Sustainability and regulatory compliance in management control systems: insights from Germany’s Supply Chain Due Diligence Act

The transition from voluntary sustainability initiatives to binding regulations marks a decisive shift in the governance of global supply chains. While earlier literature has largely focused on corporate social responsibility (CSR) programs, sustainability reporting and multi-stakeholder frameworks (e.g. Beusch et al., 2022; Damert et al., 2021; Gabrielli et al., 2025; van der Ven, 2022), a new regulatory era has emerged. Recent laws, such as Germany’s Supply Chain Due Diligence Act (LkSG) (BMAS, 2026), Norway’s Transparency Act (Lovdata, 2021) and the forthcoming EU Corporate Sustainability Due Diligence Directive (CSDDD) (CSDDD, 2026), impose enforceable obligations that move sustainability from soft expectations to matters of mandatory compliance and accountability (Bebbington et al., 2023; Kauppi and Hannibal, 2017; Palea et al., 2025). These frameworks require firms to address risks across their supply chains, embedding sustainability into organizational processes, accountability structures and risk management systems. Within this context, management control systems (MCSs) become central for operationalizing legal requirements and ensuring accountability across global supply chains (Beusch et al., 2022; Edirisinghe et al., 2024). These regulatory developments entail a concrete and urgent practical challenge, as MCSs originally designed around voluntary CSR and reputational concerns must now be reconfigured to demonstrate compliance with stringent due diligence obligations in complex global supply chains.

Despite this regulatory turn, research on sustainability and control has remained largely focused on voluntary initiatives, external communication and symbolic practices. Prior studies show how firms use sustainability reporting and CSR strategies to meet stakeholder expectations (Beusch et al., 2022; Edirisinghe et al., 2024) or how soft institutional pressures influence socially responsible supply chain management (Damert et al., 2021; van der Ven, 2022). While these contributions shed light on sustainability primarily as a reputational and communicative practice, they offer limited insight into how internal MCSs are reconfigured when compliance becomes a legal obligation. Recent work has highlighted the role of governance mechanisms in bridging the gap between sustainability “talk” and performance (Palea et al., 2025), but systematic knowledge is still lacking on how binding regulation reshapes the design and use of MCSs. In particular, little is known about how legally mandated due diligence requirements are translated into specific control practices and how these adaptations vary across organizational contexts. This gap is critical because such obligations not only intensify compliance pressures but also compel firms to adapt internal controls at the core of organizational decision-making and supply chain oversight.

To theorize these adaptations, this study adopts institutional theory (IT) and contingency theory (CT) as complementary lenses. IT explains why firms adopt compliance mechanisms, highlighting how coercive regulatory pressures compel organizations to conform to maintain legitimacy and avoid sanctions (DiMaggio and Powell, 1983). CT (Chenhall, 2003) complements this by explaining how responses vary depending on organizational characteristics such as governance structures, supply chain complexity or digital maturity. In this framework, regulation is positioned primarily as an institutional factor that creates the necessity of compliance, while CT helps explain the differentiated adaptations that emerge across firms. To analyze the concrete mechanisms through which adaptation occurs, the study draws on Malmi and Brown’s (2008)MCS package framework – which conceptualizes planning, administrative, cybernetic, cultural and reward controls as an integrated system – and Gond et al.’s (2012) model of sustainability integration, which identifies technical, organizational and cognitive pathways for embedding sustainability into practice. Although not initially developed with sustainability in mind, subsequent research has highlighted the analytical value of the MCS package framework for studying sustainability-related control (Ditillo and Lisi, 2014). Together, these frameworks provide a multi-level lens for understanding how institutional pressures from binding regulation, conditioned by organizational contingencies, are translated into specific adaptations of MCSs to meet sustainability and regulatory compliance.

Building on this foundation, the present study investigates how multinational corporations (MNCs) adapt their MCSs in response to binding sustainability regulation, focusing on LkSG. These firms face intensified scrutiny from regulators, stakeholders and the public regarding their social and environmental responsibilities (Hoejmose et al., 2013). Enacted in 2023, the Act requires firms to identify, assess and mitigate human rights and environmental risks in their supply chains, including forced labor, unsafe working conditions and ecological harm. Compared to similar legislation, such as France’s Loi de Vigilance (Loi de Vigilance, 2017), Norway’s Transparency Act (Lovdata, 2021) and the UK’s Modern Slavery Act (HM Government, 2015), the LkSG introduces stricter enforcement mechanisms, more prescriptive due diligence obligations and a more comprehensive approach to upstream risk assessments (BMAS, 2026). With regulatory momentum intensifying across Europe through the proposed EU CSDDD (CSDDD, 2026), the German case provides a timely and relevant context to examine how MCSs are adapted to meet these binding legal mandates. Accordingly, this paper asks: how do multinational corporations adapt their management control systems to comply with binding sustainability regulations, as exemplified by Germany’s Supply Chain Due Diligence Act (LkSG)?

To answer this question, the study uses a qualitative, multiple-case design based on semi-structured interviews with 14 professionals from 11 German-based MNCs subject to the LkSG. The findings show how MCSs evolve under the combined influence of coercive regulatory requirements and firm-specific contingencies. While legal mandates drive the adoption of formalized mechanisms such as supplier audits, risk scoring systems and compliance dashboards, organizational characteristics shape differentiated applications across firms. This interplay highlights the influence of institutional conformity and contingency-driven variation in shaping MCS adaptation under regulatory conditions.

This study makes three contributions. First, it extends management control research by examining how legally binding regulations reconfigure MCSs and by identifying the mechanisms through which firms operationalize legal obligations through specific control practices. In doing so, it shows how MCSs are adapted to govern human rights and environmental risks, thereby supporting corporate contributions to sustainable development. Second, it advances theory by clarifying the interplay between institutional and contingency perspectives: regulation acts as an institutional factor that compels compliance, while contingency theory explains variations in adaptation. By linking these perspectives to the MCS package (Malmi and Brown, 2008) and the sustainability integration model (Gond et al., 2012), the study develops a multi-level lens for understanding adaptation under regulation. Third, it offers practical implications for managers in client and supplier firms, as well as policymakers operating within sustainability-focused regulatory environments. Although situated in the German context, the findings offer broader relevance for global firms subject to similar sustainability mandates and for policymakers engaged in shaping supply chain sustainability governance worldwide.

