How risk perception influences CEOs' technological decisions: extending the technology acceptance model to small and medium-sized enterprises' technology decision makers

Abstract

Purpose

This paper aims to investigate the factors influencing chief executive officers’ (CEOs') intentions to implement cloud technology in Italian small and medium-sized enterprises (SMEs).

Design/methodology/approach

The study proposes a model that integrates the theoretical construct of the technology acceptance model (TAM) with a classification of perceived benefits and risks related to cloud computing. The study employs a structural equation modeling approach to analyze data gathered through a Likert scale-based survey.

Findings

The findings indicate that risk perception has a strong negative effect on the intention to introduce cloud technology in firms. This effect is partially offset by the perceived ease of use of the technology.

Originality/value

The study provides a new theoretical framework that integrates the TAM and a classification of perceived risks to provide a clear view of management's cognitive processes during technological change. Moreover, the results show the main factors influencing decisions regarding the implementation of cloud computing in firms in light of the perception of risks. Finally, this study provides interesting findings for cloud service providers (CSPs) about their customers' decision-making processes.

Citation

Ferri, L., Spanò, R., Maffei, M. and Fiondella, C. (2021), "How risk perception influences CEOs' technological decisions: extending the technology acceptance model to small and medium-sized enterprises' technology decision makers", European Journal of Innovation Management, Vol. 24 No. 3, pp. 777-798. https://doi.org/10.1108/EJIM-09-2019-0253

1. Introduction

This paper falls under the domain of studies devoted to investigate the role played by information and communications technology (ICT) systems in increasing the efficiency and effectiveness of firms' processes (e.g. Venter, 2014) and reshaping them (Andrews et al., 2018). Over the last 15 years, major attention has been devoted to cloud computing, which has been identified as a means to pursue greater competitive advantage (Ross and Blumenstein, 2015; Varghese and Buyya, 2018).

Cloud computing is a distributed computing technology that enables access to virtualized resources, including computers, networks, storage, development platforms and applications (Mell and Grance, 2009). These resources can be unilaterally requested, provisioned for and configured by users, with minimal interactions with the cloud service provider (CSP). Furthermore, resources can be rapidly scaled up and down to meet the user's needs, thereby creating the illusion of infinite resources available at any time (González-Martínez et al., 2015). Resource utilization can be measured and controlled by customers on a pay-per-use basis (Ibrahim et al., 2011; Carreiro and Oliveira, 2019). Cloud computing is considered a disruptive technology with profound implications for people and firms (Sultan, 2011; Ross and Blumenstein, 2015; Rittinghouse and Ransome, 2016). It provides numerous services, such as software, hardware and reduced data costs associated with ICT, all the while achieving economies of scale.

Cloud computing diffusion has become the central subject of several studies. However, the topic is still vague because this technology can involve either software solutions or server infrastructures, thus implying a growing degree of complexity and fixed costs. Furthermore, the plethora of available reports relies on heterogeneous scales and measures to monitor the issues of cloud computing adoption, compromising any chance of comparability. Ross and Blumenstein (2015) highlighted that even though firms are attempting to integrate some cloud-based tools (e.g. for file storage) into their existing ICT applications, the technology is not yet widely used. The same view has been expressed by the Organization for Economic Co-operation and Development (OECD) (2016) and EUROSTAT (2018). In general terms, it is possible to assert that even if there is a consolidated use of cloud-based tools in business (e.g. Office 365 and Dropbox), the adoption rate for this technology is not growing as fast as estimated considering its advantages for firms (EUROSTAT, 2018).

