Trade-Control Compliance in SMEs: Do Decision-Makers and Supply Chain Position Make a Difference?

In recent years, trade-control laws and regulations such as embargoes and sanctions have gained importance. However, there is limited empirical research on the ways in which small- and medium-sized enterprises (SMEs) respond to such coercive economic measures. Building on the literature on organizational responses to external demands and behavioral ethics, this study addresses this issue to better understand how external pressures and managerial decision-making are associated with the scope of trade-control compliance programs. Based on a sample of 289 SMEs, the findings show that the organizational responses of SMEs reflect proportionate adjustments to regulatory pressures but only if decision-makers are well informed and aware of the prevailing rules and regulations. Conversely, uninformed decision-making leads to a disproportionate response resulting in an inadequately reduced scope of the compliance program. In addition, the results indicate that SMEs that are highly integrated into supply chains are susceptible to passing-the-buck behavior.


Introduction
For several decades, scholarly research has been addressing the question of how firms respond to pressures originating from the external environment from both a conceptual and an empirical perspective, acknowledging the characteristics of firms and managers as filters (e.g., Oliver, 1991;Schuler and Rehbein, 1997;Rehbein and Schuler, 1999;Weaver et al., 1999a;Wang et al., 2016;Tatoglu et al., 2020). The freedom of trade and commerce enshrined as a right in Western legal systems guarantees companies the right to make their own business decisions without state interference (Biaggini, 2017). However, the government is entitled to restrict economic freedom to protect the general interests of state policy, for example, in the case of a threat to public security (Biaggini, 2017;Vock, 2017). Due to heightened levels of war, armed conflict, terrorism, piracy, organized crime, and commercial disputes, the past decade has witnessed intensified government-imposed controls and restrictions on business activities and relationships (John and Lawton, 2018). The consequences of noncompliance with said legal and regulatory restrictions range from substantial fines to considerable prison sentences (Petermann, 2015;Furrer and Henschel, 2017). Due to the complexity and fast-paced nature of the legal, regulatory, and administrative provisions regarding trade control, companies are obliged to implement effective and efficient internal control measures to comply thoroughly with all applicable trade-control regimes (Henschel et al., 2016). However, this is particularly challenging for small and medium-sized enterprises (SMEs), which have only limited resources at their disposal (Hillary, 2004;Audia and Greve, 2006).
Recently, SMEs have received increasing visibility and attention in the business ethics literature (Baumann-Pauly et al., 2013;Wickert et al., 2016). However, more research, and support for SMEs to implement ethics and compliance practices, is needed. More specifically, more 1 3 empirical research is needed on the factors that influence the implementation of proportionate internal ethics and compliance measures (Stewart and Brewer, 2016). The extant literature often attributes organizations' ethics and compliance efforts to pressures from the organizational environment rather than to managerial decision-making (Hauser and Hogenacker, 2014;Tatoglu et al., 2020). However, this emphasis on external pressures implies a narrow and deterministic view concerning the design of organizational structures including compliance programs. By contrast, the strategic management perspective stresses the active role of management concerning the design, implementation, and development of organizational structure and practice (Child, 1972(Child, , 1997Weaver et al., 1999a). However, in this segment of the literature, there is a lack of clarity about how firm decision-makers process the demands originating from the external environment. While some scholars posit a rational adaptation approach, behavioral scholars stress the limited cognitive capacities of decision-makers (Schuler and Rehbein, 1997;De Cremer et al., 2011). Against this background, the aim of this paper is to address the following issues. First, the study empirically analyzes whether SMEs take proportionate measures to prevent violations of trade-compliance requirements when confronted with trade-compliance issues (red flags). Specifically, it investigates whether managerial decision-making that builds on management awareness regarding trade-compliance issues moderates the link between external pressure to comply with tradecompliance obligations and the scope of the trade-control compliance programs that SMEs have in place. Second, the study examines the link between an SME's position in the supply chain and the scope of the trade-compliance program that it has in place (Lee, 2008;Eltayeb and Zailani, 2009;Harness et al., 2018;Stekelorum, 2020).
The contribution of this study is threefold. First, the study adds to ongoing attempts in the literature to explore organizations' heterogeneous responses to external pressures (Oliver, 1991;Schuler and Rehbein, 1997;Desai, 2016;Wang et al., 2016) by providing empirical evidence that well-informed SME decision-makers react proportionately to the requirements imposed by laws and regulations, meaning that the organizational response they take is directly proportionate to the company's objective level of trade-compliance risk. Conversely, uninformed decisionmaking leads to a disproportionate response resulting in an inadequately reduced scope of the compliance program. Hence, second, the empirical findings show that SMEs might unwillingly fail to comply with regulatory requirements due to oversight on behalf of the key decision-makers. Thus, this study underscores the importance of managerial leadership commitment towards compliance. Third, the results indicate that SMEs that are highly integrated into the supply chain are less likely to have a comprehensive compliance program, which suggests that SMEs instead "pass the buck" in terms of passing on their responsibility for ensuring compliance to their supply chain partners.
The remainder of the paper is structured as follows. The next section outlines the relevant literature and develops hypotheses based on conceptual considerations of the literature on organizational responses to external demands and behavioral ethics. The subsequent sections present the empirical study describing the dataset employed, the operationalization of the variables, the econometric methods used, and the results. The final section discusses both the theoretical and managerial implications of the empirical findings and presents concluding remarks including limitations and avenues for further research.

The Regulatory Context
Embargoes and sanctions are becoming increasingly important for business leaders to consider (Chipman, 2016). In principle, economic coercive measures can be imposed on individuals, companies, organizations, or economic sectors, as well as on entire states or individual regions of a country (Vock, 2005). Recent examples include measures against Al-Qaeda, Syria, Russia, or the gas pipeline Nord Stream 2 (Vock, 2017;Deutsche Welle, 2021). The scope and content of the individual coercive measures are very different, and the measures contain a variety of prohibitions and restrictions. For example, embargo measures often include goods and services that are not typically subject to trade controls, such as apples sent from the European Union to Russia, or financial and travel restrictions for individuals and companies. Concurrently, political changes and the relaxation of economic coercive measures create attractive market opportunities, as seen, e.g., albeit briefly, in Cuba or Iran (Pratt and Alizadeh, 2018). The increased importance of economic restrictions means that all companies are obliged to continually assess whether their business activities and relationships are affected as the requirements of the tradecontrol regimes are not applicable only to sensitive goods and dual-use goods (Frey, 2012;Beutel, 2015;Stewart and Brewer, 2016). To comply with these legal provisions, SMEs must also address the issue of trade compliance (Shaw and Dill, 2016). In business practice, the organizational design of trade compliance still often plays a subordinate role. Often, the issue of trade compliance is anchored at a deep hierarchical level (Palmer, 2015). Companies operating exclusively in their home country often neglect the topic completely as they wrongly assume that it is not relevant (Lieggi, 2016). However, trade control is applicable to any company that could potentially come into contact with blocked customers on sanctions, embargoes, or watch lists, regardless of whether those customers are countries, legal entities, or natural persons. Furthermore, trade control affects any company conducting business with goods on goods control lists or whose goods could be used for critical purposes as well as any company that is exposed to a critical situation listed on the so-called red flag checklists (Borocz-Cohen, 2014; State Secretariat for Economic Affairs, 2016a). Regardless, aside from goods in the narrower sense, trade compliance expands to include software, technologies, and technological support in the form of documentation and written and (tele-)oral transmission of information (Frey, 2012;Charatsis, 2015). Moreover, the transfer of sensitive information to a cloud server is also covered by trade-compliance requirements (Charatsis, 2015). In principle, this can affect any business. Therefore, all companies are obliged to monitor their business relationships and transactions. Should doubts or inconsistencies arise, no business relationship may be established, and no transactions may be conducted. If a business relationship already exists, the company is required to terminate or otherwise end the business relationship. Deliveries or payments to blocked parties violate regulations and are therefore punishable by law.

