/value The authors respond to the call for more organizational studies on risk management that consider cultural paradigms (Arena et al., 2010; Mikes, 2011; Power, 2009). The study systematically identifies risk culture controls used in corporate practice and categorizes them. It provides tentative evidence of the relevance of context-specific factors for the use of risk culture controls.