Advancing the management control systems-as-a-package: designing external resilience controls for climate-exposed agricultural industry

Agricultural firms operate in an environment characterized by intensifying climate variability, biological uncertainty and geopolitical intervention, and the palm oil sector sits at the center of these pressures (Lebdioui, 2022; Masitah et al., 2023; Sun et al., 2023; Syahid et al., 2025; Zhao and Ju, 2025). El Niño-Southern Oscillation (ENSO) driven rainfall deviations, heat stress, pest outbreaks (De Winne and Peersman, 2021; Masitah et al., 2023; Panthi et al., 2026) and evolving regulatory regimes such as EU Deforestation Regulation (EUDR) shape operational and financial outcomes (Declerck et al., 2023; Nadras et al., 2024; Su et al., 2015; Varkkey et al., 2018; Zhao and Ju, 2025). These dynamics intensify external volatility in climate-exposed, commodity-based sectors, shifting performance variance from internally generated to externally driven and initiating decision cycles through climate, technological and geopolitical signals.

Parallel development in the accounting literature has highlighted a persistent academic practice divide in management control research (Clor-Proell et al., 2025; Jansen, 2018; Thottoli et al., 2024). While existing management control system (MCS) frameworks acknowledged uncertainty and incorporate interactive controls, resilience and digitalization (Bracci and Tallaki, 2021; Hosoda, 2018; Laguir et al., 2019; Nuhu et al., 2019; Papiorek and Hiebl, 2024), they remain fundamentally organized around internally generated variance, human-interpreted feedback loops and periodic reporting cycles. Climate-exposed agricultural firms illustrate this limitation vividly: real-time climate dashboards, satellite-based fire risk alerts, artificial intelligence (AI)-based agronomic recommendations and geopolitical compliance platforms influence planning, monitoring and governance, yet these mechanisms fall outside the conceptual boundaries of existing MCS categories (Herath, 2007).

This argument is grounded in contingency-based (Granlund and Lukka, 2017) and open systems perspectives (Bracci and Tallaki, 2021; Herath, 2007; Nuhu et al., 2019), which view control systems as shaped by environmental uncertainty and continuous exchanges with the external environment. Rather than treating external volatility and internal control as separate domains, this study theorizes their interdependence: external contingencies generate signals and constraints, and MCS packages provide the mechanisms through which these signals are sensed, interpreted and embedded into action. External volatility intensifies the coupling between external contingencies and internal controls, as climate, biological and geopolitical signals trigger responses that MCS interpret, filter and translate into action.

The agricultural industry provides a suitable context for examining this problem because its financial and operational outcomes are exposed to external volatility. Commodity price cycles affect revenue and margins, climate and biological conditions influence yield (Panthi et al., 2026) and extraction performance and geopolitical requirements shape market access and compliance routines (Declerck et al., 2023; Nadras et al., 2024; Su et al., 2015; Varkkey et al., 2018; Zhao and Ju, 2025). At the same time, agricultural firms rely on climate dashboards, satellite monitoring, AI agronomy tools, mobile field applications and traceability systems to translate external signals into internal responses. These observations motivate the need to examine how external volatility becomes connected to internal control routines.

The intensification of external volatility exposes a conceptual and practical gap in existing MCS frameworks: they do not specify how high-frequency external signals are sensed, codified and translated into control triggers (Keating, 1994), nor how such signals initiate internal action in volatile environments (Herath, 2007), or become embedded in routines in systematic ways. This gap motivates the development of external resilience controls (ERCs), which reconceptualize climate, technological and geopolitical signals as structured control mechanisms rather than contextual conditions.

Accordingly, the study delineates the conditions under which external signals acquire triggering authority and clarifies how ERCs differ from risk indicators, interactive controls and digital controls. Establishing this boundary ensures that ERCs are understood as a distinct control group – one that formalizes how externally generated volatility initiates internal decision cycles within the MCS package.

The objective of this study is to conceptualize and evaluate ERCs as a distinct control group that formalizes how agricultural firms translate external volatility into internal planning, cybernetic, administrative, reward and cultural controls. Unlike risk management, environmental MCS or digital control tools, ERCs theorize external signals as control agents that can trigger action, shape decision cycles and become embedded in governance structures. Using a design science research (DSR) approach and empirical patterns from 12 listed agricultural firms in Southeast Asia, the study specifies the upstream mechanisms – sensing, thresholding, authorization and embedding – through which external signals acquire control-triggering authority within MCS-as-a-package. To guide this development, this study examines two research questions:

Beyond extending Malmi and Brown’s (2008) MCS-as-a-package, this study intervenes in two central strands of management control research. It first strengthens open systems perspectives (Bracci and Tallaki, 2021; Herath, 2007; Nuhu et al., 2019) by theorizing how external signals gain triggering authority and become intertwined into planning, monitoring and governance routines. ERCs conceptualize this process as a boundary-spanning layer that channels external volatility into the established control groups – planning, cybernetic, administrative, reward and cultural.

The study also contributes to emerging work on digital and algorithmic control (Arnaboldi et al., 2022; Papiorek and Hiebl, 2024) by showing how climate dashboards, AI agronomy systems and compliance platforms operate as non-human control agents that shape organizational routines.

Together, these insights specify how external signals become control relevant. ERCs explain how climate, technological, market and geopolitical conditions are sensed, codified into thresholds, authorized through decision rights and embedded across the MCS package. This mechanism offers a design-oriented extension to the MCS-as-a-package by clarifying how external volatility becomes a recurrent trigger for internal control routines.

The paper proceeds as follows: Section 2 reviews relevant MCS and resilience literature; Section 3 presents empirical evidence of external volatility; Section 4 outlines the DSR methodology; Section 5 develops and introduces the ERCs mechanism and framework; Section 6 demonstrates its application; Section 7 evaluates its utility; Section 8 discusses implications; and Section 9 concludes with contributions, limitations and future research directions.

