The paradox of IT governance: Enhancing or suppressing corporate risk-taking?

Purpose This study aims to explore the impact of information technology (IT) governance (ITGOV) on corporate risk-taking behavior (RTB) in Indonesian publicly listed firms, examining how IT governance structures facilitate or constrain strategic risk-taking. Design/methodology/approach This study employs a quantitative approach, using data from Indonesian publicly listed companies from 2018 to 2022. Corporate risk-taking behavior is proxied by ROA fluctuation, while IT governance is assessed using publicly available data, providing an objective measure compared to prior survey-based studies. Findings This study finds a significant positive relationship between IT governance and corporate risk-taking, particularly in low-innovation firms. Stronger IT governance encourages higher risk-taking, especially in companies with fewer innovation resources. However, in highly innovative firms, the impact is weaker, suggesting that innovation-driven firms may not rely as heavily on formal IT governance structures. Furthermore, the effect of IT governance is more pronounced in low-profit firms, where financial constraints exacerbate the rigidity of IT governance and hinder adaptive risk-taking. Research limitations/implications This study is limited to publicly listed firms in Indonesia, and the generalizability of this study may be affected by the reliance on voluntary IT governance disclosures. Future study should explore different industries and regions to broaden the understanding of IT governance's role in corporate risk behavior. Practical implications The findings provide valuable insights for corporate managers and regulators, highlighting the need to balance IT governance structures to promote both control and flexibility in risk management. Regulators may consider developing clearer guidelines to help firms navigate digital risks, while ensuring governance frameworks remain adaptable in dynamic business environments. Originality/value This study contributes to corporate governance and risk management literature by examining IT governance's role in strategic risk-taking, challenging the traditional view of IT governance as merely a tool for mitigating risks. By using an objective measure of IT governance based on publicly available data, offering a more reliable and generalizable assessment compared to prior studies.