The remainder of this paper is structured as follows. Section 2 presents the theoretical background. Section 3 introduces the conceptual frameworks. Section 4 outlines the research methodology and regulatory context. Section 5 details the empirical findings. Section 6 explores emergent insights derived from the data. Section 7 concludes with a discussion of theoretical contributions and practical implications.

Understanding how firms adapt their MCSs to comply with sustainability regulations requires a theoretical lens that captures both external institutional pressures and organizational contingencies. To address this complexity, this study draws on a comprehensive framework combining IT and CT.

IT emphasizes how organizations respond to external pressures in the pursuit of legitimacy (DiMaggio and Powell, 1983). These pressures manifest in three forms of isomorphism: coercive isomorphism, where firms adopt formal structures and practices in response to legal and regulatory mandates to avoid sanctions (Duan et al., 2025); normative isomorphism, where professional norms and shared values encourage convergence around accepted practices; and mimetic isomorphism, where firms imitate others in the face of uncertainty (DiMaggio and Powell, 1983). These institutional dynamics are central to understanding how binding sustainability laws, such as the LkSG, compel firms to demonstrate compliance with human rights and environmental standards (BMAS, 2026). IT thus offers a valuable lens for explaining how regulatory frameworks shape the formalization and adaptation of MCSs within firms.

CT, by contrast, emphasizes the internal dynamics of organizational adaptation. It posits that there is no universally effective design of MCSs; instead, MCSs must be tailored to the specific characteristics of the organization and its operating environment (Chenhall, 2003). Factors such as supply chain complexity, governance structures, digital infrastructure and organizational culture influence how MCSs function in practice (Otley, 2016). CT hence highlights the importance of managerial discretion, organizational capabilities and strategic sensemaking in internalizing and operationalizing regulatory demands.

By combining these two perspectives, the study adopts a dual theoretical foundation. IT explains the external, legitimacy-driven behaviors that compel firms to adopt compliance mechanisms, while CT accounts for variation in how those mechanisms are implemented across different organizational contexts.

Research on sustainability-oriented MCSs has grown as firms are increasingly expected to integrate environmental and social objectives into their operations (e.g. Beusch et al., 2022; Edirisinghe et al., 2024; Guenther et al., 2016; Maas et al., 2016; Mio et al., 2022). Much of this work has examined voluntary initiatives and symbolic practices, portraying sustainability primarily as a response to stakeholder expectations and legitimacy concerns. From this perspective, firms tend to rely on tools such as sustainability reports, codes of conduct or reputational campaigns to signal commitment (Arjaliès and Mundy, 2013; Beusch et al., 2022; George et al., 2016). Yet, in weakly regulated contexts, these practices often remain at a surface level, serving more as communication exercises than as drivers for substantive transformation (Edirisinghe et al., 2024; Guenther et al., 2016).

More recent contributions emphasize the role of governance in bridging the gap between symbolic communication and actual performance. Palea et al. (2025), for instance, show that mechanisms such as sustainability committees and assurance practices are associated with a stronger alignment between firms’ communication and measurable contributions to the sustainable development goals. However, this body of work has not explored how firms adapt their internal MCSs in response to regulatory mandates. This marks a shift in the literature: whereas earlier research investigated sustainability integration in largely voluntary settings, more recent work highlights governance and related regulatory pressures as decisive drivers of change.

To capture how sustainability regulation translates into concrete organizational practices, it is necessary to move beyond explaining why firms respond and examine the control types and processes through which these responses are enacted. This study therefore draws on two complementary frameworks. Malmi and Brown’s (2008)MCS package provides a structural classification of control types, while Gond et al.’s (2012) integration model emphasizes the processes through which sustainability becomes embedded in organizations. By combining these frameworks, this study extends prior research by shifting the focus from voluntary, symbolic practices toward the structural and processual mechanisms through which binding regulation reconfigures MCSs.

Malmi and Brown (2008) define MCSs as “systems, rules, practices, values and other activities management put in place to direct employee behavior” (p. 290) toward organizational objectives. Their typology identifies five interrelated control types – planning, administrative, cybernetic, cultural and reward and compensation – which together form an integrated control package. This holistic approach supports a structured analysis of how diverse controls interact to meet strategic goals (Maas et al., 2016).

Planning controls define the organization’s strategic direction by embedding sustainability into long-term objectives and action plans. This includes articulating ESG commitments at the strategic level and translating them into measurable key performance indicators (KPIs), milestones and implementation timelines (Edirisinghe et al., 2024; Palea et al., 2025). Meanwhile, administrative controls encompass formal structures, governance arrangements and standard operating procedures that institutionalize sustainability within the organization. These controls clarify roles and responsibilities, ensure accountability and align sustainability goals with broader corporate governance (Ditillo and Lisi, 2014). Cybernetic controls involve feedback loops and performance monitoring systems, such as dashboards and ESG scorecards, that assess progress against predefined targets (Malmi and Brown, 2008). These typically include non-financial indicators related to environmental and social performance, such as carbon emissions, workplace safety or labor practices (Maas et al., 2016).

Cultural controls shape behavior through shared values, norms and symbolic expressions. Tools such as mission statements, codes of conduct and sustainability campaigns help embed ESG values into the organizational culture and foster internal commitment (Arjaliès and Mundy, 2013; George et al., 2016). Finally, reward and compensation controls link incentives to sustainability performance by integrating ESG metrics or compliance objectives into appraisal and bonus systems. These controls reinforce desired behaviors and align personal goals with organizational sustainability and compliance targets (Edirisinghe et al., 2024).

To complement the structural perspective of MCS packages, Gond et al. (2012) propose a process-oriented framework that identifies three mechanisms through which sustainability becomes embedded in organizational practice: technical, organizational and cognitive integration.