Organizational Responses
The question as to how organizations vary in their organizational responses to demands originating from the external environment has been a topic area in several streams of literature using different theoretical lenses (Oliver, 1991;Scherer et al., 2014;Desai, 2016). According to the extant literature, organizations can, on the one hand, resist external pressure by trying to strategically manipulate external demands without adjusting their organizational structures and practices (Oliver, 1991;Barley, 2010;Pache and Santos, 2010). On the other hand, organizations can decouple their organizational responses from their actual practices by symbolically but not substantially align their organizational structures to external demands (Edelman, 1992;Boxenbaum and Jonsson, 2017). In addition, organizations can respond to external pressures by isomorphically changing their organizational structures and practices to conform to external expectations (Deephouse, 1996;Scherer et al., 2014). While the extant literature has primarily examined the reasons and conditions that lead to resistance and decoupling, less empirical evidence is available regarding the antecedents of conformity (Desai, 2016).
Formal ethics or compliance programs have been conceptualized in the extant literature as organizational control systems (Lange, 2008;Grabner and Moers, 2013). The purpose of such systems is to ensure conformity with the norms and rules prevalent in the organizational environment (Weaver et al., 1999a;Kaptein, 2009). Formal compliance programs are considered to be an important instrument to signal to stakeholders the organization's alignment with the external demands and expectations of the organizational environment (Pfarrer et al., 2008;Kaptein, 2015;Hauser, 2019). In addition, internal compliance programs should demonstrate that the organizational structures and processes are in line with prevailing good practices in this field. By implementing and following internal compliance programs in business practice, the organization has greater chances of avoiding penalties and sanctions from stakeholders resulting from unauthorized business relationships and transactions (Weaver et al., 1999b;MacLean and Behnam, 2010;Hauser and Hogenacker, 2014).
Building on Weaver et al., (1999a) and Kaptein (2015), trade-related ethics and compliance programs can be characterized in terms of their scope, that is, the number of different control measures incorporated into the internal compliance program. Typically, trade-control compliance programs include policies, manual, and/or automated electronic monitoring procedures and systems, which help prevent, detect, and remediate business transactions with goods and parties related to trade-control implications (Frey, 2012). In accordance with recommendations issued by national and international institutions, internal trade-control compliance programs should include the following ten measures (Secretariat of Wassenaar Arrangement, 2011; Dual-Use Coordination Group, 2018): (a) the commitment of senior management to comply with trade-control requirements; (b) a formal code of conduct that itemizes the organization's existing policies regarding trade-control compliance; (c) systems that continuously and systematically check whether business partners or customers come from countries that are subject to sanctions/embargoes; (d) systems that continuously and systematically check whether the organization's goods are listed on control lists; (e) systems that continuously and systematically check whether the information provided by customers regarding the intended use of organization's goods contains any discrepancies; (f) records that continuously document the organization's business transactions; (g) warning lists that identify and control risks related to critical end uses and recipients; (h) regular trade-compliance trainings aimed at helping employees recognize and properly respond to trade-compliance issues; (i) internal audits; and (j) compliance officers or compliance committees charged with coordinating policies, providing trade-compliance trainings, or investigating potential rule violations.
Through interactions with key SME decision-makers, the current study found initial indications that the extent to which organizations implement internal trade-control compliance varies. In some SMEs, internal trade-control compliance programs are broad in scope and extend to include 1 3 many of the abovementioned measures. Conversely, the scope of the trade-control compliance programs in other SMEs is limited by few, if any, of the abovementioned measures being implemented. Based on this observation, the question arises as to which factors explain the variation in scope of organizational trade-control compliance programs.

Applicability of Laws and Regulations and the Scope of Trade-Compliance Programs
From a strategic response perspective, specialized administrative functions and systems such as compliance programs can be implemented by taking steps along one of two main avenues (Child, 1997;Tatoglu et al., 2020). This process can be achieved either by taking a proactive or a reactive approach. In the context of trade compliance, a proactive approach can be characterized by organizations implementing a compliance program to avoid potential dangers and threats before they materialize, i.e., regardless of whether there is an imminent risk of violating the prevailing tradecontrol laws and regulations. Such compliance measures may be recommended by authorities to prevent noncompliance but are not mandatory at this stage. Conversely, a reactive approach to trade compliance can be understood as taking action to implement compliance measures only after a compliance breach or once red flags are present, suggesting an imminent threat to compliance, i.e., to remedy an existing real threat. In such cases, the implementation of a formal compliance program might be made mandatory by the authorities, for example, as a result of a settlement or court order. The extant literature suggests that the benefits from proactive behavior outweigh those from reactive behavior (Hauser and Hogenacker, 2014). In this sense, it is considered superior and cheaper to minimize the prospect and damages of an incident before it occurs rather than to wait for the damage to happen in the first place (Merchant and van der Stede, 2007;Schembera and Scherer, 2017). Therefore, it seems axiomatic that SMEs should proactively implement trade-control compliance measures because of the severe damage that can be caused by noncompliance with the applicable legal, regulatory, and administrative provisions regarding trade control.
However, with regard to organizational risk management, the extant literature has shown that there are tradeoffs among multiple factors such as time and money (Reuer et al., 2004). Thus, when considering the implementation of a trade-control compliance program from a cost-benefit or cost-risk perspective, SMEs might neglect the high costs associated with noncompliance and instead focus only on the perceived higher costs linked to the compliance program (Hauser and Hogenacker, 2014;Palmer, 2015;Wickert et al., 2016;Durand et al., 2019). Additionally, if companies consider the risk of detection and prosecution to be unlikely, or if they consider the penalties for noncompliance to be low, the company may deliberate and conclude that it is more cost-effective to behave reactively (Bitektine, 2011;Jorge and Basch, 2013). That being said, it can be postulated that SMEs will implement trade-control compliance measures only if external pressure forces them to do so because they have been confronted with trade-compliance-related issues (red flags) in their business practice. The actual confrontation with trade-compliance-related red flags can represent a contingent event that causes path dependency, thereby reducing the choices available to SME decision-makers. Specifically, path dependency might limit the ability of SME decision-makers to make discretionary decisions regarding specific organizational processes or structures because path dependency is linked to rigidity, stickiness, and irreversibility, meaning that an organization cannot deviate from the chosen path within reasonable time or cost parameters (Sydow et al., 2009;Vergne and Durand, 2011). When an organization is confronted with trade-compliance issues, decision-makers may no longer have the option to decide against implementing a trade-control compliance program as governmental authorities are already demanding such a program. As a result, repeatable and routine trade-compliance tasks and processes are introduced by the organization, which are, over time, carried out more effectively, leading to self-reinforcement. Based on these considerations, the first hypothesis is formulated: H1 There is a positive link between being affected by tradecompliance issues (red flag) and the scope of the trade-control compliance programs that SMEs have in place.