Management control research offers a rich set of frameworks for understanding how organizations guide behavior, coordinate activities and respond to uncertainty. Much of this work, however, has been shaped by assumptions of relatively stable environments and internally generated variance, where control routines are designed around human interpretation of internal performance signals (Herath, 2007; Malmi and Brown, 2008).

In climate-exposed agricultural sectors, this internal orientation becomes limiting as external shocks – climate anomalies, biological cycles, market disruptions and geopolitical interventions – arrive faster than periodic reporting cycles can accommodate (Hoffmann et al., 2017; Kamil and Omar, 2017; Nadras et al., 2024; Panthi et al., 2026; Zhao and Ju, 2025). This review synthesizes two analytical tensions salient in volatility-intensive settings: the tension between internal and external orientations in control design, and the tension between human and algorithmic forms of control agency.

Management control research has emphasized internally focused mechanisms – targets, feedback loops, variance analysis and human interpretation of performance signals (Herath, 2007; Malmi and Brown, 2008). Digitalization studies similarly prioritized internal data accuracy rather than the capacity to sense external volatility (Papiorek and Hiebl, 2024). Institutional and budgeting research also centers on internal alignment rather than external triggers (Schäffer et al., 2015; Watts and McNair‐Connolly, 2012). Although strands of research on interactive controls, resilience and sustainability acknowledge uncertainty (Bracci and Tallaki, 2021; Laguir et al., 2019; Nuhu et al., 2019; Riccaboni and Leone, 2010), they continue to treat external forces as contextual contingencies rather than as mechanisms embedded within control routines. This reflects a broader assumption in contingency-based MCS research: the environment shapes control design but remains conceptually outside the control system.

To clarify boundaries, this study distinguishes external inputs (signals used as information) from external control mechanisms, which institutionalize external signals into internal control architectures through five mechanisms: external sensing, threshold codification, interpretive authorization, control translation and organizational embedding. This structural framework differentiates ERCs from three related concepts: risk indicators, which monitor exposures without triggering action; interactive controls, which rely on human interpretation rather than externally codified thresholds; and digital controls, which enhance data processing speed but remain internally oriented (Papiorek and Hiebl, 2024).

By contrast, ERCs specify how externally sourced, data-rich signals – such as climate anomalies, AI-generated agronomy intelligence or geopolitical constraints – are formalized into active control mechanisms. Rather than serving as a mere extension of existing constructs, ERCs operate as a conceptually distinct control group within the management control package by formalizing how external volatility transitions from a passive contextual input into an active initiating mechanism.

External signals acquire this control-triggering agency only when four conditions are jointly satisfied: they are captured via structured sensing infrastructures, codified into definitive thresholds or escalation rules, linked to decision rights that authorize responses and embedded directly into governance controls like budgets or key performance indicators (KPIs). By automating how these external inputs alter the timing, authority and consequences of control actions, ERCs systematically shape organizational behavior – explicitly distinguishing them from risk indicators that monitor without triggering, interactive controls that rely on human interpretation and digital controls that remain internally focused.

A second analytical tension concerns the source of agency within control systems. Existing MCS frameworks assume humans diagnose deviations and initiate corrective action, even in digitalized settings (Papiorek and Hiebl, 2024). Yet climate-exposed agricultural firms rely on algorithmic and sensor-based systems – AI agronomy models, Internet of Things (IoT)-enabled soil and rainfall sensors, satellite-based fire risk alerts, digital twins and mobile app ecosystems – that detect anomalies, generate recommendations and trigger operational responses with limited human reinterpretation.

These technologies blur the line between information input and control mechanism, raising questions about how non-human agents participate in control routines (Arnaboldi et al., 2022). While MCS research has begun to acknowledge digitalization, it has not yet fully theorized how algorithmic triggers, automated sensing or externally sourced data streams function as control mechanisms. To address conceptual ambiguity in the literature, this study adopts explicit criteria for what qualifies as a control mechanism within an MCS.

A mechanism is considered a control mechanism when it meets at least three of the following four criteria: it can initiate or activate a control response (Tessier and Otley, 2012); it is embedded in planning, monitoring, governance or incentive routines (Ferreira and Otley, 2009; Malmi and Brown, 2008); it systematically shapes decisions, actions or performance expectations (Ahrens and Chapman, 2004; Tessier and Otley, 2012); and it is linked to organizational objectives, risk thresholds or compliance requirements (Ahrens and Chapman, 2004; Ferreira and Otley, 2009). These criteria distinguish control mechanisms from environmental inputs, contextual pressures or generic information signals and provide a conceptual foundation for analyzing how external signals may become embedded in control routines in volatility-intensive settings.

Agricultural production operates within an open system characterized by high exposure to climate variability (Kamil and Omar, 2017; Panthi et al., 2026; Syahid et al., 2025), biological cycles (Hoffmann et al., 2017), global commodity markets (Zhao and Ju, 2025) and geopolitical interventions (Nadras et al., 2024; Su et al., 2015). In the palm oil sector, these forces interact to create extreme volatility in crude palm oil (CPO) prices and production outcomes (De Winne and Peersman, 2021). Each category of volatility challenges a different assumption embedded in conventional control routines: climate affects yields and extraction rates; biological factors introduce long-term structural variability; market forces amplify price swings; and geopolitical regulations reshape market access and compliance requirements (Suhardjo et al., 2024; Suhardjo and Suparman, 2025).

Technology-driven systems – AI agronomy, IoT sensors, drone surveillance, satellite imaging and integrated WebGIS–SAP platforms – have become central to sensing and responding to these conditions. Although digitalization is acknowledged in MCS research, technology is still largely conceptualized as an enhancer of internal feedback accuracy rather than as a mechanism that interacts directly with external volatility (Papiorek and Hiebl, 2024). However, these technologies act as non-human controllers that sense, predict and trigger action in response to external conditions (Hosoda, 2018; Laguir et al., 2019).