Technical integration refers to the incorporation of sustainability metrics, tools and procedures into core management systems. This includes embedding environmental and social indicators into planning instruments, risk management protocols and performance monitoring systems to ensure that sustainability is evaluated alongside financial performance (Beusch et al., 2022; Gond et al., 2012). Organizational integration captures how sustainability responsibilities are distributed across formal structures and decision-making routines. This involves creating dedicated sustainability roles, establishing cross-functional teams and embedding sustainability criteria into procurement, compliance and reporting practices, thereby making sustainability part of the organization’s operational structure (Gond et al., 2012). Cognitive integration, in contrast, focuses on the internalization of sustainability-related values, knowledge and awareness among employees. This is supported through leadership engagement, employee training, internal communication and symbolic initiatives that promote sustainability as a shared organizational commitment (George et al., 2016; Gond et al., 2012). Together, these mechanisms show how sustainability can be embedded through technical tools, systems and organizational roles, as well as culturally, through cognitive processes that foster shared values, knowledge and behaviors.

While Malmi and Brown offer a detailed typology for identifying and categorizing control mechanisms within organizations, Gond et al. (2012) highlighted the pathways through which sustainability becomes embedded in operations, structures and organizational mindsets. Integrating these frameworks enables a multi-dimensional analysis that links specific types of controls to broader integration pathways, thereby offering deeper insight into how firms embed sustainability into their control systems under regulatory mandates.

This study adopts a qualitative, multiple-case design to investigate how German-based MNCs adapt their MCSs in response to the LkSG. A case study approach is appropriate for exploring contemporary, complex phenomena shaped by firm-specific institutional and operational dynamics (Scapens, 2004; Yin, 2013), enabling an in-depth understanding of how organizations respond to sustainability challenges and regulatory demands.

The LkSG, enacted in 2023, aims to enhance protection for human rights and the environment across supply chains. It requires firms to identify, assess and mitigate risks related to forced labor, child labor, unsafe working conditions and environmental degradation. The law applies to firms headquartered in Germany as well as foreign firms with significant operations in the country, particularly those with more than 1,000 employees (BMAS, 2026). Enforcement is administered by the Federal Office for Economic Affairs and Export Control (BAFA), which can impose penalties of up to 2% of global turnover for firms with annual revenues exceeding €400m. Non-compliant firms may also face exclusion from public procurement (BAFA, 2026). In contrast to earlier voluntary standards, the LkSG establishes binding obligations, requiring formal due diligence processes, grievance mechanisms and risk monitoring within firms’ internal control systems. Table 1 summarizes the core legal requirements of the LkSG.

A purposive sampling strategy was used to select MNCs in Germany’s manufacturing sector with more than 1,000 employees and clear exposure to the LkSG. The manufacturing sector was chosen due to its economic significance and extensive integration into global supply chains, which heightens sustainability-related risks and regulatory exposure (BMAS, 2026). Participants were identified through professional networks, industry associations and public sources, including corporate websites and sustainability reports. Selection criteria focused on individuals involved in sustainability strategy, compliance, procurement governance or supplier oversight. To complement this approach, snowball sampling was also used. In several cases, initially selected participants referred us to colleagues with more direct responsibility or greater expertise in specific areas, such as supply chain due diligence under the LkSG. This enabled access to domain-relevant knowledge and enhanced the comprehensiveness of the data collected.

The final sample included 14 professionals from 11 MNCs, representing roles in senior corporate sustainability leadership, operational sustainability management, procurement and purchasing and legal and compliance. Semi-structured interviews were conducted via video conferencing between September and November 2024, lasting between 50 and 90 min, with follow-up sessions conducted where necessary. Interviews continued until thematic saturation was reached. All interviews were audio-recorded with informed consent, transcribed and returned to participants for verification (Murphy and Yielder, 2010). The resulting data set comprised over 160 pages of transcripts, totaling more than 80,000 words. Table 2 provides an overview of participants’ roles, interview durations and session dates.

Data were analyzed thematically using Braun and Clarke’s (2006) six-phase framework, applying a combined coding strategy that incorporated deductive and inductive approaches (Fereday and Muir-Cochrane, 2006). Deductive codes were derived from Malmi and Brown’s (2008) typology of MCSs (e.g. cybernetic, administrative, planning), while Gond et al.’s (2012) integration mechanisms informed the identification of technical, organizational and cognitive pathways for embedding sustainability practices. In phase one, the data were reviewed through repeated reading and memo-writing to build familiarity and generate initial impressions. In phase two, a structured codebook was developed based on these theoretical categories, while remaining open to emergent themes (e.g. supplier trust mechanisms, ERP fragmentation). In phase three, codes were grouped into candidate themes organized around three dimensions: control types, integration mechanisms and adaptation logics. Cross-case matrices were then constructed to identify patterns of convergence and divergence across firms. In phase four, themes were refined to ensure internal consistency and alignment with the theoretical framework. In phase five, they were finalized and named to reflect their analytical focus (e.g. cybernetic controls and technical integration; trust as procedural compliance). Finally, in phase six, the themes were synthesized into two sections: Findings, focused on MCS adaptation and sustainability integration and Further Findings, centered on relational and contextual dynamics shaping control implementation.

This section presents empirical findings on how German-based multinational manufacturing corporations have adapted their MCSs in response to the LkSG. While earlier sustainability initiatives were primarily driven by reputational concerns, investor expectations or broader stakeholder engagement (e.g. Beusch et al., 2022; Damert et al., 2021), the LkSG marks a shift from soft law to binding legal requirements. The findings suggest that firms respond to LkSG mandates not only to meet legal requirements but also in ways influenced by their internal structures and practices, revealing distinct adaptation logics across control types and integration mechanisms. We define adaptation logic as the dominant rationale guiding how firms adjust MCS elements in response to legal pressures, shaped by institutional and contingency-based considerations.

