**3.1 Data collection**

The research was limited to Germany to avoid influences from socio-cultural differences or country-specific risk management regulations. Participants have been recruited by a combination of self-selection and snowball sampling within the researcher's professional network. The selection included various industries and was limited to ERM leadership or senior-level positions. Instead of job titles, the classification followed IRM's career levels [9] and, thus, based on the breadth and depth of influence over stakeholders and the risk profession (**Table 1**).

Primary data have been collected through one-to-one semi-structured interviews to facilitate rich and in-depth accounts. Initial questions were shared with the interviewees before the interview to enable participants to mull over the questions and provide deeper accounts. The interviews' flow was flexible and contingent on what participants were saying. Accordingly, the formulation of questions and their order varied among interviews. Emphasis was put on how participants frame and understand issues and what an interviewee considers meaningful in ERM communication and leadership. This focus enabled explaining and understanding events, patterns,


#### **Table 1.** *Participants of the research study.*

and behaviours. The interview language concurred with the researcher's first language and the study's location.

#### **3.2 Data analysis**

The research followed an inductive approach to theory development. Instead of pre-specifying hypotheses, findings have been generated from data. Interviews have been transcribed and analysed in the source language to keep ties between language, identity, and culture as long as possible. For quotations, the material has been directly translated into the English language to achieve credibility and authenticity.

Qualitative research data have been triangulated with qualitative studies and surveys to ensure credibility. Surveys have been consulted to identify risk practitioners' challenges, contextualise risk practitioners' roles in German companies, and understand practitioners' perceptions of the present risk culture. Thick descriptions of the research findings and interpretations ensure transferability. The researcher kept complete records through all phases of the research process, including data analysis decisions and a reflective research diary to ensure dependability. Including rich quotes from participants depicting how themes have emerged ensures conformability.

The coding of interviews followed a template analysis approach in which the hierarchical representation of themes and codes emerged during the coding process. Existing literature, particularly sensemaking literature, guided the development of codes.

The coding was performed in two cycles using NVivo software. Initial coding provided breaking down data into discrete parts and determining the topic of each passage of the semi-structured interviews. Risk practitioners' challenges and actions have been identified using value coding, respectively, process coding.

In a second coding cycle, initial codes have been grouped and summarised to create smaller categories based on emergent configuration and explanation. This process included reanalysing first cycle codes, merging similar codes, and reassessing the utility of infrequent codes for the overall coding scheme.