Decision-Maker Awareness and the Scope of Trade-Compliance Programs
Despite the potential severe damage that can be caused by noncompliance with trade-control regimes, not all SMEs seem to respond equally to the applicable legal, regulatory, and administrative provisions. This situation is in line with the literature on organizational responses to external demands whereby the assumption is made that key decisionmakers influence how companies respond to the demands and expectations of the organizational environment (Dutton and Duncan, 1987;Phillips et al., 2010;Tatoglu et al., 2020). However, there is a lack of clarity in the academic debate on how decision-makers shape a firm's organizational response to external pressures. One line of literature posits that the design of organizational structures, including ethics or compliance programs, is the result of the deliberate actions of rational decision-makers responding objectively to pressures originating from the organizational environment, which implies that decision-makers are fully aware of and able to correctly interpret and act on all relevant information (Brunsson, 1982;Barley and Kunda, 1992). Conversely, drawing on the behavioral view of the firm, another line of literature argues that individuals possess only limited cognitive capacities, which in turn also constrains the ability of decision-makers to consciously and intentionally react to environmental conditions (Simon, 1957;Schuler and Rehbein, 1997;Rehbein and Schuler, 1999;De Cremer et al., 2011).
As far as trade control is concerned, the self-declaration principle applies, meaning that it is the responsibility of the management of each individual organization to be aware of the legal restrictions on economic freedom associated with its business activities and, if necessary, to proactively obtain a corresponding license or to refrain from business activities (Böhler-Royett Marcano and Frost, 2017). In the organizational literature, theorists have proposed several factors that shape an organization's response to the demands of its environment. Oliver (1991) suggested a framework containing various preconditions to organizational decision-making in response to external pressure including the organization's degree of awareness of external expectations and requirements. In a similar line of reasoning, Schuler and Rehbein (1997) theorized that in a political context, organizations filter internal and external knowledge and information, shaping the organization's willingness and ability to act and engage in politics. In a later study, Rehbein and Schuler (1999) began to test their conceptual framework based on a sample of publicly traded corporations, finding that an organization's firm-level characteristics are significantly linked to the intensity of its involvement in political activities; however, the study does not explore the role of awareness and knowledge and does not cover the SME sector.
In a different, yet related, context, another literature stream deliberates on the role of awareness in responding to ethical demands. In the behavioral ethics literature, theorists have focused on awareness in the ethical decision-making process at the individual level rather than the firm level. Rest's (1986) four-component model highlights the initial and crucial importance of awareness as a prerequisite to act responsibly in a situation involving ethical issues. The model posits that decision-makers must first be aware of and understand that a situation has ethical implications before they can evaluate different courses of action, develop an intention to act responsibly, and finally act accordingly. Due to the specific characteristics of SMEs having fewer formal structures and rather having personalized, centralized leadership styles and decision-making processes (Hauser andWerner, 2009, 2015;Josefy et al., 2015), it seems salient to employ considerations from the behavioral perspective to explore decision-making regarding the scope of the trade-control compliance programs that SMEs have in place. Drawing on the extant literature, it can be expected that if decision-makers in SMEs have an active awareness of the regulatory environment to which they are bound, it is more likely that proportionate ethics and compliance measures will be taken to address the issue at the firm level (Akinboade and Mokwena, 2009;Johnson, 2015). Nevertheless, few empirical studies have tested the link between SME key decision-maker awareness and the organizational response to external demands by SMEs (Cao and Chen, 2019). Scholars have primarily begun to empirically examine the link between decision-maker awareness of environmental issues and companies' sustainability strategies and ecological innovations. While some studies indicate a positive relationship between decision-maker awareness and green practices at the firm level (Johnson, 2015;Zhang and Zhou, 2016;Huang et al., 2019), others present mixed or nonsupportive results regarding the effect of decision-maker awareness (Gadenne et al., 2009;Akinboade and Kinfack, 2012;Weerasiri and Zhengang, 2012;Peng and Liu, 2016;Cao and Chen, 2019). A possible explanation for the divergent findings might be that most studies hypothesize that a stronger decision-maker awareness will lead to greater implementation of environmentally friendly practices. However, in the field of ethics and compliance, a higher level of decision-maker awareness might not be linked to a broader scope of a compliance program but rather to a more proportionate scope (Maor, 2017;Maor et al., 2017). Thus, it can be assumed that well-informed decision-makers may also conclude that their companies are not affected by trade-compliance issues and they therefore deliberately refrain from investing in costly overdimensional compliance programs. Conversely, if well-informed decisionmakers know that their companies' business activities and relationships are affected, they will invest in sustained compliance programs to mitigate the existing compliance risks. Hence, SME key decision-makers' awareness of trade-control requirements can be considered a prerequisite for the establishment of proportionate internal trade-control compliance programs (Hambrick and Mason, 1984;Winter and May, 2001;Sevini, 2014). Taking the perspective of the behavioral view, it can therefore be assumed that the greater the awareness of tradecontrol requirements by decision-makers in SMEs, the more proportionate will be the scope of the SME's trade-control compliance program. Based on these considerations, the following second hypothesis can be formulated:

H2
The link between being affected by trade-compliance issues (red flag) and the scope of the trade-control compliance programs that SMEs have in place is moderated by management awareness regarding trade compliance.