Planning controls, which guide strategic goals (Malmi and Brown, 2008), have gained renewed significance in the context of the LkSG. Under this regulatory framework, firms have transformed planning from general forecasting into risk-sensitive, digitally embedded systems. This evolution aligns with Gond et al.’s (2012) concept of technical integration, where sustainability is embedded into core processes through structured planning and digital infrastructures. Three key adaptations emerged from the data: (1) risk-based supplier segmentation, (2) use of ESG-aligned digital planning tools and (3) integration of regulatory foresight into long-term planning. First, firms developed tiered supplier risk models based on geography, industry and procurement volume to prioritize due diligence efforts:

This segmentation reflects CT’s emphasis on aligning controls with contextual conditions (Chenhall, 2003), turning planning from a top-down exercise into a selective, risk-informed mechanism. Second, firms replaced manual processes with digital platforms that enabled real-time risk scoring, automated workflows and ERP integration:

These tools operationalized due diligence and improved compliance efficiency and scalability. Third, some firms extended planning horizons to align with emerging regulations such as the EU Corporate Sustainability Reporting Directive (CSRD), embedding strategic foresight into ESG planning:

These findings extend Malmi and Brown’s (2008) framework by demonstrating how planning controls have become dynamic, data-informed tools under legal pressure. They also refine Gond et al.’s (2012) notion of technical integration by showing how digital infrastructures embed sustainability within strategic planning. While the shift toward digitalization reflects coercive isomorphism (DiMaggio and Powell, 1983), firm-specific factors such as digital maturity and supply chain complexity shaped implementation. Hence, planning controls under the LkSG followed a hybrid adaptation logic, combining institutional standardization with contingency-driven differentiation.

Administrative controls, defined as the structural and procedural tools that formalize responsibilities, standardize practices and coordinate internal processes (Malmi and Brown, 2008), were instrumental in how firms adapted their MCSs to meet LkSG requirements. While planning controls set strategic direction, administrative controls provide the operational backbone for embedding legal compliance in day-to-day activities. In response to the LkSG, firms did not merely reinforce existing structures but reconfigured them to enable cross-functional collaboration and scalable regulatory compliance. This transformation reflects Gond et al.’s (2012) notion of organizational integration, in which sustainability is operationalized through revised procedures, new roles and coordinated decision-making across functions.

Two adaptation models emerged: distributed and dedicated integration. In the distributed model, responsibilities for sustainability and due diligence were embedded across departments – compliance, legal, procurement, HR – emphasizing shared accountability and breaking down silos:

In contrast, the dedicated model entailed establishing new roles or units with explicit responsibility for LkSG implementation, including the appointment of Human Rights Officers, the expansion of ESG teams and the creation of sustainability-specific positions to enhance oversight and accountability:

Regardless of structural model, both approaches emphasized cross-functional alignment, blending legacy systems with newly defined responsibilities. Even within dedicated structures, successful implementation relied heavily on inter-departmental collaboration. Alongside role-based changes, firms also revised procedural tools – such as supplier codes of conduct, onboarding protocols and contract templates – to incorporate LkSG provisions. These instruments served not only as documentation but also as embedded governance mechanisms that translated legal mandates into operational routines:

These adaptations reflect a shift in administrative controls from static, rule-based tools to dynamic coordination mechanisms that facilitate due diligence across departments and supplier networks. This reconceptualization extends Malmi and Brown’s (2008) framework by showing how administrative controls promote procedural coherence and enable cross-functional collaboration under regulatory pressure. It also deepens Gond et al.’s (2012) concept of organizational integration, particularly in distributed models where sustainability responsibilities are enacted across departmental boundaries through shared ownership and standardized routines.

While the widespread adoption of onboarding protocols, updated codes of conduct and formal role assignments reflects coercive isomorphism (DiMaggio and Powell, 1983), the variation between distributed and dedicated structural models suggests contingency-based differentiation. Rather than following a uniform compliance blueprint, firms tailored their administrative systems based on internal governance capacities and structural configurations. In this sense, administrative controls under the LkSG exemplify a hybrid adaptation logic, balancing standardization to fulfill legal mandates with customization aligned to organizational contingencies. This hybrid logic highlights how firms navigate the space between institutional conformity and strategic discretion when embedding sustainability into operational governance.

Cybernetic controls, mechanisms that set performance targets, monitor deviations and trigger corrective action, have traditionally supported financial and operational oversight (Malmi and Brown, 2008). While planning controls provide strategic direction, cybernetic controls offer real-time monitoring benchmarks. Under the LkSG, firms expanded these mechanisms to address sustainability risks, particularly in human rights due diligence, supplier monitoring and grievance handling. This shift aligns with Gond et al.’s (2012) concept of technical integration, where sustainability becomes embedded into digital infrastructure and performance systems that inform day-to-day decisions.

The data revealed three main adaptations: (1) incorporation of ESG indicators into KPI frameworks; (2) activation of real-time feedback loops via digital monitoring tools; and (3) formalization of grievance mechanisms within compliance systems. First, KPI systems were adapted to include LkSG-specific metrics – algorithmically generated supplier risk scores, ESG ratings and grievance counts. These indicators functioned not just as performance measures but as early-warning triggers for compliance actions:

These practices reflect a shift from static reporting to dynamic risk governance. Second, firms implemented automated real-time monitoring tools that scan media, NGO reports and social media for early risk signals. These systems produced alerts and allowed for rapid investigation and corrective responses:

Such tools expanded visibility across complex global supply chains. Third, grievance mechanisms – such as hotlines, email channels and multilingual portals – were formalized and digitized, ensuring accessibility for both internal and external stakeholders. These systems fulfilled LkSG requirements while supporting transparency and accountability:

Together, these developments illustrate a transformation of cybernetic controls from inward-facing tools into proactive, stakeholder-oriented compliance mechanisms. Unlike planning or administrative controls, which varied across firms, cybernetic controls exhibited high consistency, pointing to uniform adaptation driven by coercive isomorphism (DiMaggio and Powell, 1983). Risk-based KPIs, automated monitoring and formal grievance systems were widely adopted regardless of internal contingencies. These findings extend Malmi and Brown’s (2008) concept by showing how cybernetic controls evolve under legal pressure to support real-time ESG risk oversight. They also refine Gond et al.’s (2012) notion of technical integration by demonstrating how sustainability becomes operationalized through standardized systems that institutionalize visibility, accountability and intervention across global supply chains.

Cultural controls, defined by Malmi and Brown (2008) as the values, norms and beliefs that guide employee behavior, played a central role in shaping how firms approached the cognitive dimension of compliance with the LkSG. Unlike planning, administrative or cybernetic controls, which operate through formal procedure and measurable outputs, cultural controls influence how sustainability is interpreted, prioritized and internalized. In this context, firms sought not only to meet legal requirements but also to embed sustainability into their organizational mindset. This approach aligns with Gond et al.’s (2012) notion of cognitive integration, wherein sustainability becomes part of a shared belief system rather than merely imposed by formal mechanisms.

