Hello, dear friend, you can consult us at any time if you have any questions, add WeChat: THEend8_
ABSTRACT: This study aims to enhance our understanding of the practice of risk management, and specifically how
corporate boards fulfill their responsibilities regarding risk oversight. We draw on a theoretical perspective centered
on (dis)comfort and 25 interviews with corporate board members and risk management consultants in Canada to
present a view of risk management as a set of activities characterized by tension between actions that engender the
feeling of discomfort, and a quest for comfort and reassurance. Our findings provide insights that show how,
alongside the functionalist underpinnings, comfort-seeking represents a pervasive imperative that profoundly shapes
risk management in action.
Keywords: risk management; boards of directors; consultants; corporate governance; comfort.
I. INTRODUCTION
R
isk management practices have sparked significant interest among accounting scholars in recent years (Spira and Page
2003; Power 2004; Hall, Mikes, and Millo 2015; Gendron, Brivot, and Gue´nin-Paracini 2016; Laguecir and Leca
2019; Tekathen 2019; Tekathen and Dechow 2020). This growing body of literature explores a variety of topics,
including how risk-mitigating technologies are institutionalized and framed in ways that promote their wider acceptance
(Brivot, Himick, and Martinez 2017; Hayne and Free 2014), and how they are translated into different contexts, depending on
an organization’s calculative culture (Mikes 2009, 2011) and prevailing risk attitudes (Arena, Arnaboldi, and Azzone 2010;
Arena, Arnaboldi, and Palermo 2017). Studies have shown, in this regard, how risk management systems may produce hybrid
practices that lead to new forms of manageability (Miller, Kurunma¨ki, and O’Leary 2008), result in conflicting approaches
competing for authority (Fischer and Ferlie 2013), or even generate unexpected effects such as increased uncertainty (Vinnari
and Skærbæk 2014). Other works have focused on particular risk management tools, such as a study by Jordan, Jørgensen, and
Mitterhofer (2013) of how heat maps may act as platforms for mediating diverse stakeholder interests (see also Jørgensen and
Jordan 2016). However, despite this growing literature, risk management practices in the context of corporate boards remain
scarcely explored, with scholars calling for more research to understand ‘‘the intervening processes and behaviors that boards
engage in to carry out their [risk management] duties’’ (Slagmulder 2017, 181). The present study aims to respond to this call
We thank board members, consultants, and other professionals who participated in the interviews for this study. We benefited from the comments made by
Steven E. Salterio (editor), two reviewers, participants at the 2018 Alternative Accounts Conference (HEC Montre´al), and by workshop participants at the
University of Tampere (Finland) and University of Turku (Finland). We gratefully acknowledge the financial support of the Social Sciences and
Humanities Research Council of Canada.
Yves Gendron, Universite´ Laval, Faculte´ des sciences de l’administration, E´cole de comptabilite´, Que´bec City, Canada; Anna Samsonova-Taddei, HEC
Montre´al, Department of Accounting, Montre´al, Canada; Henri Gue´nin, Universite´ Laval, Faculte´ des sciences de l’administration, E´cole de comptabilite´,
Que´bec City, Canada.
Editor’s note: Accepted by Steven E. Salterio.
Submitted: March 2018
Accepted: August 2020
Published Online: September 2020
1
by examining how risk management is experienced and performed within corporate boards and how boards accordingly fulfill
their responsibilities in relation to risk oversight.
Prior literature has placed a primary focus on the operationalization of risk management, often implicitly linking its
purpose to the logic of organizational efficiency and/or risk minimization and prevention (see also Woods and Linsley 2017).
Yet, as noted by Themsen and Skærbæk (2018), we fundamentally lack a more holistic understanding of what motivates
processes of identifying and incorporating risk into organizational risk management templates, and how meanings that develop
around risk management may extend beyond purely functionalist rationales (see also, Jordan, Mitterhofer, and Jørgensen
2018).1 In this respect, relevant studies of nursing, law, and auditing have recognized comfort and providing reassurance as
important cognitive referents that influence how these professional practices are carried out (Pentland 1993; Fareed 1994;
Carrington and Catasu´s 2007; Sarens, De Beelde, and Everaert 2009), especially when the outcomes of such practices are
ambiguous. Power (1997), for example, conceptualized auditing as a practice with uncertain outcomes—it may be years after
the issuance of an audit report that the public learns the audit was a failure. He further argued that much of the work
surrounding auditing centers on ensuring the appropriateness of processes aimed at controlling audit risk, since professions
whose outcomes are nebulous place a particularly strong emphasis on processes supporting professional work (Abbott 1988).