Supply Chain Position and the Scope of Trade-Compliance Programs
As argued in the previous sections, external pressure that can trigger SMEs to implement measures to comply with trade controls can come directly from the applicability of the prevailing laws and regulations. In this case, SMEs take action to comply with trade-control requirements because they have been affected by trade-compliance issues; however, as hypothesized above, this requires decision-makers at the focal SME to be sufficiently aware of the laws and regulations to be able to take proportionate measures to prevent violations of said requirements.
In addition, external pressure on SMEs to implement trade-compliance programs can also stem from business partners in the supply chain (Lee, 2008;Eltayeb and Zailani, 2009;Harness et al., 2018;Stekelorum, 2020). SMEs are regularly not the lead firm in a supply chain but, rather, integrated within the supply chain itself (Hong and Jeong, 2006). In companies integrated within the supply chain, a large share of the company's total revenue stems from business-tobusiness (B2B) sales. By comparison, lead firms are further downstream in the supply chain and have greater direct contact with end-consumers (Gereffi et al., 2005). Accordingly, lead firms generate only a small proportion of sales through B2B transactions. If the downstream business partner in the supply chain, which is frequently a larger company (Beier et al., 2016), is aware of the prevailing rules and regulations, the necessary awareness regarding the implementation of a trade-compliance program may be transferred to the SME via supply chain linkages (Stekelorum, 2020). In this case, the downstream business partner will force the SME to implement a compliance program, even if the SME's decision-makers themselves are not aware of the applicable laws and regulations (Gadenne et al., 2009;Vanalle et al., 2017). As a result, downstream business partners in the supply chain might send messages or use measures such as clauses in contracts or supplier codes of conduct that define the scope of the trade-compliance program that must be established by the supplying SMEs (Andersen and Skjoett-Larsen, 2009;Egels-Zandén, 2017;Choi et al., 2019). It is thus to be expected that becoming embedded in a supply chain is a contingent event that creates a path dependency as the SME is forced to implement trade-compliance programs to comply with the requirements imposed by its downstream business partners. This process severely limits the autonomy of the SME decision-makers regarding the approach to trade compliance (Stekelorum, 2020). Consequently, the SME will implement repeatable and routine trade-control compliance tasks and processes, which, over time, lead to selfreinforcing path dependency (Sydow et al., 2009;Vergne and Durand, 2011). Based on these assumptions, the third hypothesis can be formed: H3 In SMEs that are predominantly integrated into a supply chain, there is a positive link between the share of revenues obtained by business-to-business relationships and the scope of the trade-control compliance programs that the SMEs have in place.

Sample, Measurement Issues, and Descriptives
The empirical analysis is based on a unique cross-sectional dataset of Swiss SMEs. Despite the lack of a universally accepted definition of an SME (Ribau et al., 2018), a widely used definition in German-speaking areas is the one provided by the Institut für Mittelstandsforschung (IfM) Bonn.
Here, SMEs are defined as firms with fewer than 500 employees (Hauser and Werner, 2009). Following this definition, the study sample is limited to firms with fewer than 500 employees in the German and French-speaking parts of Switzerland, corresponding to 580,397 companies (Federal Statistical Office, 2017). To ensure adequate coverage of each SME size category, a sample of 1354 SMEs was selected from the population by stratified random sampling using the stratification criterion of firm size (see Table 1). Of the SMEs in the initial sample, 289 SMEs participated in the online survey, corresponding to a response rate of 21%.
The online survey was conducted between January and May 2017. Before the survey was launched, the questionnaire was pretested with trade-control content experts, survey design specialists, and representatives of the target population who were not included in the final sample. The aims of the pretests were to eliminate ambiguous or misleading wording and errors and to assess the duration of the survey. In addition, the pretest helped avoid possible uniform answering patterns. The pretests were conducted by telephone, with the questionnaire being sent to the participants shortly before the interview. By leaving no time for preparation before the interview, the intention was for the participants to react as impartially as possible to the questions. The participants were asked to read and answer the questions out loud, thus disclosing any uncertainties and divergences of interpretation regarding the meaning of the questions. The results of the pretest revealed potential areas for improvement in terms of the simplicity and comprehensibility of individual questions. Based on these findings, the identified questions and answer options were redesigned in a more precise and coherent manner, thus improving the readability of the questionnaire. Furthermore, the pretest ensured that the data collection based on the finalized questionnaire generated valid and reliable data. Previous empirical research has revealed that key decision-makers in charge of related organizational activities provide accurate information when investigating a specific organizational phenomenon (Weaver et al., 1999a). For this reason, SME representatives familiar with trade-control requirements and any formal compliance measures their organization may have employed to meet those requirements were targeted. In 57% of the interviews, the target providing the information was either the ownermanager or the employed managing director of the SME.
In the remaining interviews, the person providing the information was a decision-maker either in the finance department (27%) or in other functions (16%) including legal and compliance, human resources, international business, or logistics.
Considering the portfolio of SMEs in the dataset, the average SME has been in operation for approximately 59 years and has 72 employees. SMEs that are predominantly integrated into a supply chain generate on average 86% of their revenues from B2B relationships. Conversely, SMEs that hold more of a lead position within the supply chain generate on average 8% of their sales through B2B interactions. For 54% of the surveyed SMEs, at least one warning indicator indicates that business activities are potentially affected by trade-control rules and regulations, and 28% have increased awareness of trade-control issues. A total of 54% of SMEs have implemented at least one tradecontrol compliance measure. Thirty-six percent conduct business abroad, 18% are active in the manufacturing sector, 15% are active in the trade sector, and 6% are active in the IT sector (see Table 1).
The descriptive results from the survey provide evidence that there are considerable differences between firms regarding the implementation of trade-control compliance measures. As shown in Table 2, in the group of SMEs with business activities not affected by trade control and that have low management awareness, only 37% have implemented at least one trade-control compliance measure. This number rises slightly to 43% in the group of SMEs with business activities that are also not affected by trade control but have high management awareness. Moreover, this figure increases to 61% in the group of SMEs with business activities affected by trade control and that have low management awareness; in the group of SMEs with business activities affected by trade control and possessing high management awareness, 81% have implemented at least one trade-control compliance measure. These descriptive results indicate clear differences among SMEs; such differences can be attributed to management awareness and the degree to which laws and regulations are applicable to each respective company.