The data highlight three key adaptations: (1) training and communication to normalize sustainability thinking; (2) framing sustainability as central to identity and purpose; and (3) collaborative supplier engagement grounded in transparency and mutual learning. First, firms used training and internal communications to promote a common understanding of human rights and environmental responsibilities:

These efforts were participatory, continuous and embedded in everyday routines – hallmarks of cognitive integration (Gond et al., 2012). Second, many firms positioned sustainability not as a compliance task but as central to corporate identity and strategic direction:

Such symbolic framing reinforces internal legitimacy and aligns employees with shared values, demonstrating how cultural controls operate normatively through leadership narratives and identity construction. Third, firms extended cultural controls to their suppliers through dialogue-based engagement rather than enforcement:

These practices fostered trust, transparency and long-term improvement, extending cultural influence beyond the firm’s boundaries. Together, these adaptations show that cultural controls under the LkSG supported both internal sense-making and external collaboration. This extends Malmi and Brown’s (2008) framework by emphasizing the constructive, relational and identity-driven aspects of cultural controls, not just their role in enforcing norms. It also enriches Gond et al.’s (2012) model by illustrating how cognitive integration is enacted through training, leadership framing and supplier dialogue.

Across cases, firms converged on similar cultural practices not due to coercive mandates or strategic imitation, but through shared ethical commitments and sectoral legitimacy norms. This reflects a uniform adaptation logic shaped by normative isomorphism (DiMaggio and Powell, 1983), where professional values and collective standards drive alignment. In this sense, cultural controls helped reframe sustainability as a collectively held belief system, embedded through dialogue, purpose and normative commitment.

Reward and compensation controls, as defined by Malmi and Brown (2008), link performance outcomes to incentives, guiding behavior through extrinsic motivation. Gond et al. (2012) argue that such mechanisms support organizational integration by embedding sustainability expectations into HR processes and cognitive integration by shaping how individuals internalize sustainability as part of their professional identity. Three recurring patterns were identified: (1) incorporation of ESG responsibilities into employee performance targets; (2) rejection of financial incentives for supplier compliance; and (3) selective use of non-monetary incentives to encourage supplier alignment. Internally, ESG-linked responsibilities were incorporated into bonus structures and performance reviews, reinforcing formal accountability and the internalization of sustainability norms:

These mechanisms contributed to both organizational and cognitive integration, signaling that sustainability is not peripheral but core to professional performance. Externally, however, firms uniformly rejected the idea of offering financial rewards to suppliers for basic legal compliance, framing it as a normative expectation, not a discretionary achievement:

This stance reflects the limits of extrinsic motivation in inter-organizational settings and illustrates a normative boundary between compliance and reward. Nonetheless, some firms experimented with symbolic incentives, such as supplier awards or elevated strategic status:

These findings extend Malmi and Brown’s (2008) framework by illustrating that non-financial rewards can serve as effective control mechanisms in sustainability contexts. They also enrich Gond et al.’s (2012) model by showing that reward and compensation controls contribute unevenly to integration. Internally, ESG-linked incentives reflected a values-based logic, reinforcing sustainability as part of professional accountability. Externally, the consistent rejection of financial rewards for legal compliance signaled normative isomorphism (DiMaggio and Powell, 1983), as firms converged around the ethical view that legal adherence should not be incentivized. Symbolic recognition, when used, served reputational or relational purposes. As such, reward and compensation controls under the LkSG followed a hybrid adaptation logic, shaped by normative isomorphism and contingency-based differentiation. Internally, firms linked ESG performance to employee incentives in line with emerging professional norms. Externally, while financial rewards were uniformly rejected, the selective use of symbolic incentives varied according to firm-specific priorities. This hybrid logic illustrates how firms combine legitimacy-seeking with context-sensitive control design to align internal accountability and external partnerships with evolving sustainability expectations.

The findings suggest that firms respond to LkSG mandates not only to fulfill legal requirements but also in ways shaped by their internal structures and practices, revealing distinct adaptation logics linked to control types and integration mechanisms.

Planning and cybernetic controls followed a technical integration mechanism, embedding sustainability into digital infrastructures through automated monitoring and data-driven tools. Cybernetic controls exhibited strong convergence across firms, particularly in ESG KPIs, real-time risk alerts and grievance systems – reflecting a uniform adaptation logic driven by coercive isomorphism. In contrast, while planning controls were also shaped by regulatory pressure, their implementation varied depending on internal factors such as digital maturity and supply chain complexity. This combination of external alignment and internal tailoring reflects a hybrid adaptation logic, merging coercive isomorphism with contingency-based design.

Administrative controls aligned with an organizational integration mechanism. Firms formalized sustainability responsibilities through either distributed or dedicated structural models and updated procedural tools such as onboarding protocols and supplier codes of conduct. This pattern reflects a hybrid adaptation logic, in which institutional pressures (i.e. coercive isomorphism) were addressed through contingency-based adjustments tailored to organizational structures and resource capacities.

Cultural controls, associated with cognitive integration, were implemented in similar ways across firms. Through symbolic leadership framing, employee training, internal communications and collaborative supplier dialogue, firms fostered a shared sustainability mindset. These practices were neither mandated by regulation nor strongly shaped by firm-specific contingencies but rather stemmed from shared ethical commitments and legitimacy-seeking behavior. As such, cultural controls followed a uniform adaptation logic shaped by normative isomorphism, embedding sustainability as a collectively held belief system.

Reward and compensation controls exhibited the most differentiated adaptation pattern. Internally, firms tied ESG-linked performance targets to HR and appraisal systems, reinforcing both organizational and cognitive integration through values-based mechanisms. Externally, firms uniformly rejected financial incentives for supplier compliance, reflecting a normative consensus that legal adherence should not be monetarily rewarded, an example of normative isomorphism. However, some firms selectively used symbolic recognition (e.g. supplier awards or elevated status) based on strategic or relational considerations. This pattern reflects a hybrid adaptation logic, combining internal normative convergence with externally contingent use of non-financial incentives.