The literature reveals that although MCS research has evolved to incorporate uncertainty, resilience and stakeholder engagement, it remains anchored in an internal, human-interpreted architecture that does not fully account for real-time external triggers or algorithmic forms of control. Existing frameworks offer limited constructs for mechanisms capable of sensing, interpreting and operationalizing external environmental, market or geopolitical signals.

They provide little guidance for real-time external data integration such as climate dashboards, rainfall deviation alerts, fire risk indices or satellite-based crop monitoring, nor do they conceptualize algorithmic decision agents such as AI agronomy models, digital twins, IoT-triggered actions or automated traceability systems that function as non-human controllers. Even studies emphasizing resilience (Bracci and Tallaki, 2021), strategic flexibility (Nuhu et al., 2019) or stakeholder integration (Hosoda, 2018; Laguir et al., 2019) continued to treat external forces as inputs into internal controls rather than as mechanisms that shape control routines directly.

These limitations are particularly salient in climate-exposed agricultural sectors, where external signals arrive rapidly, carry operational and financial consequences and interact with digital and sensor-based systems. Climate anomalies, regulatory shifts and market disruptions often materialize faster than internal reporting cycles can accommodate, creating control challenges that existing frameworks are not designed to address.

The next section therefore examines the empirical context of external volatility in Southeast Asian agricultural firms to illustrate external signals, technological infrastructures and control challenges that motivate the need for an expanded control architecture.

Agricultural firms in Southeast Asia operate within one of the most volatility-intensive production environments globally, where climate shocks, biological cycles, commodity market fluctuations and geopolitical interventions interact to shape operational and financial outcomes. To describe the scale and nature of this volatility, this study analyses six years of financial and operational data (2019–2024) from 12 listed agricultural firms across Singapore, Indonesia and Malaysia. The empirical patterns that emerge illustrate how external forces manifest and provide the contextual grounding for examining how firms respond to volatility through their control systems.

The 12 firms collectively manage approximately 3.08 million hectares of planted area (see Table 1), representing around 15% of the combined oil palm area of Indonesia and Malaysia. These two countries account for roughly 20.8 million hectares of global planted area and produce approximately 85% of the world’s palm oil (Varkkey et al., 2018). The sample therefore reflects the operational, climatic and geopolitical realities of the global industry’s core production zones (Hoffmann et al., 2017).

The sample firms are analytically illustrative and structurally relevant: they provide information-rich cases of external volatility, digital sensing, sustainability compliance and MCS practices, and they represent a substantial planted-area base across Indonesia–Malaysia with diverse business models (upstream, integrated, export-oriented and domestic).

CPO prices fluctuated sharply over the six-year period, with year-on-year changes ranging from −30% to +70%, making 2022 the peak price year and 2019 the trough (see Figure 1). Volatility was not only pronounced across years but also within individual years, with several months experiencing abrupt price swings. Annual reports described these movements as difficult to manage, underscoring the speed of external shifts.

The magnitude of price movements was evident across all three country clusters. Singapore-listed firms experienced average annual deviations of −28% to +69%, Indonesian firms −8% to +27% and Malaysian firms −17% to +45% (see Table 2). These patterns reflect the global nature of CPO price formation and the limited ability of individual firms to buffer against external market swings.

Revenue deviations between −26% and +70% broadly track CPO price movements (see Table 3), indicating a strong price transmission effect. However, revenue volatility also reflects volume, crop availability and market exposure. Return on equity (ROE) exhibited even greater variability, with swings from negative values to multi-fold increases – up to +856% for Singapore-listed firms, +660% for Indonesian firms and +107% for Malaysian firms (see Table 4). CPO price swings remain a recurring external signal that firms must integrate into budgeting, forecasting and margin monitoring.

The spread between high- and low-performing firms in gross margin, earnings before interest, tax, depreciation and amortization (EBITDA) margin and ROE (see Table 5) aligns with the magnitude of external price shocks. These patterns indicate that external price volatility is a major influence on financial performance across the sample period.

Across the six-year period, the combined financial, operational and geopolitical patterns indicate that external volatility plays a major role in shaping performance outcomes for the firms in the sample. Price movements, climate-sensitive yields and regulatory shifts materialize rapidly and with substantial magnitude, often exceeding the pace at which internal reporting and planning cycles operate. These empirical patterns provide the contextual basis for examining how firms respond to externally driven shocks and why the integration of external signals into organizational routines has become salient.

Operational volatility provides a second diagnostic dimension for the ERCs artifact. The relevance of fresh fruit bunch (FFB) yield, oil extraction rate (OER) and palm product yield, as reported by almost all firms, reveal different degrees of controllability within agricultural performance measurement. This distinction matters for MCS design because externally conditioned variance (FFB yield) and internally controllable variance (OER) require different control responses.

FFB yield showed the largest deviation, reflecting its sensitivity to rainfall deviation, drought and heat stress (see Table 6). This makes FFB yield the most climate-sensitive indicator in the data set and a major source of performance divergence. In contrast, OER displayed much smaller variation, as it is primarily influenced by mill processing technology, extraction efficiency and operational discipline – factors that tend to be more stable over time. Firms with modern mills and stronger process control achieved consistently higher OER, but the overall spread remained narrower than for FFB yield (see Table 4).

Palm product yield, calculated as FFB yield multiplied by OER and scaled by mature planted area, naturally inherits the volatility of both components. The spread in palm product yield was driven mainly by climate-induced fluctuations in FFB yield rather than by differences in mill technology.