Variables of major Interest
The four variables of major interest are the dependent variable scope of trade-control compliance program, and the three independent variables (1) red flag, (2) management awareness, and (3) B2B high.
The manifest dependent variable scope of trade-control compliance program quantifies the number of specific control measures that the SME has in place to ensure compliance with trade-control laws and regulations. Following the approach proposed by Weaver et al., (1999a) and Kaptein (2015), the scope is assessed with items asking objective questions about the SMEs' trade-control measures in a yes and no format. These items queried the presence of the ten aforementioned internal trade-control compliance measures recommended by national and international institutions (Secretariat of Wassenaar Arrangement, 2011; Dual-Use Coordination Group, 2018), with a composite measure then being formed by summing the yes-answers of all items. Higher scores on the scope variable reflected the presence of more trade-control compliance measures. The Cronbach's alpha coefficient of this measure is 0.87, which exceeds the recommended 0.70 threshold, indicating a very good internal consistency reliability of the items defining this variable (Hair et al., 2010).
The manifest independent variable red flag is an indicator variable that takes on the value of one as soon as at least , the variable was queried on the basis of 63 items that posed objective questions about SME business activities. These included questions regarding business relationships, which may potentially include critical countries, critical goods, critical recipients, or critical end uses. Due to the objective character of the items, the respondents did not need to know, nor were they asked, whether the surveyed business practices and situations constitute a trade-compliance risk. All items were recorded in a yes and no format. Three variations for operationalizing the red flag variable were considered. The first variation was the metric implementation of the underlying 63 items. However, Cronbach's alpha for the additive metric is only 0.215. Thus, from a methodological perspective, inclusion of the red flag variable as a metric variable is not an option. The second variation was based on the three dimensions of critical business activities identified based on a factor analysis (critical goods, critical countries, and critical business transactions). From this, a four-point scale was created ranging from 0 (no red flag) to 3 (red flags in all dimensions). The third variation dichotomized the circumstance of whether a critical business activity is present. Due to the performance in the models, the robust distribution, and because according to the State Secretariat for Economic Affairs SECO (2014) the presence of only one red flag already indicates that the business activities of the SME might be subject to trade controls, the dummy variable is used in the models presented in this paper. The independent variable management awareness was developed by drawing on the considerations of Ciochetto and Haley (1994), Weaver et al., (1999a), Winter andMay (2001), andNeugebauer (2004) highlighting that awareness can be related to knowledge of the prevailing rules and regulations. To capture the varied aspects of management awareness regarding trade-compliance-related issues, the respondents were asked to assess a battery of seven items with statements concerning trade-compliance-related issues (Frey, 2012). Specifically, respondents were invited to carefully rate the following statements: (a) Swiss companies must continuously and systematically check for discrepancies in the information provided by their customers on the intended use of the goods; (b) Swiss companies must continuously and systematically check whether their goods are on the goods control list; (c) Swiss companies must continuously and systematically check whether their customers are on a sanctions list; (d) Swiss companies must continuously and systematically check whether their customers come from countries subject to sanctions/embargoes; (e) foreign trade in goods, which, in addition to civilian use, may also be used for military purposes, is subject to official authorization; (f) only companies dealing with weapons and armaments are subject to trade controls in their foreign trade; (g) Swiss companies are never subject to the provisions of U.S. tradecontrol laws. For each item that was correctly assessed, the respondents scored one point. The points scored were added up to form the metric variable awareness. The internal consistency reliability of the items in the scale as measured by Cronbach's alpha is 0.82, exceeding the recommended minimum of 0.70 (Hair et al., 2010). A possible standardization of the awareness variable was considered; however, it led to a less robust model than the unstandardized version.
In the context of trade control, the position of an SME in the supply chain can also be linked to the scope of its trade-control compliance program. The study includes a split variable to describe the position of the SMEs within the supply chain. Due to the distribution of the variable B2B, which was originally given as a percentage, the assumption of a structural discontinuity between high and low B2B shares seemed to be likely, which was fixed by splitting the variable B2B into SMEs with high and low shares of B2B revenues. To avoid suffering any further information loss, the two new variables were each set to zero for the nonapplicable; however, the metric information was otherwise maintained. Thus, the manifest independent variable B2B low indicates SMEs that hold more of a lead position within the supply chain and generate a maximum of up to 50% of their revenues through business-to-business interactions. The manifest independent variable B2B high indicates that the SME is more integrated within the supply chain because it generates more than 50% of its revenues with business customers. It is important to note that both variables are metric variables, with B2B low running from 0 to 50 and B2B high accounting for > 50 to 100. Thus, B2B high and B2B low are not dichotomous variables. The reason for this procedure is to fade out the variation, on the one hand for the cases with more than 50% B2B sales, and on the other hand for the cases with up to 50% B2B revenues, respectively. Accordingly, these two variables do not add up to 100% because there is no linear dependence compared to a dichotomous variable and its reference category.

Control Variables
The econometric models also include various control variables, which can be related to the dependent variable. In the extant literature, the size of an organization is often used as an indicator of resource endowment (Hauser and Kronthaler, 2013) and the need to implement mechanisms of impersonal controls based on formal procedures. Against this background, the number of full-time employees worldwide of the SME in 2016 constitutes the variable firmsize. The study used logarithmic transformation to avoid the high impact of large values. In addition to firm size, firm age was measured in years as the establishment of the organization is often used as a proxy for resource endowment and organizational maturity. To account for the influences of possible age-specific factors, the variable firmage is included in the models. Because it can be expected that international business activities are more likely to be affected by trade-compliance-related issues, it is taken into account whether the SME operates in foreign markets. For this purpose, the control variable, foreign operations, is used in the models. This is a dummy variable that takes on the value of one if the company is engaged in foreign trade or has employed employees abroad. A company's sales growth can also indicate that the company must introduce more systems of impersonal controls based on formal procedures. Therefore, a dummy variable is included, taking on a value of one if the SME's sales have grown in the last two years and are expected to continue growing in the next 12 months. To control hierarchy-levelspecific distinctions, an indicator variable for whether the surveyed respondent is the owner-manager or employed managing director of the SME is included. The dummy variable CEO takes on a value of one if the key informant is the owner-manager or employed managing director of the firm, and zero otherwise. Because the surveyed SMEs operate in various sectors, three dummy variables, manufacturing, trade, and IT, are included in the models to identify possible industry-specific influences in the context of trade compliance. Furthermore, it should be noted that the sample is composed entirely of Swiss SMEs to alleviate institutional differences between countries, which may affect the degree of legal and regulatory restrictions regarding trade control. To control for institutional aspects on a regional level, a variable for the various language regions of Switzerland is also included in the models. The dummy variable language region takes on a value of one if the headquarters of the SME is located in the German-speaking part of Switzerland, and zero otherwise. Table 3 provides a comprehensive overview of the variables used in the empirical analysis.