Together, these findings deepen our understanding of how MCSs evolve under binding sustainability regulation and highlight the interplay between regulatory compliance and strategic discretion in sustainability governance. Table 3 summarizes these dynamics across control types (Malmi and Brown, 2008) and integration mechanisms (Gond et al, 2012). Here, adaptation logic denotes how firms reconfigure MCS elements under binding sustainability regulations, shaped by institutional pressures and firm-specific contingencies (Chenhall, 2003; DiMaggio and Powell, 1983). A hybrid adaptation logic reflects the interaction between institutional isomorphism – whether coercive (e.g. legal mandates) or normative (e.g. shared values and professional norms) – and internal factors such as digital maturity or governance structures. In contrast, a uniform adaptation logic denotes strong convergence across firms, primarily driven by institutional pressures. By mapping these logics, the study demonstrates how firms respond to the LkSG while navigating their organizational contexts.

This section explores additional insights into the relational, contextual and operational dynamics of sustainability governance under the LkSG. It examines three cross-cutting themes: (1) the role of trust in shaping supplier relationships; (2) the tailoring of control mechanisms to different supplier types; and (3) the challenges and opportunities involved in embedding sustainability through MCSs.

Trust emerged as a nuanced and dynamic component of LkSG compliance. While formal mechanisms such as risk assessments, documentation and audit procedures are legally mandated, interviewees consistently emphasized trust as an essential complement to control, particularly in fostering supplier cooperation and long-term alignment. Importantly, trust was not seen as a substitute for control, but as a parallel mechanism embedded within broader compliance systems. Three stages of trust development were identified, consistent with Sako’s (1992) typology: contractual trust, established through onboarding documents like contracts and supplier codes of conduct; competence-based trust, developed via audits, ESG scoring and third-party certifications; and relational or goodwill trust, cultivated over time through responsiveness, interpersonal interaction and mutual learning.

The onboarding process established initial compliance formalities such as contracts and codes of conduct, that set the legal and ethical terms of the relationship and served as an entry point into broader trust-building and compliance routines:

However, participants emphasized that these mechanisms merely set baseline expectations. Trust was reinforced as suppliers consistently demonstrated compliance, often validated through digital platforms and third-party certifications:

In this sense, trust was embedded within compliance routines, operationalized through structured oversight and verification. These formalized practices contributed to building competence-based trust, which, when reinforced through transparent engagement, gradually evolved into relational trust. Firms also emphasized the importance of responsiveness, mutual learning and continuous dialogue in strengthening supplier relationships:

Still, all participants agreed that even in mature, long-standing partnerships, formal monitoring remained essential. In practice, trust did not replace control but complemented it, reinforced through audit platforms and ESG rating systems:

This consistency suggests that accountability and auditability are the key forces shaping governance under the LkSG. In this context, coercive isomorphism (DiMaggio and Powell, 1983) offers a compelling explanation: legal mandates limit organizational discretion, reinforcing the need for standardized, verifiable documentation even within long-standing relationships. Ultimately, while trust is framed relationally in discourse, it is enacted procedurally, through codified documentation, third-party audits and digital compliance systems.

Although the LkSG imposes standardized legal obligations, firms do not implement these obligations through uniform procedures. Instead, they tailor their planning controls (Malmi and Brown, 2008) based on supplier-specific factors such as risk profile, relationship maturity and strategic importance. This differentiation reflects contingency theory (Chenhall, 2003), which highlights the importance of aligning control mechanisms with contextual variables. The findings indicate a two-track approach: for existing suppliers, compliance is often co-developed through sustained dialogue; for new suppliers, compliance expectations are embedded from the outset through formalized, top-down processes, consistent with technical integration (Gond et al., 2012).

With long-standing suppliers, firms typically integrate LkSG requirements incrementally. Pre-existing mechanisms such as codes of conduct or framework agreements are revised to align with new legal standards, allowing continuity in established partnerships while progressively meeting regulatory demands:

However, incremental adaptation does not imply leniency. Oversight mechanisms including audits, corrective action plans and, in rare cases, contract termination were deployed based on supplier risk levels. Termination was consistently framed as a last-resort measure:

These responses reflect a pragmatic balance between regulatory obligations and supply chain continuity. Importantly, compliance expectations were often shaped through dialogue rather than unilaterally imposed. This collaborative engagement reflects cognitive integration (Gond et al., 2012), whereby sustainability becomes embedded through shared understanding, mutual learning and iterative interaction.

In contrast to existing suppliers, new suppliers were governed through structured onboarding procedures. Planning and administrative controls (Malmi and Brown, 2008) were embedded from the outset, using instruments such as due diligence questionnaires, codes of conduct and pre-engagement audits. These mechanisms served to establish a clear legal and ethical baseline prior to contractual commitment, thereby minimizing compliance risks and ensuring alignment with the LkSG requirements from the beginning:

Scrutiny was further calibrated based on perceived supplier risk. In higher-risk cases, oversight was intensified through requirements such as certifications or third-party audits. Suppliers unable to meet these expectations were typically disqualified, reflecting a preventive control logic aimed at mitigating compliance exposure before contractual engagement:

These onboarding practices illustrate technical integration (Gond et al., 2012), whereby compliance requirements are operationalized through formal routines and embedded from the outset of the supplier relationship. Overall, the findings suggest that while the LkSG imposes a uniform regulatory mandate, firms pursue different compliance strategies based on the type of supplier. For existing suppliers, compliance is embedded incrementally through collaborative engagement; for new suppliers, it is enforced via codified, standardized procedures, shaped by the maturity of the relationship and the perceived risk exposure.

The implementation of the LkSG has revealed both persistent operational challenges and emerging opportunities in embedding sustainability within MCSs. While the regulation provides a coherent legal framework, its practical application exposes significant limitations in data infrastructure, technological capacity and governance reach, particularly across globally dispersed, multi-tiered supply chains. One core challenge is the limited traceability of lower-tier suppliers, where digital systems are often fragmented, incompatible or entirely lacking. These “blind spots” undermine the effectiveness of planning and cybernetic controls (Malmi and Brown, 2008), which depend on integrated and reliable data to support risk assessment and ongoing compliance monitoring:

Human and financial resource constraints further hinder implementation. Many firms contend with the dual challenge of developing robust compliance systems while simultaneously meeting extensive reporting obligations, demands often perceived as burdensome and offering limited immediate business value:

Another systemic limitation lies in firms’ limited governance reach over indirect suppliers. Although the LkSG extends due diligence obligations into deeper tiers, many firms lack the tools, visibility or leverage needed to effectively monitor and enforce compliance.