According to EUROSTAT (2018), of the enterprises that declared they use cloud computing, 69% relied on this solution for their e-mail instead of setting up a server infrastructure, which involves inter alia capital expenditure and maintenance costs. These firms chose a solution based on per-user operating costs. The same report warned that in Europe, the average diffusion of cloud computing based on server infrastructure is 26%, indicating that the use of cloud computing is generally limited to a small set of nonsensitive data. Moreover, the use of the technology varies greatly across countries. In Finland, Sweden, Denmark, The Netherlands, Ireland, the United Kingdom and Belgium, at least 40% of enterprises use cloud computing; in Romania and Bulgaria, at most 10% of enterprises do so. The use of cloud computing over the last few years has increased, particularly in large enterprises of which more than half (56%) used cloud computing in 2018. The increase for small and medium-sized enterprises (SMEs) over this period was three times smaller than the large enterprises (from 18% to 25%; EUROSTAT, 2018).

Studies have indicated a wide variety of benefits for firms adopting cloud computing (Buyya et al., 2009; Sultan, 2011; Marston et al., 2011; Lee and Mautz, 2012). These studies have shown enhanced rapidity and flexibility as well as greater competitive advantage (Sultan and van de Bunt-Kokhuis, 2012; Ross and Blumenstein, 2015) for firms adopting this technology. Research over the last ten years has investigated the main determinants of cloud computing adoption (e.g. Low et al., 2011; Chang et al., 2013; Lumsden and Gutierrez, 2013; Gangwar et al., 2015; Alharbi et al., 2016; Alismaili et al., 2016; Sharma et al., 2016). The literature has explored final users' intention to use this technology but has overlooked the fact that the implementation decision in firms is not made by the final user of the technology. The decision makers' implementation intention may be different from the final users' view. Considering the perceptions of those practically involved in the implementation of any given system remains crucial, but to fully comprehend technological change dynamics, it is important to look at the perceptions of the firms' decision makers, such as chief executive officers (CEOs). This gap in the cloud computing literature forms the core of this study.

The views of decision makers are likely to be affected by other factors and may be largely influenced by dimensions of risk. Nevertheless, how and to what extent risk perception is a powerful influencer in cloud computing adoption (Slovic, 2000, 2016) remains an unexplored area. Any interpretation of adoption intentions is incomplete without an analysis of the effect of risk perception on CEOs' decision-making (Renn and Benighaus, 2013; Benischke et al., 2019); this constitutes another major gap that the present study aims to address.

The majority of studies in this area investigated the implementation dynamics in large firms because of the lack of contributions on SMEs; therefore, the authors of this study decided to focus on this type of firm. SMEs represent most of the firms in different continental European countries, including Italy (Hillary, 2017; Jianwen and Wakil, 2019). SMEs are often drivers of industrial technological innovation (Brunswicker and Vanhaverbeke, 2015; Kapitonov et al., 2017; Fakhreddine and Castonguay, 2019). Advanced ICT tools can help these firms survive in competitive business environments (Chinedu Eze et al., 2014; Ekberg and Gao, 2018; Jianwen and Wakil, 2019). For this reason, an understanding of the factors affecting cloud computing adoption in SMEs is paramount; however, research on these factors is lacking. Any investigation of decision-making dynamics in SMEs cannot leave aside the risk dimension, given its undeniable impact on these firms' strategic and operational choices (Caldarelli et al., 2017).

Consequently, the aim of this paper is to investigate what factors influence CEOs’ intentions to implement cloud technology in Italian SMEs. To achieve this aim, the study proposes a model that integrates the theoretical construct of the technology acceptance model (TAM; Davis, 1989) with a classification of perceived benefits and risks related to cloud computing (Caldarelli et al., 2017).

The integration of risk dimensions into the TAM has been proposed by several other studies (Pavlou, 2003; Nam and Lee, 2009). These studies considered risk from a broad perspective and were unable to tap into the impact of individual risks. By contrast, to better account for the complexity of the decision-making process, this paper further extends the framework, following Caldarelli et al. (2017), to encompass a more detailed categorization of risks.

This study relies on a Likert-based survey that was disseminated to first-time adopters of cloud computing within Italian SMEs. After the survey, structural equation modeling was performed to provide a clear view of the main factors that could influence the decision to implement cloud computing.