Estimation Strategy
As discussed in the previous sections, it can be argued from a theoretical standpoint that the scope of the tradecontrol compliance program of an SME may be linked to its affectedness and decision-maker awareness as well as its position within the supply chain. For the econometric analysis of the ceteris paribus relationships between these factors, an OLS model of the following form is used: scope_compliance_program i = β 0 + β 1 awareness i + β 2 redf lag i + β 3 interaction i + β 4 B2B_high i + β 5 B2B_low i + β 6 (log)firmsize i + β 7 firmage i + β 8 foreign_operations i + β 9 performance i + β 10 CEO i + β 11 manufacturing i + β 12 trade i + β 13 IT i +β 14 language_region i + η i The dependent variable of the model scope of trade-control compliance program is a metric measure reflecting the number of trade-compliance procedures implemented by the company. The independent variables of main interest are red flag, decision-maker awareness, and position in the supply chain B2B high. All variables are described in Table 3. The data preparation and the recoding of variables were conducted in SPSS. All model estimations were performed using R. Before proceeding with the analysis, it is necessary to consider possible pitfalls as well as to perform various robustness checks. For this purpose, different models were estimated with variations of the dependent and independent variables.
First, the choice of the OLS regression model and additive metric required some justification given that the dependent variable is a limited sum-index (Lehmann et al., 1998). Thus, the first variation includes a multiple-correspondence-analysis-based dependent variable. This model shows a slightly better fit than the selected OLS regression model. The second variation of the dependent variable took into account a weighted index based on the frequency of occurrence of the individual measures. This model performed worse than the OLS model. Therefore, for the sake of an easier interpretation of the coefficients and due to the overall good fit of the OLS regression model, as well as the knowledge that it lies between the two other models in terms of fit, the study moved forward with the OLS model. Additionally, the robustness of the findings was tested using two Tobit models. The first had a range from zero to ten according to the OLS model, and the second Tobit model had one as the lower limit. The results of the Tobit models completely confirm the OLS model.
A second concern that must be considered relates to endogeneity and unobserved heterogeneity (Wooldridge, 2009). The decision concerning the scope of a compliance program is determined at the firm level and is therefore endogenous. Because the study depends on cross-sectional data, the best strategy to address the issue of endogeneity would be to identify a suitable instrument variable. However, due to the lack of an appropriate instrument, as many suitable control variables as possible must be included in the model, which of course does not eliminate the possibility that important predictors are missing in the model. While it cannot be completely ruled out that relevant variables were omitted in the model, the analyses do not provide any indication of unobserved heterogeneity. Moreover, to check whether the issue of endogeneity is of concern, a Durbin-Wu-Hausman test was performed, which did not result in any strong evidence (α = 0.05). In addition, there does not seem to be plausible theoretical evidence of endogeneity as no panel structure or other problems such as autocorrelations were detected (Hausman, 1978;Nakamura and Nakamura, 1981;Greene, 2018).
Another concern that must be addressed is the issue of multicollinearity. Table 4 reports the pairwise correlations between the variables included in the regression models. The  bivariate relationships indicate that the independent variables are generally not highly correlated with one another, indicating that there is no major risk for multicollinearity in the estimation results. This finding is also supported by the VIF values that are all below six, which also indicates that no multicollinearity is present in the analysis (O'Brien, 2007).
Furthermore, to check whether common method bias according to Podsakoff and Organ (1986) is of concern, a Harman's single factor test was performed. Common method bias is assumed to exist if a single factor emerges from unrotated factor solutions or if a first factor explains the majority of the variance in the variables (Podsakoff and Organ, 1986). The results of the unrotated factor analysis show five factors with eigenvalues greater than one, where the maximum variance explained by one single factor is only 18.2%. Thus, the results of Harman's single factor test indicate that this type of bias is not of concern in the study.

Multivariate Results
The regression analysis began by first obtaining a baseline specification of the model in which all control variables and the dependent variable (scope of trade-control compliance program) were included (see column 1). Columns 2 and 3 present models with the inclusion of awareness, red flag, B2B high, and B2B low as the further explanatory variable of interest and with inclusion of the interaction term of the two factors awareness and red flag, respectively. Both R-square and corrected R-square improve when the explanatory variables of interest and the interaction term are included in the model, which indicates a better model-fit of the fully specified model. The estimated coefficients of the regressions are shown in Table 5. It can be seen that the occurrence of trade-compliance red flags is statistically significantly linked to the scope of an SME's trade-control compliance program. The coefficient for red flag (model 2) is positive and significantly different from zero (β = 0.788; p < 0.01). Model 2 also shows a statistically significant link between decision-maker awareness and the scope of trade-control compliance programs in SMEs (β = 0.181; p < 0.01).
When adding the interaction term of red flag and awareness to the regression (model 3), the coefficient for the interaction term is positive and significant at the 1% confidence level (β = 0.253; p < 0.01), suggesting that the scope of the trade-compliance program of SMEs, which are affected by trade-control regulations, is broader when management is aware of trade-compliance requirements. Hence, the data support hypothesis H2. Regarding H1, the hypothesis seems to be supported if the interaction term is not considered (model 2). However, if the interaction term is included, no significant link is observed between the independent variable red flag and the scope of the trade-control compliance program (model 3, (β = 0.327; n.s.). Thus, the simple applicability of trade-control laws and regulations (red flag) without decision-maker awareness does not trigger the scope of the trade-control compliance programs implemented by SMEs. The same holds true for the awareness variable, which also becomes insignificant after including the interaction term (model 3, β = 0.059; n.s.). Hence, management awareness without red flags is not linked to the number of compliance measures in place.
To provide a more holistic and transparent way of understanding how the interaction works, the predicted outcomes were plotted. Figure 1 provides insights into how the predicted outcomes change for SMEs regarding whether they will or will not be affected by trade-compliance issues (red flag) as a function of the dummy variable management awareness (while leaving all other variables at their means).
Hypothesis H2 is also supported, and H1 is also not confirmed by the data when the awareness-moderated effects are visualized (see also Table 6).
The difference in the implementation of trade-control compliance measures between SMEs affected by tradecompliance issues (red flag) and those with or without management awareness continues to be considerable and significantly different from zero when controlling for other contextual factors (14 percentage points) (see Table 7). In addition, in the group of SMEs with business activities affected by trade control, the number of SMEs with no trade-control compliance measures in place declines by ten percentage points when management is aware of the issue. In contrast, the variance in the predicted conditional outcome between SMEs not affected by trade-compliance issues (red flag) and those with or without management awareness disappears when controlling for other contextual factors (zero percentage points).
When considering the results regarding hypothesis 3, the coefficient for B2B high is negative and significantly different from zero, while the coefficient for B2B low is not significant (model 2). These effects can also be found in the fully specified model (model 3, β = − 0.008; p < 0.05 (B2B high); β = 0.003; n.s. (B2B low)). Hence, the models provide evidence that there is a statistically significant negative link between the position of an SME in the supply chain and the scope of its trade-control compliance program. It can thus be said that companies that are highly integrated into a supply chain have a less comprehensive trade-compliance program than companies that lead their supply chain. With this in mind, H3 is not borne out of the data, but rather the results indicate the opposite.

Discussion and Conclusion
This paper contributes to academic debates regarding organizations' heterogeneous responses to external pressures (Oliver, 1991;Schuler and Rehbein, 1997;Desai, 2016;Wang et al., 2016). In particular, factors contributing to the scope of formal control programs to manage trade-related ethics and compliance risks were examined (Weaver et al., 1999a;Kaptein, 2015). By scrutinizing the influence of the applicability of prevailing laws and regulations on SME activities and management awareness, as well as the position in the supply chain, the present study makes several theoretical and managerial contributions to the extant literature.

