Trade-Control Compliance in SMEs: Do Decision-Makers and Supply Chain Position Make a Difference?

Embargoes and sanctions are becoming increasingly important for business leaders to consider (Chipman, 2016). In principle, economic coercive measures can be imposed on individuals, companies, organizations, or economic sectors, as well as on entire states or individual regions of a country (Vock, 2005). Recent examples include measures against Al-Qaeda, Syria, Russia, or the gas pipeline Nord Stream 2 (Vock, 2017; Deutsche Welle, 2021). The scope and content of the individual coercive measures are very different, and the measures contain a variety of prohibitions and restrictions. For example, embargo measures often include goods and services that are not typically subject to trade controls, such as apples sent from the European Union to Russia, or financial and travel restrictions for individuals and companies. Concurrently, political changes and the relaxation of economic coercive measures create attractive market opportunities, as seen, e.g., albeit briefly, in Cuba or Iran (Pratt and Alizadeh, 2018). The increased importance of economic restrictions means that all companies are obliged to continually assess whether their business activities and relationships are affected as the requirements of the trade-control regimes are not applicable only to sensitive goods and dual-use goods (Frey, 2012; Beutel, 2015; Stewart and Brewer, 2016). To comply with these legal provisions, SMEs must also address the issue of trade compliance (Shaw and Dill, 2016). In business practice, the organizational design of trade compliance still often plays a subordinate role. Often, the issue of trade compliance is anchored at a deep hierarchical level (Palmer, 2015). Companies operating exclusively in their home country often neglect the topic completely as they wrongly assume that it is not relevant (Lieggi, 2016). However, trade control is applicable to any company that could potentially come into contact with blocked customers on sanctions, embargoes, or watch lists, regardless of whether those customers are countries, legal entities, or natural persons. Furthermore, trade control affects any company conducting business with goods on goods control lists or whose goods could be used for critical purposes as well as any company that is exposed to a critical situation listed on the so-called red flag checklists (Borocz-Cohen, 2014; State Secretariat for Economic Affairs, 2016a). Regardless, aside from goods in the narrower sense, trade compliance expands to include software, technologies, and technological support in the form of documentation and written and (tele-)oral transmission of information (Frey, 2012; Charatsis, 2015). Moreover, the transfer of sensitive information to a cloud server is also covered by trade-compliance requirements (Charatsis, 2015). In principle, this can affect any business. Therefore, all companies are obliged to monitor their business relationships and transactions. Should doubts or inconsistencies arise, no business relationship may be established, and no transactions may be conducted. If a business relationship already exists, the company is required to terminate or otherwise end the business relationship. Deliveries or payments to blocked parties violate regulations and are therefore punishable by law.

The question as to how organizations vary in their organizational responses to demands originating from the external environment has been a topic area in several streams of literature using different theoretical lenses (Oliver, 1991; Scherer et al., 2014; Desai, 2016). According to the extant literature, organizations can, on the one hand, resist external pressure by trying to strategically manipulate external demands without adjusting their organizational structures and practices (Oliver, 1991; Barley, 2010; Pache and Santos, 2010). On the other hand, organizations can decouple their organizational responses from their actual practices by symbolically but not substantially align their organizational structures to external demands (Edelman, 1992; Boxenbaum and Jonsson, 2017). In addition, organizations can respond to external pressures by isomorphically changing their organizational structures and practices to conform to external expectations (Deephouse, 1996; Scherer et al., 2014). While the extant literature has primarily examined the reasons and conditions that lead to resistance and decoupling, less empirical evidence is available regarding the antecedents of conformity (Desai, 2016).

Formal ethics or compliance programs have been conceptualized in the extant literature as organizational control systems (Lange, 2008; Grabner and Moers, 2013). The purpose of such systems is to ensure conformity with the norms and rules prevalent in the organizational environment (Weaver et al., 1999a; Kaptein, 2009). Formal compliance programs are considered to be an important instrument to signal to stakeholders the organization’s alignment with the external demands and expectations of the organizational environment (Pfarrer et al., 2008; Kaptein, 2015; Hauser, 2019). In addition, internal compliance programs should demonstrate that the organizational structures and processes are in line with prevailing good practices in this field. By implementing and following internal compliance programs in business practice, the organization has greater chances of avoiding penalties and sanctions from stakeholders resulting from unauthorized business relationships and transactions (Weaver et al., 1999b; MacLean and Behnam, 2010; Hauser and Hogenacker, 2014).