The findings indicate that perceived usefulness and perceived risks are the most important determinants of cloud computing adoption in SMEs, drawing attention to the importance of these variables in the decision-making process. Furthermore, the results explain the extent to which each category of risk described by the literature contributes to the CEOs' overall perceived risk of cloud technology.

The paper offers several contributions to the literature and practice. It complements and extends the debate, drawing attention to the role played by several categories of risk in CEOs' technological decision-making. It provides a newer theoretical model that can also be useful in exploring other settings (not limited to the SMEs explored here) and tools (e.g. blockchain). Additionally, the results of this study can be used by practitioners to support strategic decision-making and the implementation phase. The findings can also be used by CSPs to develop a broader strategy toward technological innovation in support of SMEs' competitive advantage.

The remainder of this paper is organized as follows: Section 2 reviews the literature and describes the model development. Section 3 presents the research design, while section 4 presents the findings of the analysis. Finally, section 5 discusses the results and puts forth some concluding remarks.

2. Model development

2.1 Prior literature on cloud computing

Cloud computing can be defined as a set of technologies that enable, store and process data through the use of hardware and/or software that is distributed and made virtually available on the Internet (Mell and Grance, 2011). These services are provided by qualified CSPs to users through a set of technologies and information resources available online.

The literature on cloud computing has increased considerably over the last few years. According to Yang and Tate (2009), the studies on this topic can be divided into four areas: technology (e.g. performance, network and data management), business economics (e.g. cost–benefit analyses, market analyses, risks and legal issues), applications (e.g. purely engineering-based studies) and general studies (e.g. nonempirical studies regarding the introduction and implementation of cloud computing). Bearing in mind the purposes of the current study, a full understanding of the benefits associated with cloud computing is necessary.

The initial studies on the topic were strictly theoretical. In recent years, research has focused on the benefits related to the adoption of cloud computing (Heilig and Voß, 2014). Studies have identified five advantages arising from the adoption of cloud computing: cost reduction (Almulla et al., 2012; Lee and Mautz, 2012; Lawler et al., 2012; Chang et al., 2019), reduction in the required number of ICT employees (Dahbur et al., 2012; Lawler et al., 2012; Chang et al., 2019), increased flexibility (Buyya et al., 2009; Almulla et al., 2012; Dahbur et al., 2012; Lawler et al., 2012; Arpaci, 2017), increased mobility and information access (Buyya et al., 2009; Lawler et al., 2012; Gonel and Akinci, 2018) and lessened focus on ICT (Almulla et al., 2012; Arpaci, 2017; Gonel and Akinci, 2018). Although studies have examined cloud computing adoption in firms (Wu, 2011; Hsieh, 2015; Gangwar et al., 2015; Agrawal et al., 2019), they mainly focused on its benefits and did not consider its risks or the decision-making process behind it.