Theoretical Contributions
Building on the literature on organizations' responses to the demands of their environment (Oliver, 1991;Schuler and Rehbein, 1997;Desai, 2016;Tatoglu et al., 2020), the  Fig. 1 Visualization of the interaction effect study empirically assesses factors that influence the scope of formal ethics and compliance programs, which are used to manage trade-related risks. The adoption and change of organizational structures have often been attributed, in the extant literature, merely to mimetic, normative, and/or coercive processes (DiMaggio and Powell, 1983;Hauser and Hogenacker, 2014). Nevertheless, this one-sided concentration on external factors implies a narrow and deterministic view of an organization's compliance programs. By contrast, the strategic response perspective emphasizes the active role of organizations' decision-makers (Child, 1972;Oliver, 1991;Weaver et al., 1999a;Tatoglu et al., 2020). By showing that an organization's decision-makers have some agency when making managerial decisions about issues such as the design of organizational structures, this conceptual view helps explain the variations in the structural design of organizations that are confronted with similar expectations and pressures from the organizational environment (Edelman, 1992;Desai, 2016). According to the strategic response perspective, decision-makers can act either reactively, by responding only to real or perceived external pressures, or proactively, by exercising their freedom of choice (Child, 1997). First, the results of the present research contribute to the prior literature by indicating that decision-makers are not limited to acting either proactively or reactively regarding ethics and compliance-related issues; they can also react proportionately. Drawing on recent literature in political science , an organizational response can be considered proportionate if a balance exists regarding its Robust standard errors are depicted in parentheses. Statistical significance is depicted by *p < 0.1, **p < 0.05, ***p < 0.01 a Company's management has increased awareness of trade-compliance issues (at least five correct assessments) [1 = Yes, 0 = No] Disproportionate organizational responses come in two forms, specifically, overreaction and underreaction. Overreaction is a situation where the organizational response places a cost on the organization that is too high in light of its benefits and therefore represents a disproportionate burden. An underreaction, on the other hand, is when the response taken is weaker than called for by the situation (Maor, 2017). The empirical findings indicate that wellinformed SME decision-makers react proportionately to the requirements imposed by laws and regulations, meaning that the organizational response they take is directly proportionate to the company's objective level of trade-compliance risk (see Table 8).
If they deliberately conclude that their companies are not affected by trade-compliance-related issues, they refrain from investing in costly overdimensional compliance programs. However, when well-informed decision-makers are aware that their companies' business activities and relationships are affected, they address the issue with sustained compliance programs to mitigate the associated risks. Thus, well-informed decision-makers serve their organizations in both circumstances. In the former case, they do so by keeping compliance costs to a minimum and by maintaining a lean organizational structure that allows the organization to remain competitive and agile. In the latter case, they do so by reducing the organization's liability exposure in the area of trade compliance and by limiting the risk of legitimacy crises caused by violations of the trade-control laws and regulations. Conversely, uninformed decision-makers respond disproportionately in the form of an underreaction because they do not enact all necessary and reasonable organizational precautions to adequately prevent violation of the trade-control laws and regulations.
The latter point is associated with the second contribution of this article. Laws and regulations establish the framework that determines how companies are allowed to conduct their business. Thus, laws and regulations play a principal role in the environment of organizations (Oliver, 1991;Venard, 2009). In the extant literature, there are two distinct streams discussing organizational behavior in relation to laws and regulations. On the one hand, it is assumed that decision-makers can go above and beyond what is required by applicable laws and regulations; however, they cannot go below those minimum requirements (Tatoglu et al., 2020). On the other hand, there is an extensive discussion regarding the role of decision-makers in corporate wrongdoing, where decision-makers deliberately act below the standards required by law (Zahra et al., 2005;Schnatterly et al., 2018). The results of the present research show that the relationship between the applicability of trade-control laws and regulations for SMEs' day-to-day operations and the scope of their implemented trade-control compliance program is not always proportionate. This is particularly the case when key decision-makers are not well aware of the legal restrictions, relevant regulations, and approval requirements, opening up the possibility for unintentional and unconscious violations of prevailing laws and regulations. Accordingly, the empirical findings show that organizations might inadvertently fail to comply with regulatory requirements due to oversight on behalf of the key decision-makers. Third, the present study contributes to and extends the conceptual understanding of the interplay between external pressures and managerial decision-making. The empirical results provide evidence that the organizational structures to safeguard trade-control compliance of SMEs reflect the proportionate responses to regulatory pressures; however, they do so only if the key decision-makers are well informed and aware of the prevailing laws and regulations. The study thus adds to ongoing attempts in the literature to explore the interface between the conflicting positions regarding determinism versus managerial agency in organizational structuring (Bourgeois III, 1984;Hambrick and Finkelstein, 1987;Hitt and Tyler, 1991;Tatoglu et al., 2020). Unlike the existing literature (e.g., Child, 1997), the findings of the present study indicate that it cannot be taken for granted that all decision-makers share a complete and common understanding of the prevailing legal and regulatory framework conditions. This phenomenon is particularly true when demands and expectations within the organizational environment are subject to fast-paced and constant change and not entirely clear-cut, as is the case in trade control (Goodrick and Salancik, 1996;Scherer et al., 2014;Rosanelli, 2016). The environment imposes certain requirements on the organizational design of trade-control programs, which would call for deterministic response patterns from organizations. However, whether organizations implement proportionate internal control measures to prevent and detect violations of trade-control requirements ultimately depends on the stance of its key decision-makers. Hence, decision-makers can also act inadequately and thus not in the best interests of their organizations. This indicates that when exploring the design of organizational structures, the concept of bounded rationality (Simon, 1957)-relating to the limited cognitive capacities of the decision-makers-must be considered in addition to the concept of bounded autonomy (Child, 1997)-relating to the limited scope of action set by the organizational environment.
Finally, the results of the present study provide new insights into the extent to which SMEs within supply chains are dependent on the path established by downstream business partners (Sydow et al., 2009;Vergne and Durand, 2011). Based on the literature, it was expected that SMEs that are predominantly active in business-to-business relationships would be forced to implement trade-control compliance programs of a greater scope. However, in contrast to the expected path dependency, the results show a negative link between the supply chain position and the scope of the trade-control compliance programs implemented by SMEs. It can be postulated that this negative link can be attributed to one of two scenarios. On the one hand, the results indicate that SMEs do not receive substantial pressure from their downstream business partners to implement comprehensive trade-control compliance programs, potentially because the downstream supply chain partners have already well-established trade-control compliance programs that are able to take responsibility for ensuring compliance with trade regulations for the entire supply chain. Thus, the SMEs would not need a wide-ranging compliance program on their own. However, for downstream business partners to be able to maintain a truly effective trade-control compliance program, they must receive regular information from their upstream business partners in the supply chain so that they have a holistic view of what is being done to ensure trade compliance. SMEs may not be able to provide the necessary information to their downstream supply chain partners without having their own trade-control compliance measures in place. On the other hand, the results indicate that SMEs in business-to-business relationships might have a considerable degree of autonomy regarding how they address trade-compliance issues. The reduced scope of trade-control compliance programs witnessed in the sample suggests that SMEs that are not supply chain leaders might neglect their responsibility towards trade-control compliance and instead attempt to pass it on to their downstream supply chain partners. This oversight of responsibility for trade-control compliance raises the question of liability in the case of noncompliance in the supply chain.