Building on Weaver et al., (1999a) and Kaptein (2015), trade-related ethics and compliance programs can be characterized in terms of their scope, that is, the number of different control measures incorporated into the internal compliance program. Typically, trade-control compliance programs include policies, manual, and/or automated electronic monitoring procedures and systems, which help prevent, detect, and remediate business transactions with goods and parties related to trade-control implications (Frey, 2012). In accordance with recommendations issued by national and international institutions, internal trade-control compliance programs should include the following ten measures (Secretariat of Wassenaar Arrangement, 2011; Dual-Use Coordination Group, 2018): (a) the commitment of senior management to comply with trade-control requirements; (b) a formal code of conduct that itemizes the organization’s existing policies regarding trade-control compliance; (c) systems that continuously and systematically check whether business partners or customers come from countries that are subject to sanctions/embargoes; (d) systems that continuously and systematically check whether the organization’s goods are listed on control lists; (e) systems that continuously and systematically check whether the information provided by customers regarding the intended use of organization’s goods contains any discrepancies; (f) records that continuously document the organization’s business transactions; (g) warning lists that identify and control risks related to critical end uses and recipients; (h) regular trade-compliance trainings aimed at helping employees recognize and properly respond to trade-compliance issues; (i) internal audits; and (j) compliance officers or compliance committees charged with coordinating policies, providing trade-compliance trainings, or investigating potential rule violations.

Through interactions with key SME decision-makers, the current study found initial indications that the extent to which organizations implement internal trade-control compliance varies. In some SMEs, internal trade-control compliance programs are broad in scope and extend to include many of the abovementioned measures. Conversely, the scope of the trade-control compliance programs in other SMEs is limited by few, if any, of the abovementioned measures being implemented. Based on this observation, the question arises as to which factors explain the variation in scope of organizational trade-control compliance programs.

From a strategic response perspective, specialized administrative functions and systems such as compliance programs can be implemented by taking steps along one of two main avenues (Child, 1997; Tatoglu et al., 2020). This process can be achieved either by taking a proactive or a reactive approach. In the context of trade compliance, a proactive approach can be characterized by organizations implementing a compliance program to avoid potential dangers and threats before they materialize, i.e., regardless of whether there is an imminent risk of violating the prevailing trade-control laws and regulations. Such compliance measures may be recommended by authorities to prevent noncompliance but are not mandatory at this stage. Conversely, a reactive approach to trade compliance can be understood as taking action to implement compliance measures only after a compliance breach or once red flags are present, suggesting an imminent threat to compliance, i.e., to remedy an existing real threat. In such cases, the implementation of a formal compliance program might be made mandatory by the authorities, for example, as a result of a settlement or court order. The extant literature suggests that the benefits from proactive behavior outweigh those from reactive behavior (Hauser and Hogenacker, 2014). In this sense, it is considered superior and cheaper to minimize the prospect and damages of an incident before it occurs rather than to wait for the damage to happen in the first place (Merchant and van der Stede, 2007; Schembera and Scherer, 2017). Therefore, it seems axiomatic that SMEs should proactively implement trade-control compliance measures because of the severe damage that can be caused by noncompliance with the applicable legal, regulatory, and administrative provisions regarding trade control.

However, with regard to organizational risk management, the extant literature has shown that there are trade-offs among multiple factors such as time and money (Reuer et al., 2004). Thus, when considering the implementation of a trade-control compliance program from a cost-benefit or cost-risk perspective, SMEs might neglect the high costs associated with noncompliance and instead focus only on the perceived higher costs linked to the compliance program (Hauser and Hogenacker, 2014; Palmer, 2015; Wickert et al., 2016; Durand et al., 2019). Additionally, if companies consider the risk of detection and prosecution to be unlikely, or if they consider the penalties for noncompliance to be low, the company may deliberate and conclude that it is more cost-effective to behave reactively (Bitektine, 2011; Jorge and Basch, 2013). That being said, it can be postulated that SMEs will implement trade-control compliance measures only if external pressure forces them to do so because they have been confronted with trade-compliance-related issues (red flags) in their business practice. The actual confrontation with trade-compliance-related red flags can represent a contingent event that causes path dependency, thereby reducing the choices available to SME decision-makers. Specifically, path dependency might limit the ability of SME decision-makers to make discretionary decisions regarding specific organizational processes or structures because path dependency is linked to rigidity, stickiness, and irreversibility, meaning that an organization cannot deviate from the chosen path within reasonable time or cost parameters (Sydow et al., 2009; Vergne and Durand, 2011). When an organization is confronted with trade-compliance issues, decision-makers may no longer have the option to decide against implementing a trade-control compliance program as governmental authorities are already demanding such a program. As a result, repeatable and routine trade-compliance tasks and processes are introduced by the organization, which are, over time, carried out more effectively, leading to self-reinforcement. Based on these considerations, the first hypothesis is formulated:

Despite the potential severe damage that can be caused by noncompliance with trade-control regimes, not all SMEs seem to respond equally to the applicable legal, regulatory, and administrative provisions. This situation is in line with the literature on organizational responses to external demands whereby the assumption is made that key decision-makers influence how companies respond to the demands and expectations of the organizational environment (Dutton and Duncan, 1987; Phillips et al., 2010; Tatoglu et al., 2020). However, there is a lack of clarity in the academic debate on how decision-makers shape a firm’s organizational response to external pressures. One line of literature posits that the design of organizational structures, including ethics or compliance programs, is the result of the deliberate actions of rational decision-makers responding objectively to pressures originating from the organizational environment, which implies that decision-makers are fully aware of and able to correctly interpret and act on all relevant information (Brunsson, 1982; Barley and Kunda, 1992). Conversely, drawing on the behavioral view of the firm, another line of literature argues that individuals possess only limited cognitive capacities, which in turn also constrains the ability of decision-makers to consciously and intentionally react to environmental conditions (Simon, 1957; Schuler and Rehbein, 1997; Rehbein and Schuler, 1999; De Cremer et al., 2011).

As far as trade control is concerned, the self-declaration principle applies, meaning that it is the responsibility of the management of each individual organization to be aware of the legal restrictions on economic freedom associated with its business activities and, if necessary, to proactively obtain a corresponding license or to refrain from business activities (Böhler-Royett Marcano and Frost, 2017). In the organizational literature, theorists have proposed several factors that shape an organization’s response to the demands of its environment. Oliver (1991) suggested a framework containing various preconditions to organizational decision-making in response to external pressure including the organization’s degree of awareness of external expectations and requirements. In a similar line of reasoning, Schuler and Rehbein (1997) theorized that in a political context, organizations filter internal and external knowledge and information, shaping the organization’s willingness and ability to act and engage in politics. In a later study, Rehbein and Schuler (1999) began to test their conceptual framework based on a sample of publicly traded corporations, finding that an organization’s firm-level characteristics are significantly linked to the intensity of its involvement in political activities; however, the study does not explore the role of awareness and knowledge and does not cover the SME sector.

In a different, yet related, context, another literature stream deliberates on the role of awareness in responding to ethical demands. In the behavioral ethics literature, theorists have focused on awareness in the ethical decision-making process at the individual level rather than the firm level. Rest’s (1986) four-component model highlights the initial and crucial importance of awareness as a prerequisite to act responsibly in a situation involving ethical issues. The model posits that decision-makers must first be aware of and understand that a situation has ethical implications before they can evaluate different courses of action, develop an intention to act responsibly, and finally act accordingly. Due to the specific characteristics of SMEs having fewer formal structures and rather having personalized, centralized leadership styles and decision-making processes (Hauser and Werner, 2009, 2015; Josefy et al., 2015), it seems salient to employ considerations from the behavioral perspective to explore decision-making regarding the scope of the trade-control compliance programs that SMEs have in place. Drawing on the extant literature, it can be expected that if decision-makers in SMEs have an active awareness of the regulatory environment to which they are bound, it is more likely that proportionate ethics and compliance measures will be taken to address the issue at the firm level (Akinboade and Mokwena, 2009; Johnson, 2015). Nevertheless, few empirical studies have tested the link between SME key decision-maker awareness and the organizational response to external demands by SMEs (Cao and Chen, 2019). Scholars have primarily begun to empirically examine the link between decision-maker awareness of environmental issues and companies’ sustainability strategies and ecological innovations. While some studies indicate a positive relationship between decision-maker awareness and green practices at the firm level (Johnson, 2015; Zhang and Zhou, 2016; Huang et al., 2019), others present mixed or nonsupportive results regarding the effect of decision-maker awareness (Gadenne et al., 2009; Akinboade and Kinfack, 2012; Weerasiri and Zhengang, 2012; Peng and Liu, 2016; Cao and Chen, 2019). A possible explanation for the divergent findings might be that most studies hypothesize that a stronger decision-maker awareness will lead to greater implementation of environmentally friendly practices. However, in the field of ethics and compliance, a higher level of decision-maker awareness might not be linked to a broader scope of a compliance program but rather to a more proportionate scope (Maor, 2017; Maor et al., 2017). Thus, it can be assumed that well-informed decision-makers may also conclude that their companies are not affected by trade-compliance issues and they therefore deliberately refrain from investing in costly overdimensional compliance programs. Conversely, if well-informed decision-makers know that their companies’ business activities and relationships are affected, they will invest in sustained compliance programs to mitigate the existing compliance risks. Hence, SME key decision-makers’ awareness of trade-control requirements can be considered a prerequisite for the establishment of proportionate internal trade-control compliance programs (Hambrick and Mason, 1984; Winter and May, 2001; Sevini, 2014). Taking the perspective of the behavioral view, it can therefore be assumed that the greater the awareness of trade-control requirements by decision-makers in SMEs, the more proportionate will be the scope of the SME’s trade-control compliance program. Based on these considerations, the following second hypothesis can be formulated:

As argued in the previous sections, external pressure that can trigger SMEs to implement measures to comply with trade controls can come directly from the applicability of the prevailing laws and regulations. In this case, SMEs take action to comply with trade-control requirements because they have been affected by trade-compliance issues; however, as hypothesized above, this requires decision-makers at the focal SME to be sufficiently aware of the laws and regulations to be able to take proportionate measures to prevent violations of said requirements.