These challenges highlight a structural misalignment between regulatory ambition and operational feasibility. While coercive isomorphism (DiMaggio and Powell, 1983) compels firms to align with legal mandates, implementation is often complicated by internal constraints such as limited data visibility or system maturity. The LkSG has accelerated investment in supply chain mapping, supplier segmentation and risk-based prioritization – practices that strengthen legal compliance and overall supply chain resilience:

These developments signal increasing technical integration (Gond et al., 2012), as sustainability becomes embedded in digital tools and planning routines. The LkSG has also shifted sustainability from a discretionary initiative to a core operational imperative. In this sense, the regulation functions both as a legal mandate and as a normalizing force, institutionalizing sustainability as a baseline expectation across firms:

These findings highlight the complex realities of embedding sustainability into MCSs under binding regulation. Challenges such as data blind spots, limited visibility into lower-tier suppliers and resource constraints underscore the tension between regulatory ambition and operational capacity. Nevertheless, the LkSG has contributed to greater supply chain transparency and has reframed sustainability as a normative baseline rather than a source of competitive differentiation. In this sense, the LkSG functions not only as a compliance mechanism but also as a catalyst for adapting MCSs toward more integrated and resilient forms of sustainability governance, including greater agility in responding to disruptions.

This discussion reflects on how MNCs adapt their MCSs in response to binding sustainability regulation, focusing on LkSG. It shows how legal mandates drive changes across different types of controls and how firms respond to institutional pressures while navigating internal organizational contingencies. In doing so, the study contributes to the literature on MCS reconfiguration and the integration of sustainability into organizational control and offers practical insights for firms, suppliers and policymakers who operate in an increasingly regulated sustainability landscape and seek to support sustainable development through supply chain governance.

Drawing on institutional theory (DiMaggio and Powell, 1983), the study conceptualizes coercive regulation as an external legitimacy pressure compelling compliance, while contingency theory (Chenhall, 2003) accounts for variation in firms’ responses based on governance structures, supply chain complexity and digital maturity. This dual lens strengthens prior work that has primarily examined voluntary or symbolic sustainability initiatives (e.g. Arjaliès and Mundy, 2013; Beusch et al., 2022) by shifting the focus to legally binding mandates and their implications for internal controls. In parallel, by applying Malmi and Brown’s (2008)MCS package framework alongside Gond et al.’s (2012) integration model, the study extends the scope of these frameworks into the domain of mandatory compliance and due diligence.

A first theoretical contribution lies in extending Malmi and Brown’s conceptualization of MCSs. Rather than treating control types as static components of a fixed package, the findings show how firms dynamically mobilize and reconfigure them under institutional pressures associated with binding regulation. Planning and cybernetic controls evolved into digitally mediated, risk-responsive tools embedded in compliance routines. Moreover, the analysis demonstrates that different control types linked to distinct integration mechanisms: planning and cybernetic controls were associated with technical integration via data infrastructures and performance measurement systems; administrative controls supported organizational integration by codifying ESG responsibilities across departments; and cultural controls supported cognitive integration by embedding sustainability values into training, internal communications and supplier engagement processes.

Reward and compensation controls revealed a dual internal-external approach. Internally, ESG targets were tied to performance appraisal and bonuses, reinforcing organizational and cognitive integration. Externally, firms rejected financial rewards for supplier compliance, instead leveraging symbolic recognition and reputational benefits. This dual approach – values-driven internally and reputationally motivated externally – reflects a differentiated, context-sensitive pathway to sustainability integration, consistent with Hahn et al. (2015). Collectively, these findings connect the MCS package literature with sustainability integration research by showing how planning, cybernetic, administrative, cultural and reward controls contribute, in different ways, to technical, organizational and cognitive integration under regulatory pressure.

The findings also challenge the assumption that sustainability integration is primarily voluntary or emergent. Under the LkSG, integration mechanisms, especially those linked to digital infrastructures and reporting systems, were not optional but necessary, reflecting clear patterns of coercive isomorphism (DiMaggio and Powell, 1983; Scott, 2005). While firms retained discretion over softer elements such as culture and incentive systems, compliance imperatives tightly aligned system design with the regulative pillar of IT.

A second theoretical contribution concerns the interplay between institutional and contingency perspectives. The study introduces the concept of adaptation logic, distinguishing between hybrid and uniform approaches, to conceptualize how firms adapt their MCSs in response to binding sustainability regulations. While IT typically predicts convergence under external pressures (DiMaggio and Powell, 1983), the findings reveal selective responses: some control elements were standardized across firms, while others were tailored to internal contingencies such as digital maturity, governance structures and supply chain complexity (Chenhall, 2003). Cybernetic controls were uniformly institutionalized, reflecting coercive isomorphism, whereas planning and administrative controls followed a hybrid adaptation logic shaped by regulatory demands and firm-specific characteristics. Cultural controls, shaped by normative isomorphism, exhibited convergence and thus a uniform adaptation logic. In contrast, reward and compensation controls, although also influenced by normative isomorphism, varied in implementation and followed a hybrid adaptation logic. The concept of adaptation logic thus clarifies how uniform legal mandates can lead to differentiated organizational responses, enriching theoretical understandings of MCS design under sustainability regulation and resonating with recent work on multiple governing logics in sustainability MCSs (Slacik et al., 2022).

In addition, the study contributes to the literature on digital sustainability governance by showing how MCSs are increasingly mediated by technologies such as ERP systems, risk scoring algorithms, real-time media monitoring and grievance reporting platforms. These technologies operated not merely as tools for implementation but as governance actors – translating regulatory requirements into operational routines and decision-making processes. This finding aligns with Wang’s (2023) framework of digitally enabled governance and supports Kloppenburg et al.’s (2022) claim that digitalization introduces new forms of visibility, control and accountability in environmental governance.