Sales distribution patterns show that most firms are structurally exposed to external markets regardless of where their plantations are located. Singapore-listed firms export roughly 40% of their production outside Indonesia, making them sensitive to global price formation and international regulatory shifts (Declerck et al., 2023; Nadras et al., 2024; Zhao and Ju, 2025). Malaysian firms export close to 70% of their output, embedding them deeply in global supply chains and sustainability-driven market requirements (Declerck et al., 2023; Nadras et al., 2024; Zhao and Ju, 2025). Indonesian firms are comparatively more domestically oriented, yet remain exposed to global dynamics through benchmark pricing, biodiesel mandates, export levies and currency movements (Cisneros et al., 2021; Suhardjo et al., 2024; Suhardjo and Suparman, 2025).

This external orientation amplifies the influence of geopolitical and legitimacy pressures, including EUDR and NDPE compliance requirements, sustainability expectations from international buyers, biodiesel policy shifts (B30–B50), currency volatility in Indonesian Rupiah and Malaysian Ringgit and evolving trade tensions and tariff regimes. These forces shape revenue stability, market access and cost structures across the sample period.

Across financial, operational and geopolitical dimensions, the empirical evidence demonstrates that agricultural firms in Southeast Asia operate in an environment where external volatility is pervasive, rapid and consequential. The patterns observed in the six-year data set illustrate climates, market and regulatory shocks that firms encounter and the speed at which these shocks materialize.

These shocks also shape multiple elements of the MCS package: external market access and regulatory signals alter planning assumptions, become monitored cybernetic indicators, create administrative compliance structures, influence sustainability-linked incentives and reinforce cultural expectations around traceability and legitimacy. This empirical context motivates the need to examine how firms translate external volatility into internal responses and provides the foundation for the development of ERCs. We observe co-movement consistent with transmission from external price volatility to financial outcomes; causal inference is beyond the scope of this study.

This study adopts a pragmatic constructivist paradigm aligned with DSR’s aim of developing practice-relevant artifacts (Clor-Proell et al., 2025; Thottoli et al., 2024). Pragmatism emphasizes problem-solving utility (Baker and Schaltegger, 2015; Nørreklit, 2014, 2020), while constructivism recognizes frameworks as context-shaped solutions (Nørreklit, 2014, 2020), supporting an ERC’s design built from observed practices, refined through empirical patterns and evaluated for conceptual coherence and practical usefulness rather than causal testing.

This study follows a full DSR methodology by identifying the volatility problem, designing the ERCs framework, demonstrating it through multi-company evidence and evaluating maturity across firms. ERCs are developed as a new control group extending Malmi and Brown’s (2008) MCS-as-a-package, addressing a conceptual gap in how external signals are theorized within control systems. DSR is well suited to contexts where existing theory is insufficient to explain emerging phenomena and where the research objective is to design a framework that provides a utility-enhancing solution (Gregor and Hevner, 2013; Myers et al., 2024).

In accounting and AIS research, DSR has been recognized as a methodology capable of addressing practice-relevant problems by creating frameworks that improve organizational decision processes (Albanese, 2023; Myers et al., 2024). This makes DSR particularly appropriate for climate-exposed agricultural firms, where external volatility – not internal processes – now shapes performance and where existing MCS frameworks lack constructs for real-time external triggers.

The sample of 12 agricultural firms represents approximately 15% of the planted area in Indonesia and Malaysia (Varkkey et al., 2018), ensuring structural industry coverage rather than idiosyncratic cases. The analysis draws on two complementary data sources: (1) six-year financial and operational patterns (2019–2024) and (2) structured content analysis of 2024 annual reports. These sources provide both longitudinal context and detailed disclosure-level evidence of how firms respond to external volatility.

A structured coding framework was developed deductively (Fereday and Muir-Cochrane, 2006) from the research questions and the literature on climate, technological and geopolitical mechanisms. The coding book specified four categories to be identified in the annual reports: (1) the type of external signal, (2) the mechanism through which the signal is processed (e.g. dashboards and AI models), (3) the control routine affected (planning, cybernetic, administrative, reward and cultural) and (4) evidence of triggering authority or embedding within routines. This deductive structure ensured that the coding process was aligned with the conceptual boundaries of ERCs and the criteria for what qualifies as a control mechanism.

To ensure consistency in interpretation, the coding protocol also incorporated explicit decision rules for identifying ERC-related mechanisms. These rules drew on five evaluative dimensions – trigger, autonomy, routine integration, accountability linkage and persistence. For example, CEO statements were coded as “ERCs framing” when they referenced external indices, climate dashboards or market-linked KPIs as primary explanations for performance outcomes.

The coding framework was applied directly to the 12 firms’ annual reports. One coder conducted the initial coding, after which a second coder independently reviewed the coded excerpts, classifications and category assignments. Differences in interpretation were discussed and resolved through consensus, with both coders revisiting the underlying text to ensure consistent application of the coding criteria. This two-stage review process provided calibration and strengthened reliability by ensuring shared understanding of category definitions and consistent interpretation across firms.

Following agreement on the coded material, mechanisms were aggregated into the three ERC components – climate resilience controls, technology-driven controls and geopolitical and legitimacy controls – based on whether they demonstrated triggering authority, systematic influence on decisions, embedding in routines and linkage to objectives. This aggregation step ensured conceptual consistency and prevented the misclassification of generic environmental inputs or contextual descriptions as control mechanisms.

The problem identification stage is grounded in the six-year data set of 12 firms, which shows that climate, biological, technological and geopolitical shocks consistently overwhelm internal control mechanisms. This empirical reality mirrors the theoretical gap identified in Section 2: existing MCS frameworks remain internally oriented and lack constructs for real-time external data, algorithmic decision agents or geopolitical triggers (Herath, 2007; Papiorek and Hiebl, 2024).

These patterns indicate that firms rely on externally sourced data streams to guide operational and strategic decisions, yet existing MCS frameworks lack a conceptual category to explain how these signals acquire control relevance. The absence of such a category creates analytical blind spots, particularly in volatility-intensive sectors where external triggers shape performance more strongly than internal processes. This motivates the need for a new control architecture.