In addition, external pressure on SMEs to implement trade-compliance programs can also stem from business partners in the supply chain (Lee, 2008; Eltayeb and Zailani, 2009; Harness et al., 2018; Stekelorum, 2020). SMEs are regularly not the lead firm in a supply chain but, rather, integrated within the supply chain itself (Hong and Jeong, 2006). In companies integrated within the supply chain, a large share of the company’s total revenue stems from business-to-business (B2B) sales. By comparison, lead firms are further downstream in the supply chain and have greater direct contact with end-consumers (Gereffi et al., 2005). Accordingly, lead firms generate only a small proportion of sales through B2B transactions. If the downstream business partner in the supply chain, which is frequently a larger company (Beier et al., 2016), is aware of the prevailing rules and regulations, the necessary awareness regarding the implementation of a trade-compliance program may be transferred to the SME via supply chain linkages (Stekelorum, 2020). In this case, the downstream business partner will force the SME to implement a compliance program, even if the SME’s decision-makers themselves are not aware of the applicable laws and regulations (Gadenne et al., 2009; Vanalle et al., 2017). As a result, downstream business partners in the supply chain might send messages or use measures such as clauses in contracts or supplier codes of conduct that define the scope of the trade-compliance program that must be established by the supplying SMEs (Andersen and Skjoett-Larsen, 2009; Egels-Zandén, 2017; Choi et al., 2019). It is thus to be expected that becoming embedded in a supply chain is a contingent event that creates a path dependency as the SME is forced to implement trade-compliance programs to comply with the requirements imposed by its downstream business partners. This process severely limits the autonomy of the SME decision-makers regarding the approach to trade compliance (Stekelorum, 2020). Consequently, the SME will implement repeatable and routine trade-control compliance tasks and processes, which, over time, lead to self-reinforcing path dependency (Sydow et al., 2009; Vergne and Durand, 2011). Based on these assumptions, the third hypothesis can be formed:

The empirical analysis is based on a unique cross-sectional dataset of Swiss SMEs. Despite the lack of a universally accepted definition of an SME (Ribau et al., 2018), a widely used definition in German-speaking areas is the one provided by the Institut für Mittelstandsforschung (IfM) Bonn. Here, SMEs are defined as firms with fewer than 500 employees (Hauser and Werner, 2009). Following this definition, the study sample is limited to firms with fewer than 500 employees in the German and French-speaking parts of Switzerland, corresponding to 580,397 companies (Federal Statistical Office, 2017). To ensure adequate coverage of each SME size category, a sample of 1354 SMEs was selected from the population by stratified random sampling using the stratification criterion of firm size (see Table 1). Of the SMEs in the initial sample, 289 SMEs participated in the online survey, corresponding to a response rate of 21%.

The online survey was conducted between January and May 2017. Before the survey was launched, the questionnaire was pretested with trade-control content experts, survey design specialists, and representatives of the target population who were not included in the final sample. The aims of the pretests were to eliminate ambiguous or misleading wording and errors and to assess the duration of the survey. In addition, the pretest helped avoid possible uniform answering patterns. The pretests were conducted by telephone, with the questionnaire being sent to the participants shortly before the interview. By leaving no time for preparation before the interview, the intention was for the participants to react as impartially as possible to the questions. The participants were asked to read and answer the questions out loud, thus disclosing any uncertainties and divergences of interpretation regarding the meaning of the questions. The results of the pretest revealed potential areas for improvement in terms of the simplicity and comprehensibility of individual questions. Based on these findings, the identified questions and answer options were redesigned in a more precise and coherent manner, thus improving the readability of the questionnaire. Furthermore, the pretest ensured that the data collection based on the finalized questionnaire generated valid and reliable data. Previous empirical research has revealed that key decision-makers in charge of related organizational activities provide accurate information when investigating a specific organizational phenomenon (Weaver et al., 1999a). For this reason, SME representatives familiar with trade-control requirements and any formal compliance measures their organization may have employed to meet those requirements were targeted. In 57% of the interviews, the target providing the information was either the owner-manager or the employed managing director of the SME. In the remaining interviews, the person providing the information was a decision-maker either in the finance department (27%) or in other functions (16%) including legal and compliance, human resources, international business, or logistics.

