**5. Discussion**

Risk communication is essential to gain stakeholders' input on the risk management process and their ownership of the output [22]. Accordingly, the findings show that risk practitioners' communication and leadership practices are directed both towards business units and top management. ERM practitioners encourage and support communication about risks within the organisation without formally influencing decision-making [11]. As a result, business units can easily prevent or restrict risk practitioners' involvement in decision-making [57]. Therefore, risk practitioners emphasise creating value and building common ground for risk work, which they achieve through leadership practices and relationship management.

#### **5.1 Gaining and using power**

Risk practitioners emphasise unbiased discussions and respect other business units' competencies. This trust-building practice effectively addresses change resistance as it reframes change requests as less threatening [58]. Practitioners further reinforce trust-building by fostering dialogue with business units and management and building relationships through networking and connections.

These practices, aimed at building informal networks and increasing dialogue, overlap with the findings of studies conducted by Mikes and colleagues, as outlined in Kaplan and Mikes [11]. According to the authors, informal networks with executives and business managers help maintain a balance between keeping a sufficient distance to remain independent and staying involved in the business. The challenges mentioned by respondents elucidate this requirement. On the one hand, the ERM unit is perceived as an administrative burden responsible for controlling compliance with little relevance for decision-making. On the other hand, conflicting interests and change resistance by business units hinder the effective sharing of information.

Yukl [52] emphasises collaboration and communication as related to referent power. As the author states, this power source is an essential source of influence as people are more likely to carry out requests from persons they admire. Therefore, referent power positively affects risk practitioners' leadership practices, such as managing tensions and strengthening influence. Using their referent power, established informal networks allow risk practitioners to reshape and improve how the ERM role is perceived by executives and business units [13]. Risk practitioners must develop a consistent set of values, clearly express them and act based on them to increase referent power [52].

Risk practitioners strengthen their influence using two additional power sources. The first is expert power, a personal power source. Yukl [52] confirms unique knowledge as a potential source for influencing subordinates, peers and superiors. Moreover, as influence is more likely to be accepted and less rejected when exercised by people with critical and scarce knowledge, expert power is superior to participative leadership [59]. Expert power allows risk practitioners to share opinions proactively and openly and, thus, be recognised as competent advisors for the management. Risk practitioners must present rational arguments appreciatively and humbly to gain and maintain expert power [52]. To be recognised by decision-makers as experts require building informal networks and proactively providing expert opinions from a risk perspective.

As a second power source to strengthen their influence, risk practitioners possess information power, a position power source. Despite having no formal authority as independent facilitators, the risk unit presents risk information to the top management. Control over information enables risk practitioners to influence risk management activities within the organisation [52]. However, position power is lost with the position associated with the power [60]. Therefore, risk practitioners reluctantly use power over information. This parallels the limited use of legitimate power found by Mikes [13] in two case studies.

Risk practitioners must manage tensions as a result of different interests. They overcome these tensions using participative leadership. Participation and collaboration enable sharing perspectives [51]. Furthermore, it increases the speed at which threats and opportunities can be identified and addressed [50]. In contrast, compromising can be counterproductive as harmony is prioritised over value [61]. For risk practitioners, this implies prioritising negotiation of claims over compromise-seeking strategies.

#### **5.2 Increasing influence through issue selling**

Issue selling is centred on affecting others' attention. The framework developed by Dutton and Ashford [42] and Dutton et al. [43] considers how middle managers gain influence through issue selling in upward communication. Still, the observation of Dutton et al. [43] observation that issue selling is a political and commitment-building process parallels the process through which risk practitioners engage with peers.

When risk practitioners emphasise value creation, such as leveraging information and enhancing perspectives, they predominantly use logical, coherent, structured presentations and incorporate business objectives. These practices create legitimacy on issues to be sold and increase attention by decision-makers [43].

According to Dutton et al. [43], bundling risk issues with business objectives is successful if these issues are linked to already agreed-upon goals. Risk practitioners must identify stakeholders, practice relationship building and develop knowledge about the organisation's strategy. The authors note that issue-selling efforts should be customised to include the full range of stakeholders. Beyond knowing stakeholders, customisation may involve experimenting with alternatives to present knowledge, as one interviewee specified.

Practices aiming to develop this knowledge include fostering dialogue and building trust. These practices involve the informal exchange of information and emphasise unbiased and trustful discussions. Involving others helps reduce bias through diverse thoughts [62]. It further increases visibility, creates awareness and supports building organisational commitment [43]. Practitioners reinforce involvement through a participatory leadership style that builds trust, respect and commitment [51]. Therefore, these practices help increase risk practitioners' influence and overcome change resistance.

In the same vein, involvement helps to reduce the misperception of ERM and reinforces relation-building practices. However, as Goleman [51] flags, participation must be distinguished from putting off crucial decisions, confusing people and escalating conflicts. As the findings show, it implies that risk practitioners communicate assertively, including resisting conflicting demands. Assertive communication emphasises expressing opinions and beliefs honestly and appropriately without infringing on others' emotions [63]. Therefore, assertively resisting conflicting demands helps keeping a balance between independence and involvement [13].

### **5.3 Managing knowledge across boundaries**

Creating a shared understanding and value for the business are two major practice episodes pursued by risk practitioners. Through these episodes, they understand the business, including objectives and requirements. It also involves transferring knowledge on ERM to stakeholders. These practices help risk practitioners and business units create common knowledge. Common knowledge is necessary for sharing and assessing knowledge across boundaries [44]. Using this knowledge and, particularly, applying the language of the business reinforce risk practitioners' leadership practices, such as cultivating dialogue.

Risk practitioners increase interaction with business units by developing and applying business language in conversations [12, 13, 46]. Carlile [44] states that a common lexicon is sufficient for managing dependencies between activities and resources where knowledge differences and dependencies between actors are known.

Increasing novelty blurs differences and dependencies and makes meanings ambiguous [44]. Therefore, risk practitioners visualise risk methods using scenarios, examples and simplification. Moreover, they use their risk tools to leverage information. Risk tools can effectively represent and transform current and novel knowledge [46], thus supporting the interaction between risk practitioners and others.

When novelty leads to conflicting interests, it impedes effectively sharing information and knowledge [44]. Overlapping activities resulting from shared accountability for managing uncertainties stimulate professional rivalry [10] and reinforce conflicting interests. These conflicts require creating common meanings and renegotiating agreements [44]. The participative leadership style used by risk practitioners supports this objective [61]. Therefore, participation effectively overcomes knowledge boundaries, especially in volatile business environments characterised by high novelty.

Risk practitioners complement collaboration by partnering with business units to create win-wins and reframe the organisational ERM. According to Carlile and Rebentisch [64], reframing the perception of ERM as a value-creating practice fosters cooperation through the demand for value-creating activities. However, a high level of novelty generates different interests [44] expressed by political and social concerns. According to Carlile [44], interests must be negotiated and defined in a political process. As the author states, costs resulting from transforming current common and domain-specific knowledge negatively impact the willingness of actors to make those changes. Therefore, partnering with business units enables risk practitioners to discuss and stipulate shared interests.

Risk practitioners require stakeholders' input to risk management processes [22]. However, individual biases and groupthink jeopardise the quality of shared information and, thus, the quality of consequent decisions [65]. These issues promote overlooking threats or subjective assessments [11]. Risk practitioners acknowledge different perspectives from diverse stakeholders and incorporate them into their knowledge generation to overcome individual bias and combat groupthink. This diversity of thoughts is essential for effective decision-making as it supports understanding the full range of possible options [62].