2.2 The technology acceptance model and cloud computing studies

This section offers an overview of the features of TAM and explains why this model is relevant to explore the issues cited earlier, which constitutes the main subject of this study. The TAM is a widely accepted model for understanding information technology (IT) adoption and technology acceptance processes (King and He, 2006; Turner et al., 2010). A broad range of empirical and conceptual studies have justified the significant role of TAM, defining it as a reliable model in technology acceptance studies. The TAM is an adaptation of the theory of reasoned action (Fishbein and Ajzen, 1975) and was mainly designed to model user acceptance of IT (Davis, 1989). The TAM explains much of the variance in users' behavioral intentions related to adopting new technology in a wide variety of contexts, and it predicts the determinants of user technology acceptance (Venkatesh, 2000; Howell, 2015). The model hypothesizes that technology use is directly determined by the behavioral intention to use the technology, which in turn is influenced by users' perceived ease of use (PEOU) and the perceived usefulness (PU) of the system. More specifically, the model posits that the intention to use a technology depends on two motivational factors: PU and PEOU. These two theoretical constructs provide an accurate measure of users' technology acceptance (Davis, 1989; Venkatesh, 2000). According to the TAM, the user's intention to use a technology (INT) is determined by these two particular beliefs. Finally, intention leads to the final behavior (BI) of using (or accepting) the technology and generating the actual usage behavior (Davis, 1989; Venkatesh and Davis, 2000). The TAM requires integration with several variables to improve its predictive value (e.g. Teo et al., 2007; Hernandez et al., 2008; Opitz et al., 2012; Hsieh, 2015; Liébana-Cabanillas et al., 2015; Coeurderoy et al., 2014; Joo et al., 2018; Verma et al., 2018). The model is useful for explaining people's reactions toward technology and predicting their degree of acceptance (Davis, 1989), but it does not take into account all the variables that affect the decision-making process (Turner et al., 2010; Reymen et al., 2017). Table 1 provides a list of different variables used in previous studies to improve the predictive value of TAM in cloud computing studies.

The reviewed literature indicates two important aspects at the core of the research design of this study. First, although these studies confirmed the good predictive value of TAM in understanding technological acceptance, they also revealed a gap in the field. To date, research has been limited to focusing on the final users of any given technology and has overlooked the perspective of the firm and of the decision makers in particular (which usually differs from that of the final users). Second, even if PU and PEOU are considered the key factors of cloud computing implementation, to better interpret the phenomena under scrutiny, it is important to integrate a key variable of technological choices: the risk dimension (Pavlou, 2003; Caldarelli et al., 2017).

Risks are acknowledged as a fundamental dimension affecting human decision-making processes (Slovic, 2000, 2016). People decide to perform an action by taking into account all the possible outcomes in terms of action's benefits (positive outcomes) and risks (negative outcomes). Despite the importance of the perceived risks, only a few studies have tried to integrate this variable into the TAM. Pavlou (2003) integrated the TAM with the theory of reasoned action and with risk variables to predict consumer acceptance of e-commerce. Nam and Lee (2009) showed that perceived risks are considered resistance factors in adopting new technology. Other studies suggested that considering risk is paramount to understanding technological adoption choices (Forsythe and Shi, 2003). What remains hidden in extant studies using the TAM is the multifaceted phase of risk. For this reason, this paper goes further by considering, in addition to the overall perceived risk, factors such as organizational (ORs), technical (TRs), legal (LRs) and other general risks (OGRs), in line with previous research (Caldarelli et al., 2017). This paper adapted the TAM theoretical construct to ICT decision makers by following the same approach used by other authors (e.g. Hernandez et al., 2008; Opitz et al., 2012; Chen et al., 2017; Hassan et al., 2018) and introducing “perceived risks” as a variable that affects CEOs' intentions to introduce cloud technology in firms.

2.3 Hypotheses development

Several theoretical models have been proposed to better understand the decision-making process for cloud technology adoption (e.g. TAM 1, TAM 2, TAM 3 and unified theory of acceptance and use of technology-UTAUT; Gangwar et al., 2015; Chang et al., 2016; Sabi et al., 2017). This study employed the TAM because it is considered one of the most reliable models for identifying the main determinants of technology usage (Teo et al., 2007; Hernandez et al., 2008; Opitz et al., 2012; Hsieh, 2015; Liébana-Cabanillas et al., 2015; Coeurderoy et al., 2014; Joo et al., 2018; Verma et al., 2018).

PU is a factor that reflects people's beliefs about the use of technology and whether it will be helpful in improving performance (Davis, 1989). PU represents the users' subjective assessment of job performance enhancement arising from the usage of a new piece of technology (Davis, 1989). It is a theoretical construct that has repeatedly been revealed to influence attitude (ATT) and is a direct determinant of continued ICT usage intentions (Lee and Mautz, 2012). In addition, PU mediates the effect of PEOU on behavioral intention (Davis, 1989).