Drawing from performativity theory (Callon, 2007; Power, 2007), these digital MCSs can be viewed as performative infrastructures; not simply monitoring sustainability performance but actively shaping it. They contributed to defining ESG categories, institutionalizing new roles (e.g. Human Rights Officers) and shifting organizational priorities from efficiency toward resilience. In this sense, these systems did not simply track compliance; they helped enact it.

Trust also emerged as a critical component of LkSG compliance. Drawing on Sako’s (1992) trust typology, firms used layered trust mechanisms: contractual trust established through onboarding documents; competence-based trust via ESG scoring and audits; and goodwill trust fostered through long-term engagement. Crucially, trust did not replace control but operated alongside it. Even in mature partnerships, trust was relationally framed but procedurally enacted through verification, documentation and digital monitoring. This finding aligns with Bracci et al. (2024), who argue that trust and control can coexist within hybrid governance models, reinforcing rather than substituting one another.

At the same time, while firms claimed to have largely achieved procedural compliance, it remains unclear to what extent these adaptations will lead to substantive environmental or human rights improvements. This reflects a form of means–ends decoupling (Wijen, 2014), where formal alignment with regulatory frameworks does not necessarily translate into meaningful change on the ground. The findings also resonate with Palea et al. (2025), who identify a persistent gap between reported sustainability performance and actual practices and caution that ESG integration risks becoming symbolic unless anchored by robust, systemic governance mechanisms. This tension is central to ongoing debates about whether and how due diligence regulation contributes to sustainable development in practice.

From a practical standpoint, the study provides valuable insights for sustainability and compliance managers in client firms that engage in outsourcing, for suppliers facing increasing expectations and for policymakers overseeing supply chain sustainability governance aimed at advancing sustainable development outcomes.

For managers, a key challenge is to move beyond checklist-based compliance and view MCSs as dynamic tools for sustainability governance. As the study shows, firms adopt either hybrid or uniform adaptation logics depending on the interplay between institutional pressures and internal contingencies. Compliance strategies should therefore follow a uniform adaptation logic in contexts where coercive or normative pressures allow little room for variation and a hybrid adaptation logic in situations where organizational contingencies necessitate tailored responses, provided regulatory demands are still met. Investments in scalable digital tools – such as real-time monitoring platforms, algorithmic risk scoring and integrated grievance systems – can strengthen responsiveness and traceability. Control strategies should also be differentiated by supplier type, striking a balance between formal mechanisms and trust-based approaches grounded in transparency and mutual learning. In this way, effective compliance aligns legal accountability with adaptive, context-sensitive control and collaborative supplier engagement.

For suppliers, the findings demonstrate how MNCs interpret and implement regulatory mandates. By showing how MCSs are adapted under legal pressure, the study helps suppliers understand clients’ expectations, anticipate evolving governance trends and prepare for more formalized and demanding compliance requirements. This understanding is particularly valuable for suppliers seeking to maintain or strengthen their position in global value chains amid tightening sustainability standards.

For policymakers, this study highlights the ripple effects of sustainability regulation. Although the LkSG formally targets large corporations, its implementation creates indirect compliance burdens for smaller, German-based suppliers. These firms, though not legally subject to the regulation, are often required to meet ESG documentation and due diligence standards imposed by their regulated clients, without access to equivalent institutional or infrastructural support. This dynamic risks excluding small and medium-sized enterprises (SMEs) from global value chains and may deepen existing resource asymmetries. To mitigate such unintended consequences, policymakers should develop supportive mechanisms that enable SMEs to participate in sustainability governance on more equitable terms.

Moreover, the ambiguity inherent in the LkSG’s operational requirements has led to divergent interpretations and decentralized compliance approaches among firms. This lack of clarity places a significant burden on organizations to interpret and operationalize the law independently, resulting in inconsistent implementation and uneven enforcement. Policymakers should therefore recognize that the success of such regulations depends both on the formal articulation of rules and on the practical conditions of implementation. Future regulatory design should account for the diverse organizational realities firms face and offer clearer guidance, along with flexible yet coherent implementation frameworks that address varying capacities and control structures across industries.

Furthermore, despite the LkSG’s potential benefits, its implementation has exposed persistent operational challenges. The core obstacle is limited data visibility, especially beyond the first tier of suppliers, alongside fragmented systems and underdeveloped technological infrastructure, all of which constrain oversight of indirect supply chain actors. These findings echo Fraser and van der Ven’s (2022) call for more realistic assessments of monitoring feasibility in complex, fragmented global supply chains. They highlight a structural misalignment between regulatory ambition and firms’ capacity to comply, especially when digital and governance infrastructures remain underdeveloped.

In light of these insights, several avenues for future research emerge. First, longitudinal studies are needed to examine whether firms move beyond procedural compliance toward more strategic, embedded and enduring forms of sustainability integration. While this study captures early-stage adaptations, the long-term durability and institutionalization of MCS changes remain uncertain. Second, further research should investigate whether binding sustainability legislation, such as the LkSG, achieves its intended outcomes. This includes evaluating whether the costs incurred (e.g. administrative burdens, digital infrastructure investments and supply chain restructuring) translate into measurable improvements in human rights and environmental performance and whether such outcomes justify the regulatory costs.

Third, future studies should explore how compliance demands are distributed across firms of varying sizes and supply chain positions. In particular, SMEs often face indirect pressures without equivalent resources or institutional support, potentially leading to competitive disadvantages or alternative governance responses. Understanding these dynamics can inform the design of more equitable and effective regulatory frameworks.

In conclusion, this study positions MCSs not merely as tools of regulatory compliance but as dynamic systems through which sustainability is conceptualized and operationalized. As regulatory frameworks become increasingly central to corporate sustainability strategies, understanding the interplay between institutional coercion, internal capabilities and digital mediation will be essential for both scholarship and practice. The findings underscore the constraints imposed by binding regulation and its capacity to drive meaningful transformation in how firms govern and account for their sustainability commitments.

The author thanks the participating professionals, whose insights were instrumental to this research. The author also appreciates the Sustainability Accounting, Management and Policy Journal team, including the Co-Editor-in-Chief, the Associate Editor and the reviewers, for their contributions to improving the quality of this article. The author extends her gratitude to Gabriela Steinemann, Judith Madlener and Silvia Hu for their support and encouragement.