The uncertainties of risk management A field study on risk management internal audit practices in a Finnish municipality

Purpose - The purpose of this paper is to analyse the implementation of risk management as a tool for internal audit activities, focusing on unexpected effects or uncertainties generated during its application. Design/methodology/approach - Public and confidential documents as well as semi-structured interviews are analysed through the lens of actor-network theory to identify the effects of risk management devices in a Finnish municipality. Findings - The authors found that risk management, rather than reducing uncertainty, itself created unexpected uncertainties that would otherwise not have emerged. These include uncertainties relating to legal aspects of risk management solutions, in particular the issue concerning which types of document are considered legally valid; uncertainties relating to the definition and operationalisation of risk management; and uncertainties relating to the resources available for expanding risk management. More generally, such uncertainties relate to the professional identities and responsibilities of operational managers as defined by the framing devices. Originality/value - The paper offers three contributions to the extant literature: first, it shows how risk management itself produces uncertainties. Secondly, it shows how internal auditors can assume a central role in the risk management system. Thirdly, it develops Callon's framing/overflowing framework with the notion that multiple frames are linked and create unexpected dynamics, and applies it to the study on the effects of risk management tools in an internal audit context. It shows how, despite recurring attempts to refine risk management, further uncertainties are continuously produced, thus providing an empirical illustration of how reframing and overflowing intertwine in a continual process.