Considering the portfolio of SMEs in the dataset, the average SME has been in operation for approximately 59 years and has 72 employees. SMEs that are predominantly integrated into a supply chain generate on average 86% of their revenues from B2B relationships. Conversely, SMEs that hold more of a lead position within the supply chain generate on average 8% of their sales through B2B interactions. For 54% of the surveyed SMEs, at least one warning indicator indicates that business activities are potentially affected by trade-control rules and regulations, and 28% have increased awareness of trade-control issues. A total of 54% of SMEs have implemented at least one trade-control compliance measure. Thirty-six percent conduct business abroad, 18% are active in the manufacturing sector, 15% are active in the trade sector, and 6% are active in the IT sector (see Table 1).

The descriptive results from the survey provide evidence that there are considerable differences between firms regarding the implementation of trade-control compliance measures. As shown in Table 2, in the group of SMEs with business activities not affected by trade control and that have low management awareness, only 37% have implemented at least one trade-control compliance measure. This number rises slightly to 43% in the group of SMEs with business activities that are also not affected by trade control but have high management awareness. Moreover, this figure increases to 61% in the group of SMEs with business activities affected by trade control and that have low management awareness; in the group of SMEs with business activities affected by trade control and possessing high management awareness, 81% have implemented at least one trade-control compliance measure. These descriptive results indicate clear differences among SMEs; such differences can be attributed to management awareness and the degree to which laws and regulations are applicable to each respective company.

As discussed in the previous sections, it can be argued from a theoretical standpoint that the scope of the trade-control compliance program of an SME may be linked to its affectedness and decision-maker awareness as well as its position within the supply chain. For the econometric analysis of the ceteris paribus relationships between these factors, an OLS model of the following form is used:

scope_compliance_program_i = β₀ + β₁awareness_i + β₂redflag_i + β₃interaction_i + β₄B2B_high_i + β₅B2B_low_i + β₆(log)firmsize_i + β₇firmage_i + β₈foreign_operations_i + β₉performance_i + β₁₀CEO_i + β₁₁manufacturing_i + β₁₂trade_i + β₁₃IT_i +β₁₄language_region_i + η_i

The dependent variable of the model scope of trade-control compliance program is a metric measure reflecting the number of trade-compliance procedures implemented by the company. The independent variables of main interest are red flag, decision-maker awareness, and position in the supply chain B2B high. All variables are described in Table 3. The data preparation and the recoding of variables were conducted in SPSS. All model estimations were performed using R.

Before proceeding with the analysis, it is necessary to consider possible pitfalls as well as to perform various robustness checks. For this purpose, different models were estimated with variations of the dependent and independent variables.

First, the choice of the OLS regression model and additive metric required some justification given that the dependent variable is a limited sum-index (Lehmann et al., 1998). Thus, the first variation includes a multiple-correspondence-analysis-based dependent variable. This model shows a slightly better fit than the selected OLS regression model. The second variation of the dependent variable took into account a weighted index based on the frequency of occurrence of the individual measures. This model performed worse than the OLS model. Therefore, for the sake of an easier interpretation of the coefficients and due to the overall good fit of the OLS regression model, as well as the knowledge that it lies between the two other models in terms of fit, the study moved forward with the OLS model. Additionally, the robustness of the findings was tested using two Tobit models. The first had a range from zero to ten according to the OLS model, and the second Tobit model had one as the lower limit. The results of the Tobit models completely confirm the OLS model.

A second concern that must be considered relates to endogeneity and unobserved heterogeneity (Wooldridge, 2009). The decision concerning the scope of a compliance program is determined at the firm level and is therefore endogenous. Because the study depends on cross-sectional data, the best strategy to address the issue of endogeneity would be to identify a suitable instrument variable. However, due to the lack of an appropriate instrument, as many suitable control variables as possible must be included in the model, which of course does not eliminate the possibility that important predictors are missing in the model. While it cannot be completely ruled out that relevant variables were omitted in the model, the analyses do not provide any indication of unobserved heterogeneity. Moreover, to check whether the issue of endogeneity is of concern, a Durbin–Wu–Hausman test was performed, which did not result in any strong evidence (α = 0.05). In addition, there does not seem to be plausible theoretical evidence of endogeneity as no panel structure or other problems such as autocorrelations were detected (Hausman, 1978; Nakamura and Nakamura, 1981; Greene, 2018).

Another concern that must be addressed is the issue of multicollinearity. Table 4 reports the pairwise correlations between the variables included in the regression models. The bivariate relationships indicate that the independent variables are generally not highly correlated with one another, indicating that there is no major risk for multicollinearity in the estimation results. This finding is also supported by the VIF values that are all below six, which also indicates that no multicollinearity is present in the analysis (O’Brien, 2007).