The objective definition stage clarifies the need for a control architecture capable of translating external signals – climate anomalies, digital agronomy intelligence and regulatory pressures – into structured internal responses across planning, cybernetic, administrative, reward and cultural controls.

This aligns with DSR’s emphasis on defining framework objectives that address a meaningful, practice-relevant problem (Gregor and Hevner, 2013; Myers et al., 2024). The objective is therefore not to redesign existing MCS categories, but to specify the conditions under which external signals function as control mechanisms and to articulate how these mechanisms interact with established control routines.

The design and development stage synthesizes the external resilience mechanisms identified in the empirical context into a coherent conceptual model. ERCs are conceptualized as an external wrapper comprising three components – climate resilience controls, technology-driven controls and geopolitical and legitimacy controls – each operating at tactical (real-time) and strategic (long-term) levels.

The design process involved iteratively comparing coded mechanisms with the control mechanism criteria to ensure conceptual clarity. Mechanisms that did not meet the threshold – such as generic risk disclosures or contextual descriptions – were excluded. This iterative refinement ensured that ERCs represent a coherent and analytically distinct control group rather than a relabeling of existing constructs, consistent with the DSR principle of creating frameworks that combine theoretical grounding with practical utility (Albanese, 2023; Gregor and Hevner, 2013).

The demonstration stage applies the ERCs framework to the coded disclosures from the 12 listed agricultural firms, combined with the six-year operational and financial performance data set. This analysis shows that external signals already shape budgets, KPIs, governance structures, incentive systems and operational routines, even though these mechanisms are not recognized within existing MCS theory.

Demonstration through real-world application is a core requirement of DSR (Gregor and Hevner, 2013; Myers et al., 2024). The demonstration highlights how ERCs manifest differently across firms depending on technological maturity, exposure to external markets and governance structures. This variation provides a natural test of the framework’s explanatory power, showing that ERCs can account for differences in responsiveness and control integration that existing MCS categories cannot explain.

The evaluation stage assesses the framework using a three-level maturity scale – aware, managed and integrated – capturing the extent to which firms operationalize ERCs. The maturity assessment reveals clear differentiation across firms and regions, confirming the internal consistency and practical relevance of the framework, consistent with DSR’s requirement for rigorous evaluation (Gregor and Hevner, 2013).

Each maturity level was defined using observable criteria: level 1 (aware): narrative acknowledgement of external volatility without structured routines; level 2 (managed): systematic monitoring and partial incorporation into planning or cybernetic controls; and level 3 (integrated): predictive, trigger-based mechanisms embedded across planning, monitoring, governance and incentives.

To ensure rigor, maturity classifications were cross-checked against multiple data points within each annual report (e.g. governance statements, risk disclosures, KPI tables and sustainability sections). This triangulation strengthened internal validity and ensured that maturity levels reflected systematic patterns rather than isolated statements.

The evaluation therefore provides a structured and transparent assessment of how ERCs are embedded. While the evaluation does not aim to establish causal performance effects, it identifies indicative patterns suggesting that firms with higher ERC maturity exhibit more structured and timely responses to external shocks.

Agricultural firms operate in environments where climate variability, digital agronomy and geopolitical regulation shape performance more strongly than internal managerial actions. The theoretical gaps identified in Section 2 and the empirical patterns in Section 3 show that these forces originate outside the traditional organizational boundary yet exert direct influence on planning, measurement, governance and behavior.

In climate-exposed agriculture, however, external forces function as de facto control agents that initiate internal responses and reshape organizational priorities. This section develops an ERC mechanism and framework to address this gap and to align with the coding categories and control mechanism criteria outlined in Section 4.

The empirical evidence demonstrates that external shocks – climate variability, biological cycles and geopolitical pressures – consistently dominate financial and operational outcomes across the 12 firms. Large swings in CPO prices translated almost directly into revenue, margin and ROE volatility, while climate-driven fluctuations in FFB yield created operational instability that internal controls could not offset (De Winne and Peersman, 2021; Hoffmann et al., 2017; Kamil and Omar, 2017; Panthi et al., 2026; Syahid et al., 2025).

Across the annual reports, CEOs frame performance through the lens of climate risks, geopolitical pressures and technology adoption – implicitly describing mechanisms that fall outside existing MCS constructs. These patterns indicate that external volatility now activates, rather than only informs, internal control routines. To function effectively in such environments, any extended control architecture must: detect externally generated disruptions in a timely manner, translate those signals into coordinated internal responses and embed these responses into organizational routines. These design requirements underpin the ERCs framework and align with the coding logic used.

Climate variability – ENSO cycles, rainfall deviation, drought, flooding and heat stress – directly influence yields, extraction rates and biological asset health (De Winne and Peersman, 2021; Hoffmann et al., 2017; Kamil and Omar, 2017; Panthi et al., 2026; Syahid et al., 2025). Firms rely on rainfall deviation dashboards, fire risk alerts, peat dryness indices and predictive climate models to anticipate shocks and adjust harvesting, fertilizer regimes and replanting schedules.

These climate signals now initiate planning adjustments, operational routines and resource allocation – functions associated with internal planning and cybernetic controls in Malmi and Brown’s (2008) framework – demonstrating their role as externally triggered control mechanisms.

AI agronomy models, IoT sensors, drone surveillance and digital twin simulations generate real-time intelligence that bypasses current reporting cycles and human interpretation. While digitalization research in MCS (Papiorek and Hiebl, 2024) still treated technology as a tool for improving internal feedback accuracy, agricultural practice shows that these technologies act as non-human controllers that sense, predict and trigger responses to external conditions.