PU has been identified as a variable that significantly influences the inclination of different types of users to use cloud computing in different settings (Alraimi et al., 2015; Gangwar et al., 2015; Opitz et al., 2012; Park and Ryoo, 2013; Hsieh, 2015). However, relying on an evolution of TAM, Nikolopoulos and Likothanassis (2018) found that the main determinant of the intention to use is computer self-efficacy; they also discovered that PU has a lower effect, even though it exerts a positive effect on users’ intention.

In the current research, the concept of PU overlaps with the benefits of cloud computing. The PU of a piece of technology is directly related to the expected benefits arising from the adoption of that technology (Dalcher and Shine, 2003; Safeena et al., 2013; Gangwar et al., 2015). In line with previous studies (e.g. European Union Agency for Cybersecurity [ENISA], 2009; Almulla and Yeun, 2010; Marston et al., 2011; Lawler et al., 2012; Lee and Mautz, 2012; Caldarelli et al., 2017), this paper considers five expected benefits: cost reduction, the reduction of ICT employees, increased flexibility, increased mobility and information access and lessened focus on ICT. CEOs' opinions about the benefits of adopting cloud technology are crucial to the implementation of this technology. Based on this, the following hypothesis was formulated:

H1.

PU has a positive effect on CEOs' INT.

PEOU reflects people's beliefs regarding whether the technology can be used without effort (Venkatesh and Davis, 2000). This factor is inversely related to the concept of perceived complexity proposed by Rogers (1995).

The literature on new technology adoption has shown the positive effect of PEOU on INT and BI (Davis, 1989; Taylor and Todd, 1995; Venkatesh and Davis, 2000). Some cloud computing studies have found a strong positive relationship between PEOU and INT (Opitz et al., 2012; Gangwar et al., 2015; Nikolopoulos and Likothanassis, 2018). For example, Berhend et al. (2011) found that PEOU is the main determinant of the intention to use cloud computing in a community college in the USA. Other authors obtained similar results with PEOU in different fields and countries (Opitz et al., 2012; Park and Ryoo, 2013; Hsieh, 2015; Changchit and Chuchuen, 2018; Al-Somali and Baghabra, 2019). They found that PEOU positively influences PU because if a tool is easy to use, the effort to implement it will be low and the perception of usefulness will increase (Davis, 1989; Changchit and Chuchuen, 2018; Al-Somali and Baghabra, 2019). In the current study, PEOU is defined as the degree to which the CEO believes that adopting cloud computing in their firm would be free of effort for their employees. In light of the aforementioned literature, PEOU is expected to directly influence PU and ATT in a positive way (Davis, 1989; Venkatesh et al., 2002; King and He, 2006). Thus, the following hypotheses were formulated:

H2.

PEOU has a positive effect on CEOs' INT.

H3.

PEOU has a positive effect on CEOs' PU.

Despite the large number of studies on the determinants of cloud computing adoption in firms (Low et al., 2011; Chang et al., 2013; Lumsden and Gutierrez, 2013; Gangwar et al., 2015; Alharbi et al., 2016; Alismaili et al., 2016; Sharma et al., 2016), there is a lack of knowledge about the effects of risk perception (RP) on people's intention to use this technology.

To provide a complete view of CEOs' decision-making processes, RP was added to the TAM in this study. Previous research merging the TAM and RP issues has shown that RP is a relevant dimension to take into account (i.e. Pavlou, 2003).