Furthermore, to check whether common method bias according to Podsakoff and Organ (1986) is of concern, a Harman’s single factor test was performed. Common method bias is assumed to exist if a single factor emerges from unrotated factor solutions or if a first factor explains the majority of the variance in the variables (Podsakoff and Organ, 1986). The results of the unrotated factor analysis show five factors with eigenvalues greater than one, where the maximum variance explained by one single factor is only 18.2%. Thus, the results of Harman’s single factor test indicate that this type of bias is not of concern in the study.

Building on the literature on organizations’ responses to the demands of their environment (Oliver, 1991; Schuler and Rehbein, 1997; Desai, 2016; Tatoglu et al., 2020), the study empirically assesses factors that influence the scope of formal ethics and compliance programs, which are used to manage trade-related risks. The adoption and change of organizational structures have often been attributed, in the extant literature, merely to mimetic, normative, and/or coercive processes (DiMaggio and Powell, 1983; Hauser and Hogenacker, 2014). Nevertheless, this one-sided concentration on external factors implies a narrow and deterministic view of an organization’s compliance programs. By contrast, the strategic response perspective emphasizes the active role of organizations’ decision-makers (Child, 1972; Oliver, 1991; Weaver et al., 1999a; Tatoglu et al., 2020). By showing that an organization’s decision-makers have some agency when making managerial decisions about issues such as the design of organizational structures, this conceptual view helps explain the variations in the structural design of organizations that are confronted with similar expectations and pressures from the organizational environment (Edelman, 1992; Desai, 2016). According to the strategic response perspective, decision-makers can act either reactively, by responding only to real or perceived external pressures, or proactively, by exercising their freedom of choice (Child, 1997).

First, the results of the present research contribute to the prior literature by indicating that decision-makers are not limited to acting either proactively or reactively regarding ethics and compliance-related issues; they can also react proportionately. Drawing on recent literature in political science (Maor et al., 2017), an organizational response can be considered proportionate if a balance exists regarding its costs and benefits. Conversely, an organizational response can be considered disproportionate if no such balance exists. Disproportionate organizational responses come in two forms, specifically, overreaction and underreaction. Overreaction is a situation where the organizational response places a cost on the organization that is too high in light of its benefits and therefore represents a disproportionate burden. An underreaction, on the other hand, is when the response taken is weaker than called for by the situation (Maor, 2017). The empirical findings indicate that well-informed SME decision-makers react proportionately to the requirements imposed by laws and regulations, meaning that the organizational response they take is directly proportionate to the company’s objective level of trade-compliance risk (see Table 8).

If they deliberately conclude that their companies are not affected by trade-compliance-related issues, they refrain from investing in costly overdimensional compliance programs. However, when well-informed decision-makers are aware that their companies’ business activities and relationships are affected, they address the issue with sustained compliance programs to mitigate the associated risks. Thus, well-informed decision-makers serve their organizations in both circumstances. In the former case, they do so by keeping compliance costs to a minimum and by maintaining a lean organizational structure that allows the organization to remain competitive and agile. In the latter case, they do so by reducing the organization’s liability exposure in the area of trade compliance and by limiting the risk of legitimacy crises caused by violations of the trade-control laws and regulations. Conversely, uninformed decision-makers respond disproportionately in the form of an underreaction because they do not enact all necessary and reasonable organizational precautions to adequately prevent violation of the trade-control laws and regulations.

The latter point is associated with the second contribution of this article. Laws and regulations establish the framework that determines how companies are allowed to conduct their business. Thus, laws and regulations play a principal role in the environment of organizations (Oliver, 1991; Venard, 2009). In the extant literature, there are two distinct streams discussing organizational behavior in relation to laws and regulations. On the one hand, it is assumed that decision-makers can go above and beyond what is required by applicable laws and regulations; however, they cannot go below those minimum requirements (Tatoglu et al., 2020). On the other hand, there is an extensive discussion regarding the role of decision-makers in corporate wrongdoing, where decision-makers deliberately act below the standards required by law (Zahra et al., 2005; Schnatterly et al., 2018). The results of the present research show that the relationship between the applicability of trade-control laws and regulations for SMEs’ day-to-day operations and the scope of their implemented trade-control compliance program is not always proportionate. This is particularly the case when key decision-makers are not well aware of the legal restrictions, relevant regulations, and approval requirements, opening up the possibility for unintentional and unconscious violations of prevailing laws and regulations. Accordingly, the empirical findings show that organizations might inadvertently fail to comply with regulatory requirements due to oversight on behalf of the key decision-makers.