The audit literature has showed, in this regard, how auditors engage in ‘‘comfort production’’ (Pentland 1993) and rely on
comfort in deciding on the appropriateness of procedures for ascertaining the trustworthiness of company reports (Gue´nin-
Paracini, Malsch, and Marche´ Paille´ 2014).
Risk management, arguably, is characterized by a similar dynamic of uncertainty and comfort building. That risk can never be
brought to zero is a claim widely endorsed in the professional and academic literature on risk, with some authors even resorting to
the notion of the ‘‘risk of risk management’’ (Vinnari and Skærbæk 2014) to denote the ambiguities associated with the practice.
Given the uncertainty surrounding processes of identifying, monitoring, and controlling for significant risks, it is plausible that, in
their decision-making, actors such as corporate boards are guided by process criteria (as defined by risk management ‘‘best
practices’’) as well as whether or not they feel sufficiently comfortable with the appropriateness of the risk management systems
they oversee. Some recent studies point in this direction, such as Kewell and Linsley (2017, 20) who argue that comfort represents
‘‘important heuristics . . . [that are] allied to processes of risk decision-making.’’ In this paper, we are interested in understanding
the role these ‘‘comfort heuristics’’ play in shaping approaches to risk management in corporate boards. From this perspective,
comfort heuristics may be viewed as rules-of-thumb or shortcut strategies that organizational members gradually develop and
learn to use in decision-making under uncertainty (Bingham and Eisenhardt 2011; Furnari et al. 2020).2
Drawing on extant theoretical perspectives on (dis)comfort (Pezeu-Massabuau 2012) and the initial thoughts on the role of
comfort heuristics in risk management offered by Kewell and Linsley (2017), we conceptualize risk management as a set of
activities characterized by an ongoing tension between:
Actions that engender the feeling of discomfort as material risks to organizational objectives are identified, analyzed, and
reported; and
A quest for comfort and reassurance through the development of mitigating and monitoring measures to reduce and
maintain risk at an acceptable level.
The empirical materials for the study mainly comprise 25 interviews (Table 1) in Canada with corporate board directors
and corporate consultants. Consultants are often involved in corporate board and committee meetings (Sturdy 1997), and in
disseminating ‘‘state-of-the-art’’ risk management practices.
Our findings demonstrate how (dis)comfort is at the core of risk management in action. Alongside the functionalist
underpinnings, such as those that are resource- or agency-related, comfort-seeking represents a pervasive imperative that
profoundly shapes how risk management is practiced. First, we show how board members are inclined to rely on corporate
consultants, who take on the role of chief comfort-givers by supplying board members with risk management tools and ‘‘best
practices’’ designed to cultivate a sense of controllability and knowledgeability related to risk oversight. Second, comfort serves
as a sufficing reference, or ‘‘end-state’’ (Kewell and Linsley 2017, 20), in board deliberations and assessments of risk
management effectiveness. We also show that board member preoccupation with comfort (re)production leads them to see the
purpose of risk management tools mainly as a means to quickly (re)gain confidence in the seeming effectiveness of an
organization’s risk management. This, in turn, tends to result in the board members’ preference for more mechanistic
1 A meaningful analogy can be made with one of the first articles pointing to the various roles accounting may play in organizational life, namely
Burchell, Clubb, Hopwood, Hughes, and Nahapiet (1980).
2 The socio-organizational way in which we approach the notion of comfort heuristics is different from the notion of cognitive heuristics as
institutionalized in the areas of psychology (i.e., as simplified processes that result in systematic errors as compared to normative statistical models—
Waller 1995) and behavioral auditing studies (Solomon and Shields 1995). That being said, we recognize that the two notions share a number of
assumptions.