They influence cybernetic controls (through automated KPIs), administrative structures (through digital governance units) and cultural controls (through norms of digital adoption), extending the control boundary beyond internal processes.

Geopolitical and legitimacy forces – including EUDR and NDPE, export levies, biodiesel mandates, tariff regimes and sustainability-linked financing–impose constraints that directly shape planning, governance, incentives and organizational culture (Declerck et al., 2023; Nadras et al., 2024; Su et al., 2015; Suhardjo et al., 2024; Suhardjo and Suparman, 2025). Geopolitical triggers override internal targets, determine market access and reshape strategic priorities, functioning as external governance systems that fall outside Malmi and Brown’s (2008) conceptualization of administrative and cultural controls.

Across climate, technology and geopolitical mechanisms, a consistent pattern emerges external signals now trigger internal responses, external data streams override internal reporting cycles and external constraints reshape governance, incentives and culture. These mechanisms collectively operate as external control agents, yet they remain unrecognized in existing MCS theory, which is anchored in internal feedback-driven assumptions (Herath, 2007; Schäffer et al., 2015).

ERCs address this gap by constituting a new control group that extends Malmi and Brown’s (2008) MCS-as-a-package. We define a control agent as any human or non-human entity that (a) triggers monitoring or action routines, (b) possesses delegated decision authority or strongly shapes decisions and (c) is systematically integrated into planning, monitoring or performance management systems.

A mechanism qualifies as a control agent when it meets at least three of the following five criteria: triggering authority, decision autonomy, routine integration, accountability linkage and persistence or observability. ERCs function as an external wrapper that interacts with planning, cybernetic, administrative, reward and cultural controls, transforming the MCS package into an open, externally responsive system.

ERCs comprise three interrelated components – climate resilience controls, technology-driven controls and geopolitical and legitimacy controls – each operating at two levels: tactical and strategic. Tactical ERCs capture real time, cybernetic responses to external signals, such as rainfall deviation alerts, drone-based pest detection or sudden policy changes requiring immediate operational adjustments. Strategic ERCs capture long-term structural and financial responses, including research and development (R&D) in drought-resistant clones, digital twin investments, blockchain traceability and sustainability-linked financing tied to resilience performance.

Climate resilience controls include climate dashboards, ENSO-linked planning, soil moisture sensors, fire risk alerts and predictive climate models that inform both short-term field operations and long-term biological asset strategies. Technology-driven controls capture the growing role of digital and algorithmic systems – drones, mobile app ecosystems, AI agronomy models, digital twins and mechanized harvesting systems – that function as non-human control agents. Geopolitical and legitimacy controls reflect the external regulatory and market forces that determine access to global supply chains, including EUDR and NDPE compliance systems, blockchain traceability platforms, policy dashboards and sustainability-linked loans.

The ERCs framework explains how external volatility is operationalized within internal control systems. Climate signals reshape planning controls by influencing budget allocations, replanting schedules and scenario analyses. Technology-driven intelligence modifies cybernetic controls through automated variance detection and real-time dashboards. Geopolitical pressures reshape administrative controls through compliance structures, task forces and cross-functional resilience committees. Reward controls incorporate environmental, social and governance and resilience metrics, while cultural controls evolve toward digital adoption, sustainability norms and legitimacy-driven behaviors.

By conceptualizing ERCs as an external wrapper (see Figure 2), the framework positions the MCS-as-a-package as an open system architecture capable of integrating real-time external data, algorithmic decision agents and geopolitical constraints. This extension enables MCS theory to better reflect the realities of contemporary agricultural firms, where resilience depends not only on internal discipline but on the ability to sense, interpret and respond to external forces.

The six years of financial and operational data set (2019–2024), combined with the 2024 disclosures, provides a multi-layered basis for demonstrating how external signals are already embedded – formally or informally – within firms’ control routines. The analysis distinguishes three evidence levels: descriptive evidence (disclosed systems such as climate dashboards, AI agronomy, fire-risk alerts and traceability platforms), coded control evidence (whether disclosures meet ERC criteria such as codification, triggering authority and integration) and analytical inference (the extent to which firms exhibit stronger or weaker ERC embedding based on the depth of criteria satisfied).

Across all 12 firms, external volatility influences planning, monitoring, governance and cultural routines, though with varying degrees of institutionalization. Firms rely on climate dashboards, satellite-based alerts, AI agronomy tools and geopolitical monitoring systems to interpret external conditions. These mechanisms provide observable pathways through which external signals begin to function as control triggers, consistent with the ERCs framework (see Table 7).

Climate variability – ENSO cycles, rainfall deviation, heat stress and flooding – remains the largest driver of yield volatility, with swings of 7%–35% across firms, reflected in fluctuations in FFB yield, OER and EBITDA margins. Firms with more advanced climate-linked monitoring systems – such as SIME.KL’s rainfall dashboards, AALI.JK’s ENSO-based planning, GAR’s satellite fire risk systems and BAL’s peat dryness monitoring – demonstrated clearer linkages between external climate signals and adjustments in harvesting, resource allocation and operational planning. These practices illustrate climate-resilience controls, where external climate indicators shape the timing and content of internal decision cycles.

Digitalization has become a central mechanism for managing external signals. Malaysian firms exhibit the highest algorithmic maturity, Indonesian firms rely on dense mobile app ecosystems and Singapore-listed firms combine digital tools with blockchain-based supply chains for transparency. These technologies function as non-human control agents by detecting anomalies, generating recommendations and shaping operational responses, thereby extending cybernetic and administrative controls beyond human-interpreted feedback loops in Malmi and Brown’s (2008).

Geopolitical and regulatory forces – EUDR, NDPE, export levies, biodiesel mandates and sustainability-linked financing – also shape internal control routines. Singapore-listed firms, such as GAR and BAL, demonstrate advanced legitimacy controls through blockchain traceability and sustainability-linked loans, while Malaysian and Indonesian firms strengthen compliance structures, supplier screening and policy-monitoring routines. These mechanisms influence planning assumptions, procurement boundaries, governance structures and incentive systems, illustrating how external legitimacy pressures become embedded as geopolitical and legitimacy controls.