Third, the present study contributes to and extends the conceptual understanding of the interplay between external pressures and managerial decision-making. The empirical results provide evidence that the organizational structures to safeguard trade-control compliance of SMEs reflect the proportionate responses to regulatory pressures; however, they do so only if the key decision-makers are well informed and aware of the prevailing laws and regulations. The study thus adds to ongoing attempts in the literature to explore the interface between the conflicting positions regarding determinism versus managerial agency in organizational structuring (Bourgeois III, 1984; Hambrick and Finkelstein, 1987; Hitt and Tyler, 1991; Tatoglu et al., 2020). Unlike the existing literature (e.g., Child, 1997), the findings of the present study indicate that it cannot be taken for granted that all decision-makers share a complete and common understanding of the prevailing legal and regulatory framework conditions. This phenomenon is particularly true when demands and expectations within the organizational environment are subject to fast-paced and constant change and not entirely clear-cut, as is the case in trade control (Goodrick and Salancik, 1996; Scherer et al., 2014; Rosanelli, 2016). The environment imposes certain requirements on the organizational design of trade-control programs, which would call for deterministic response patterns from organizations. However, whether organizations implement proportionate internal control measures to prevent and detect violations of trade-control requirements ultimately depends on the stance of its key decision-makers. Hence, decision-makers can also act inadequately and thus not in the best interests of their organizations. This indicates that when exploring the design of organizational structures, the concept of bounded rationality (Simon, 1957)—relating to the limited cognitive capacities of the decision-makers—must be considered in addition to the concept of bounded autonomy (Child, 1997)—relating to the limited scope of action set by the organizational environment.

Finally, the results of the present study provide new insights into the extent to which SMEs within supply chains are dependent on the path established by downstream business partners (Sydow et al., 2009; Vergne and Durand, 2011). Based on the literature, it was expected that SMEs that are predominantly active in business-to-business relationships would be forced to implement trade-control compliance programs of a greater scope. However, in contrast to the expected path dependency, the results show a negative link between the supply chain position and the scope of the trade-control compliance programs implemented by SMEs. It can be postulated that this negative link can be attributed to one of two scenarios. On the one hand, the results indicate that SMEs do not receive substantial pressure from their downstream business partners to implement comprehensive trade-control compliance programs, potentially because the downstream supply chain partners have already well-established trade-control compliance programs that are able to take responsibility for ensuring compliance with trade regulations for the entire supply chain. Thus, the SMEs would not need a wide-ranging compliance program on their own. However, for downstream business partners to be able to maintain a truly effective trade-control compliance program, they must receive regular information from their upstream business partners in the supply chain so that they have a holistic view of what is being done to ensure trade compliance. SMEs may not be able to provide the necessary information to their downstream supply chain partners without having their own trade-control compliance measures in place. On the other hand, the results indicate that SMEs in business-to-business relationships might have a considerable degree of autonomy regarding how they address trade-compliance issues. The reduced scope of trade-control compliance programs witnessed in the sample suggests that SMEs that are not supply chain leaders might neglect their responsibility towards trade-control compliance and instead attempt to pass it on to their downstream supply chain partners. This oversight of responsibility for trade-control compliance raises the question of liability in the case of noncompliance in the supply chain.

The findings of the present study also have central repercussions for SME management practice and policymakers. It can be said that most managers and decision-makers would concur that organizations should conform to applicable laws and regulations (Weaver et al., 1999a). However, these good intentions can be challenged or even foregone in an organizational environment where those in charge of decision-making processes are principally expected to meet tight deadlines, realize high revenue targets, and maximize shareholder value in the short term (Paine, 1994; Rae and Subramaniam, 2008; Albrecht et al., 2008). It is frequently the case that decision-makers must decide on whether to allocate scarce resources to direct business activities or to indirect functions such as compliance and risk management. This situation is particularly more pertinent for SMEs with only limited financial and human resources (Hauser and Werner, 2015; Paul et al., 2017). Because resources are typically scarce in SMEs, management is also actively involved in day-to-day operations. For this reason, SMEs often find it difficult to reconcile their daily work with the fulfillment of additional tasks such as risk and compliance management (Hauser and Werner, 2009). Compliance is therefore often seen as a major administrative burden for SMEs as its effectiveness and efficiency have yet to be fully seen and comprehended by these companies (Hillary, 2004; Bitektine, 2011; Jorge and Basch, 2013). Additionally, due to the multifaceted roles of management in SMEs, management members scarcely have the resources available to familiarize themselves and be properly informed about the regulatory framework with which they must comply. Considering the study’s descriptive data, it was observed that SME decision-makers typically have a low awareness of trade-compliance requirements, with only a minority demonstrating that they have a high awareness. Moreover, it was also noted from the interactions with key decision-makers of SMEs that misunderstandings and misinterpretations of the extant laws, possibly leading to noncompliance, are also common among SMEs. Nevertheless, noncompliance with the expectations and requirements of the external environment makes an organization subject to the risk of severe consequences, including the imposition of penalties, sanctions, and restricted access to resources critical for the survival and growth of the organization, regardless of whether such noncompliance is driven by a lack of awareness or misinterpretation. In accordance with the legal principle “ignorance of the law is no excuse” (Black, 1968, p. 994), a lack of awareness regarding the applicable laws and regulations or existing resource constraints cannot justify legal infringements (Frey, 2012). Hence, SMEs must take appropriate precautions to avoid noncompliance. For this reason, it can be suggested that trade compliance should be given more management attention by SME decision-makers and should become a strategic priority not only for larger corporations but also for SMEs.

