Understanding the Role of Information Technology for Organizational Control Design: Risk Control as New Control Mechanism

Abstract

Abstract. Organizational control is one of the fundamental functions of management. Although controls come along with performance constraints, organizations rely on control mechanisms to direct attention, motivate, and encourage organizational members to act according to organizational goals and objectives. Managers build their decision on control design on the degree of knowledge about the value creation process and the predictability of the outcome. In this paper, we enhance a popular theoretical framework for organizational control design by enclosing IT-enabled controls. We explore the framework empirically in a multiple case study on Governance, Risk management, and Compliance information systems (GRC IS), a popular new trend in organizational control design. Our findings provide evidence that IT-enabled controls enable a new control mechanism, risk control, for situations with perfect knowledge about the transformation process and high ability to measure output. As research implication, we recommend an extension of organizational control theory to incorporate the effects of information technology on control design. As practical implication, we provide decision support for the selection of GRC controls, depending on situational factors and the expected value proposition. In sum, this research enhances the body of knowledge on organizational control design with a risk-based perspective.

Understanding governance, risk and compliance information systems (GRC IS): The experts view

“…As GRCs consist a newly developed area of enterprise systems our study is an attempt to gain a better insight of issues related to their implementation including areas currently missing in the existing literature. Our study is addressing previous gaps in the literature by looking at GRCs as systems involving the whole enterprise rather than focusing in one aspect such as accounting (Wiesche et al 2011). As the current literature on GRC systems, presented in Section 1 and summarized in Table 1, is primarily concerned with the technical/instrumental application of GRC systems this study is advancing the understanding of the true nature of these systems as well as their role in the organizational life.…”

“…This Operational Model (PricewaterhouseCoopers 2004) combined with the four core values as presented by Tapscott (2006) could develop essential tools for the GRC implementation process analysis. Wiesche et al (2011) present a GRC framework by linking GRC to Accounting Information Systems the result of which is the BFramework for GRC IS Value Drivers^. This framework (Wiesche et al 2011) is taking an isolated accounting perspective of GRC and not an enterprise-wide approach.…”

“…Wiesche et al (2011) present a GRC framework by linking GRC to Accounting Information Systems the result of which is the BFramework for GRC IS Value Drivers^. This framework (Wiesche et al 2011) is taking an isolated accounting perspective of GRC and not an enterprise-wide approach. Furthermore, Racz et al (2010b) translated the GRC definition to a BFrame of reference for GRC Researchŵ hich depicts the definition into a figure and is the basis for the research in the GRC field (Racz et al 2010b).…”