Across firms, several mechanisms consistently met ERCs’ criteria. Climate dashboards and ENSO forecasts typically satisfied at least three criteria – triggering authority, routine integration and persistence – qualifying them as ERCs. AI agronomy models often met all four criteria, including decision autonomy. Geopolitical monitoring systems and traceability platforms demonstrated codification, escalation routines and integration into administrative and reward systems. Collectively, these practices show that ERCs already operate as an external wrapper that channels climate, technological and geopolitical signals into the internal control architecture (see Figure 3).

The evaluation assesses how the three ERC components – climate-resilience controls, technology-driven controls and geopolitical and legitimacy controls – manifest across the 12 agricultural firms. Drawing on the maturity matrix developed from the 2024 annual report content analysis and the six-year data set, the assessment demonstrates the framework’s internal consistency and practical relevance. External signals were disclosed by all firms, but the depth of institutionalization varied substantially, revealing three maturity tiers: aware, managed and integrated.

ERCs maturity was assessed across five dimensions – awareness, formalization, integration, autonomy and performance linkage – each scored from 0 to 3 (0 = absent, 1 = emerging, 2 = formalized and 3 = integrated). Total scores ranged from 0 to 15, with thresholds defined as aware (1–5), managed (6–10) and integrated (11–15). Inter-rater correlation was calculated to ensure consistency, and exploratory associations with financial stability (e.g. rolling ROE volatility) were examined descriptively.

To ensure methodological rigor, each ERC mechanism (sensing, codification, authorization and embedding) was evaluated across four control domains – planning, cybernetic, administrative and cultural – using a structured three-level rubric. Two independent coders applied the rubric, resolving discrepancies through iterative discussion. This approach provides a transparent, evidence-based evaluation of ERCs’ embedding rather than an interpretive classification.

Aware level firms acknowledge climate, technological and geopolitical risks but treat them primarily as environmental uncertainties. Disclosures remain descriptive, with limited linkage between external signals and planning, cybernetic or administrative routines. Control architectures remain inward-looking, relying on certification, compliance reporting and variance analysis rather than externally triggered mechanisms.

Managed level firms demonstrate partial integration of ERCs. External signals influence planning and monitoring, but responses remain manual, episodic and siloed. Climate dashboards, mobile app ecosystems and compliance structures are present, yet not consistently embedded in KPIs or governance structures. Geopolitical pressures are recognized through traceability and policy monitoring, but their influence on strategic planning remains uneven.

Integrated-level firms embed external signals across planning, cybernetic, administrative, reward and cultural controls. Climate dashboards trigger operational adjustments; predictive models inform replanting and capital expenditure decisions; and fire risk alerts activate field responses. Technology-driven systems – digital twins, AI agronomy models, integrated app ecosystems – shape performance measurement and decision cycles. Geopolitical and legitimacy mechanisms – blockchain traceability, sustainability-linked loans, market access strategies – are structurally embedded in governance and incentive systems. These firms exhibit a coherent, externally responsive control architecture with the full logic of ERCs.

The distribution of firms across maturity tiers illustrates variation in ERC embedding (see Tables 8 and 9). Malaysian firms show the widest spread: GENP.KL, IOI.KL and SIME.KL sit firmly in the integrated tier due to advanced algorithmic and digital twin capabilities, while KLK.KL falls into the managed tier, reflecting strong but still partially siloed integration. Indonesian firms display a similarly differentiated pattern: AALI.JK and DSNG.JK reach the integrated tier through real-time app ecosystems, AI native operational controls and green financing structures, whereas ANJT.JK occupies the managed tier and SGRO.JK remains at the aware level.

Singapore-listed firms show maturity concentrated in geopolitical and financialized resilience, with GAR achieving integrated status through blockchain traceability and sustainability-linked financing, while BAL, first resources and IndoAgri remain in the managed tier. These regional patterns mirror the ERC architecture – Malaysia as algorithmic leaders, Indonesia as cybernetic practitioners and Singapore as strategic and financialized adopters – and illustrate how different forms of external volatility shape differentiated internal control responses.

The evaluation also supports the internal consistency of the framework. Firms that score highly in climate resilience controls tend to exhibit corresponding strengths in technology-driven controls, reflecting the interdependence between climate intelligence and digital agronomy. Similarly, firms with advanced geopolitical and legitimacy controls often show stronger administrative and reward system integration, confirming that external legitimacy pressures reshape governance and incentives. These patterns indicate ERCs function as an integrated external wrapper rather than a collection of isolated mechanisms.

Finally, cross-company evidence suggests that firms with higher ERC maturity exhibit more structured and timely responses to external shocks, underscoring the relevance of externally triggered controls and the framework’s ability to capture these differences with precision.

The findings have important implications for management control theory, organizational practice and the methodological development of DSR in accounting. A central insight is that ERCs directly address the long-standing gap between academic control frameworks and the realities of practice. Prior research has noted that MCS models struggle to gain traction because they assume stable environments and internally generated variance (Herath, 2007). In climate-exposed sectors, however, external shocks shape performance outcomes.

Evidence from the 12 agricultural firms shows that climate, technological and geopolitical volatility now influence financial and operational results more strongly than internal managerial actions. The study’s design – combining six-year financial and operational analysis, annual-report content analysis and a maturity assessment – demonstrates that firms already exhibit varying degrees of external signal-to-control translation, supporting ERCs as a boundary spanning extension to the MCS-as-a-package.