Further, it is clear from the analysis that a good general knowledge of the prevailing rules and regulations by key decision-makers in SMEs is associated with a proportionate organizational response to the level of trade-compliance risk. Nevertheless, ensuring compliance still tends to be viewed by as a “necessary evil” (Kuruppu et al., 2018), with compliance-related tasks being left to the responsibility of a compliance officer or anchored at a low level in the hierarchy (Palmer, 2015). In line with the recently published International Organization for Standardization (2020) guidelines for managing legal risks, the findings of this study highlight the importance of compliance under the leadership of the senior executives, indicating that management must take ownership of compliance.

Furthermore, the present study shows that SMEs that are highly integrated into the supply chain are less likely to have a comprehensive compliance program, which might suggest that SMEs instead “pass the buck,” so to speak, in terms of passing their responsibility for ensuring trade compliance onto their downstream supply chain partners. This leaves the door open for trade-compliance violations within the firm’s own operations, of which SMEs may not be aware, further emphasizing the need for decision-makers at SMEs to be aware of the prevailing risks surrounding trade compliance, even if they are not forced to implement trade-control compliance programs by external stakeholders such as public authorities or downstream supply chain partners.

The results of the present study also show greater implications for political, public, and private entities supporting SMEs. It may be futile to simply tell SMEs that they should be more aware of the regulatory frameworks surrounding trade compliance since it is this lack of awareness that must be addressed to begin with (Hauser and Werner, 2015). Instead, to facilitate SME compliance with trade-control requirements, appropriate and accessible practical advice should be offered by policymakers, public authorities, and self-governing organizations of the private sector such as chambers of commerce. These institutions should intensify their efforts to raise awareness of trade-compliance-related issues. These SME-targeted activities could include events, presentations, trainings, round tables, brochures, and (online) articles, providing information outlining the prevailing laws and regulations as well as practical advice on dealing with the trade-control requirements in a business practice with limited resources. In accordance with the results of the present research, awareness-raising activities should target key decision-makers in SMEs who are in a position to influence the structure of the organization. The intention should be to encourage the implementation of proportionate internal control measures to prevent and detect violations of trade-control requirements.

When interpreting the results, a number of limitations should be considered. First, because the analysis is founded on a cross-sectional dataset, the usual limitations of this research design apply, including that the models only provide associations. Second, the scope of investigated SMEs is limited to those with fewer than 500 employees. Companies of this size account for 99.9% of all Swiss enterprises (Federal Statistical Office, 2017). However, as found in the literature, management in SMEs differs from management in large corporations. Further research could strive to address how large companies respond to external expectations and pressures in terms of trade control. The research could also explore how managerial prudence is applied with respect to the organizational structure and scope of the related compliance programs. Third, the dataset used in this paper covers SMEs from Switzerland. Switzerland’s economy is small and open, with long-established reputable and credible law enforcement institutions. In this respect, further research could focus on other organizational environments, including emerging economies with less-formalized institutions, to explore the role of decision-makers within such environments. Fourth, the present study focuses on formal compliance programs as recommended and sometimes required by the relevant governmental bodies. However, the literature indicates that there might be some SME-specific factors—including trusting relationships—that could enable SMEs to ensure compliance even when they do not rely on such formal control programs (Baumann-Pauly et al., 2013; Wickert, 2016; Egels-Zandén, 2017). Further research could address this topic by scrutinizing the informal control approaches used by SMEs and their effectiveness. Finally, the dataset does not offer explicit insight into the demographics of the supply chain, for instance, information regarding the level of dependence of the SMEs on their respective individual downstream supply chain partners, or the size of an SME’s partners, or the number of its B2B relationships. Future research could therefore seek to explore these factors in relation to the implementation of trade-control compliance programs.

While these limitations imply that some prudence is needed when generalizing the findings, the findings are believed to make significant contributions to ongoing academic debates on organizational response to external pressures as well as to risk and compliance management. The results indicate that the organizational structures to ensure that SMEs comply with trade-control requirements reflect the proportionate response to external pressure but only if decision-makers are well informed and aware of said rules and regulations. Conversely, uninformed decision-making leads to a lack of proportionate response, resulting in an unsuitable and inadequate compliance program. In addition, SMEs that are highly integrated into supply chains also seem to neglect their responsibility regarding trade compliance.