Practical Relevance
The findings of the present study also have central repercussions for SME management practice and policymakers. It can be said that most managers and decision-makers would concur that organizations should conform to applicable laws and regulations (Weaver et al., 1999a). However, these good intentions can be challenged or even foregone in an organizational environment where those in charge of decision-making processes are principally expected to meet tight deadlines, realize high revenue targets, and maximize shareholder value in the short term (Paine, 1994;Rae and Subramaniam, 2008;Albrecht et al., 2008). It is frequently the case that decision-makers must decide on whether to allocate scarce resources to direct business activities or to indirect functions such as compliance and risk management. This situation is particularly more pertinent for SMEs with only limited financial and human resources (Hauser and Werner, 2015;Paul et al., 2017). Because resources are typically scarce in SMEs, management is also actively involved in day-to-day operations. For this reason, SMEs often find it difficult to reconcile their daily work with the fulfillment of additional tasks such as risk and compliance management (Hauser and Werner, 2009). Compliance is therefore often seen as a major administrative burden for SMEs as its effectiveness and efficiency have yet to be fully seen and comprehended by these companies (Hillary, 2004;Bitektine, 2011;Jorge and Basch, 2013). Additionally, due to the multifaceted roles of management in SMEs, management members scarcely have the resources available to familiarize themselves and be properly informed about the regulatory framework with which they must comply. Considering the study's descriptive data, it was observed that SME decision-makers typically have a low awareness of trade-compliance requirements, with only a minority demonstrating that they have a high awareness. Moreover, it was also noted from the interactions with key decision-makers of SMEs that misunderstandings and misinterpretations of the extant laws, possibly leading to noncompliance, are also common among SMEs. Nevertheless, noncompliance with the expectations and requirements of the external environment makes an organization subject to the risk of severe consequences, including the imposition of penalties, sanctions, and restricted access to resources critical for the survival and growth of the organization, regardless of whether such noncompliance is driven by a lack of awareness or misinterpretation. In accordance with the legal principle "ignorance of the law is no excuse" (Black, 1968, p. 994), a lack of awareness regarding the applicable laws and regulations or existing resource constraints cannot justify legal infringements (Frey, 2012). Hence, SMEs must take appropriate precautions to avoid noncompliance. For this reason, it can be suggested that trade compliance should be given more management attention by SME decision-makers and should become a strategic priority not only for larger corporations but also for SMEs.
Further, it is clear from the analysis that a good general knowledge of the prevailing rules and regulations by key decision-makers in SMEs is associated with a proportionate organizational response to the level of trade-compliance risk. Nevertheless, ensuring compliance still tends to be viewed by as a "necessary evil" (Kuruppu et al., 2018), with compliance-related tasks being left to the responsibility of a compliance officer or anchored at a low level in the hierarchy (Palmer, 2015). In line with the recently published International Organization for Standardization (2020) guidelines for managing legal risks, the findings of this study highlight the importance of compliance under the leadership of the senior executives, indicating that management must take ownership of compliance.
Furthermore, the present study shows that SMEs that are highly integrated into the supply chain are less likely to have a comprehensive compliance program, which might suggest that SMEs instead "pass the buck," so to speak, in terms of passing their responsibility for ensuring trade compliance onto their downstream supply chain partners. This leaves the door open for trade-compliance violations within the firm's own operations, of which SMEs may not be aware, further emphasizing the need for decision-makers at SMEs to be aware of the prevailing risks surrounding trade compliance, even if they are not forced to implement trade-control compliance programs by external stakeholders such as public authorities or downstream supply chain partners.
The results of the present study also show greater implications for political, public, and private entities supporting SMEs. It may be futile to simply tell SMEs that they should be more aware of the regulatory frameworks surrounding trade compliance since it is this lack of awareness that must be addressed to begin with (Hauser and Werner, 2015). Instead, to facilitate SME compliance with trade-control requirements, appropriate and accessible practical advice should be offered by policymakers, public authorities, and self-governing organizations of the private sector such as chambers of commerce. These institutions should intensify their efforts to raise awareness of trade-compliancerelated issues. These SME-targeted activities could include events, presentations, trainings, round tables, brochures, and (online) articles, providing information outlining the prevailing laws and regulations as well as practical advice on dealing with the trade-control requirements in a business practice with limited resources. In accordance with the results of the present research, awareness-raising activities should target key decision-makers in SMEs who are in a position to influence the structure of the organization. The intention should be to encourage the implementation of proportionate internal control measures to prevent and detect violations of tradecontrol requirements.

Limitations and Future Research
When interpreting the results, a number of limitations should be considered. First, because the analysis is founded on a cross-sectional dataset, the usual limitations of this research design apply, including that the models only provide associations. Second, the scope of investigated SMEs is limited to those with fewer than 500 employees. Companies of this size account for 99.9% of all Swiss enterprises (Federal Statistical Office, 2017). However, as found in the literature, management in SMEs differs from management in large corporations. Further research could strive to address how large companies respond to external expectations and pressures in terms of trade control. The research could also explore how managerial prudence is applied with respect to the organizational structure and scope of the related compliance programs. Third, the dataset used in this paper covers SMEs from Switzerland. Switzerland's economy is small and open, with long-established reputable and credible law enforcement institutions. In this respect, further research could focus on other organizational environments, including emerging economies with less-formalized institutions, to explore the role of decision-makers within such environments. Fourth, the present study focuses on formal compliance programs as recommended and sometimes required by the relevant governmental bodies. However, the literature indicates that there might be some SME-specific factorsincluding trusting relationships-that could enable SMEs to ensure compliance even when they do not rely on such formal control programs (Baumann-Pauly et al., 2013;Wickert, 2016;Egels-Zandén, 2017). Further research could address this topic by scrutinizing the informal control approaches used by SMEs and their effectiveness. Finally, the dataset does not offer explicit insight into the demographics of the supply chain, for instance, information regarding the level of dependence of the SMEs on their respective individual downstream supply chain partners, or the size of an SME's partners, or the number of its B2B relationships. Future research could therefore seek to explore these factors in relation to the implementation of trade-control compliance programs.
While these limitations imply that some prudence is needed when generalizing the findings, the findings are believed to make significant contributions to ongoing academic debates on organizational response to external pressures as well as to risk and compliance management. The results indicate that the organizational structures to ensure that SMEs comply with trade-control requirements reflect the proportionate response to external pressure but only if decision-makers are well informed and aware of said rules and regulations. Conversely, uninformed decision-making leads to a lack of proportionate response, resulting in an unsuitable and inadequate compliance program. In addition, SMEs that are highly integrated into supply chains also seem to neglect their responsibility regarding trade compliance.