Principles-based risk regulatory reforms and management control practices: a field study

Purpose - Government reforms have seen shifts from rules-based to principles-based risk regulatory governance. This paper examines the effects of principles-based risk regulatory reforms on public sector risk management (RM) and management control practices in public sector organizations (PSOs). Design/methodology/approach - The principles-based regulation focuses on providing autonomy to PSOs while maintaining control over their actions without direct intervention. This resonates with Foucault's notion of how modern forms of governments operate. The research is informed by Foucault's concept of governmentality. The authors conducted a qualitative field study of an Australian PSO, gathering and analysing data from interviews, focus groups, and archival documents. Findings - The findings show the capillary modes by which principles-based risk regulatory regime penetrates and works with management control practices in pursuit of regulatory goals within the PSO the authors studied. In addition, the authors find that the principles-based approach (focusing on autonomy) and rules-based approach (focusing on control) are not opposites in kind and effect but rather, autonomy should be understood as a central pillar of control. Furthermore, the findings show how cultural controls and formal controls are not in conflict but are interconnected in RM practices, with cultural controls providing control architecture for RM and formal control translating the control architecture into routines. Finally, the study provides insights into how enterprise risk management (ERM) provides capabilities for and routinizes RM practices in a PSO and the management control systems (MCS) that enabled this to occur. Originality/value - The paper provides novel insights into how MCS are infiltrated, mobilized and deployed to enact principles-based risk regulatory reforms. These insights are useful for regulators, practitioners and researchers.