The study answers RQ1 by demonstrating that external signals have become first-order performance determinants. Instead of internal processes driving performance with external factors as background contingencies, external forces now trigger internal adjustments. This shift requires reconceptualizing control not as an internally bounded cycle but as an open system architecture responsive to real-time external data.

ERCs address this gap by formalizing climate-driven, technology-driven and geopolitical legitimacy mechanisms as structured control agents. The study answers RQ2 by showing how firms translate these signals into planning, cybernetic, administrative, reward and cultural controls. Climate dashboards, fire risk alerts, AI agronomy models and compliance platforms now initiate planning cycles, shape KPIs, activate governance committees and influence incentives. ERCs therefore extend the MCS-as-a-package (Malmi and Brown, 2008) by introducing an external wrapper that interacts dynamically with existing control groups. The maturity model further shows that firms differ in how extensively these mechanisms are embedded, reinforcing ERCs as a conceptual artifact capable of explaining variation in external-signal integration across organizations.

ERCs advance management control theory primarily by addressing a structural gap in the MCS as a package: the absence of a conceptual category that explains how external, data-rich signals acquire triggering authority within control systems. By specifying the mechanisms through which climate, technological and geopolitical signals are sensed, codified, authorized and embedded, ERCs extend open systems perspectives (Bracci and Tallaki, 2021; Herath, 2007; Nuhu et al., 2019) and clarify how external volatility becomes operationalized within planning, cybernetic, administrative and cultural controls (Arnaboldi et al., 2022; Ferreira and Otley, 2009; Granlund and Lukka, 2017; Tessier and Otley, 2012). These contributions position ERCs as a necessary modernization of MCS theory for environments where external forces initiate decision cycles.

Practically, the study highlights the need for firms to move beyond reactive risk management toward proactive resilience architectures. Firms with integrated ERCs demonstrate stronger anticipatory capabilities, more consistent operational responses to climate shocks and better alignment with geopolitical and sustainability requirements. Embedding external signals into planning, governance and incentive systems enables organizations to operate as externally responsive control environments rather than internally focused ones.

The maturity assessment confirms that resilience depends not only on operational efficiency but on the depth of ERC embedding across planning, cybernetic, administrative, reward and cultural controls. ERCs therefore offer a blueprint for designing control systems aligned with the realities of climate-exposed industries, consistent with calls for more practice-relevant management accounting research (Clor-Proell et al., 2025; Thottoli et al., 2024).

Methodologically, the study demonstrates the value of DSR in advancing management control theory. DSR provides a structured approach for identifying theoretical gaps, designing an artifact that addresses those gaps and evaluating their utility through empirical demonstration (Gregor and Hevner, 2013). ERCs emerged from diagnosing the control problem through six-year financial and operational analysis, identifying external-signal mechanisms through annual-report disclosures and evaluating their embedding through a maturity model. This illustrates how DSR can generate theory-embedded frameworks that are both conceptually robust and practically relevant, reinforcing its role as a bridge between theory and practice in accounting research (Clor-Proell et al., 2025; Jansen, 2018).

Finally, the findings highlight the broader relevance of ERCs beyond agriculture. As climate volatility, digitalization and geopolitical pressures intensify across sectors, the need for externally oriented control architectures will become universal. ERCs offer a transferable conceptual model for forestry, fisheries, farming and mining, aligning with global trends in sustainability reporting, sustainability-linked financing and digital transformation. By reconceptualizing the MCS-as-a-package as an open system architecture, ERCs provide a theoretical and practical foundation for understanding how organizations can build resilience in an era defined by external volatility.

This study demonstrates that existing MCSs are inadequate for climate-exposed agricultural firms, where external volatility – not internal variance – now drives financial and operational outcomes. By developing ERCs through a DSR approach, the study offers a theoretically grounded extension to the MCS-as-a-package that positions organizations as open systems capable of sensing, interpreting and responding to climate, technological and geopolitical signals.

Evidence from 12 listed agricultural firms shows that ERC-like mechanisms already exist; the ERCs framework provides the formal architecture needed to integrate these mechanisms into coherent, resilience-oriented control design. A key theoretical contribution of this study is the specification of the conditions under which external signals acquire control-triggering authority and the clarification of how ERCs differ from risk indicators, interactive controls and digital controls. This contribution strengthens the conceptual boundaries of ERCs and reinforces their role as a distinct extension to the MCS-as-a-package.

The study’s empirical grounding in large, digitally mature agribusinesses introduces natural boundary conditions. ERCs reflect the capabilities of well-resourced firms with advanced digital infrastructures, meaning their applicability to smaller or less technologically developed organizations may require adaptation. Although ERCs are conceptually industry agnostic, their validation in agriculture – a sector characterized by biological cycles, climate exposure and compliance-intensive supply chains – means that generalization beyond this context remains an open question.

Cross-industry application will depend on differences in technological readiness, regulatory environments and organizational capacity. The study relies on public disclosures, which may under-represent internal practices. Content analysis is interpretive and cannot establish causal mechanisms, and the exploratory association between ERCs’ maturity and performance stability should be interpreted cautiously. These limitations create opportunities for future field-based and causal research.

Overall, the study extends management control theory by positioning ERCs as an external wrapper to the MCS-as-a-package and offering a design pathway for resilience-oriented control architectures. While demonstrated in agriculture, the framework provides a foundation for broader cross-sector inquiry into externally triggered, resilience-driven MCSs. ERCs represent a timely modernization of MCS theory for environments defined by climate volatility, digital transformation and geopolitical uncertainty.

Future research should examine ERCs across other volatility-exposed sectors to establish boundary conditions and transferability. Field and behavioral studies could clarify how managers interpret external signals and embed them into routines, while research on digital and AI-enabled control environments could deepen understanding of how non-human agents participate in control processes. Longitudinal studies linking ERC maturity to financial and resilience outcomes would strengthen causal claims, and developing quantitative diagnostic tools would support broader scholarly and practitioner use.