Several studies have revealed that RP is a fundamental variable in human decision-making processes (Slovic, 2000, 2016; Yuan and Woodman, 2010). More specifically, people decide to perform an action by considering all the possible outcomes in terms of action's benefits (positive outcomes) and risks (negative outcomes). Despite the importance of the perceived risks, only a few authors have tried to integrate this variable into the TAM. Pavlou (2003) warned that due to the impersonal nature and implicit uncertainty of the online environment, e-commerce choices are largely affected by RP. Thus, risk is understood as a direct antecedent of intention, and it has a negative effect on intention. Nam and Lee (2009) explored factors influencing the adoption of online banking by customers. His results indicated that the intention to use a new technology is adversely affected by risks and positively affected by the perceived benefits, attitude and PU. Other authors addressed the issues of risks and technology acceptance and obtained similar results (Pavlou, 2003; Forsythe and Shi, 2003). They cautioned that an increasing perception of risks is likely to limit technological acceptance. Based on the literature, the following hypothesis was formulated:

H4.

RP has a negative effect on CEOs' INT.

RP is a multifaceted theoretical construct that deserves more detailed investigation. Hence, this paper considers the risk classification proposed by Caldarelli et al. (2017), which identifies 18 different risks associated with cloud computing implementation. These risks can be divided into four classes: organizational, technical, legal and other general risks. ORs are associated with the potential impact of cloud computing on the firm's organizational structure (Committee of Sponsoring Organizations of the Treadway Commission [COSO], 2012; Tiwari and Mishra, 2012; Latif et al., 2014); they include risks such as ICT organizational change and loss of business reputation. TRs include all the possible technical problems caused by CSPs, such as resource-sharing problems, data leakage and sharing technology vulnerabilities (COSO, 2012; Gangwar et al., 2015). LRs are related to the problems arising from the storage of data in different countries with laws and regulations different from those of the client firm, as well as the responsibility of the CSP in the case of business interruption (Dove et al., 2015; Rittinghouse and Ransome, 2016; Jones et al., 2017). Finally, OGRs include data protection, physical security and privacy (COSO, 2012; Ullah and Kahn, 2014). Deciders in SMEs perceive all of these risks as high, providing a map of RP in terms of probability and impact (Caldarelli et al., 2017). Although there is a strong perception of all the risks, the studies did not describe the effect of each category on the overall RP and hence on CEOs' implementation decisions.

In line with previous research, all the risks listed above represent negative events that could be significant barriers to cloud computing adoption. The final user must find the right trade-off between these risks and the benefits they can gain when adopting this tool. Based on the literature, the following hypotheses were formulated:

H5.

OR has a strong positive effect on RP.

H6.

TR has a positive effect on RP.

H7.

LR has a positive effect on RP.

H8.

OGRs have a positive effect on RP.

Figure 1 summarizes the proposed model and the research hypotheses.

3. The research method

3.1 The questionnaire

To achieve the aim of this study, a Likert-based questionnaire was created. The questionnaire was divided into five sections – one for each variable of the model. The first section included the respondents' personal information. The second section contained questions about PU, using the perceived benefits of cloud computing as an indicator of PU. The third section focused on PEOU, following Davis (1989) approach. The fourth section focused on the different categories of risks (identified in section 2.3), while the last section was about intention and behavior. An even-numbered Likert scale was used for all questions, ranging from 1 (strongly disagree) to 6 (maximum agree) (Likert, 1932).

With reference to the perceived risks, the respondents were asked to explain their perceptions of the likelihood and impact of the negative event verification. An event is considered risky if it has a high probability of verifying and if it could have a large impact on the organization (COSO, 2012). To take into account both the perceived probability and impact for each risk, the interaction between probability and impact was considered a measuring factor. More specifically, each risk was measured as follows:

R=(L×I)/6

where R is the measure of the risk, L is the perceived likelihood of the risk and I is the perceived impact of the risk. The concept of perception refers to subject's expectations about a phenomenon that could (or could not) happen (Renn and Benighaus, 2013; Slovic, 2016). Generally, to perceive something does not imply full knowledge of the events. Perception is strongly related to individuals' personal experiences, education, culture and other subjective variables. The interaction between likelihood (L) and impact (I) was used to catch both dimensions of RP, avoiding the possibility of having just a partial view of the CEOs' perception of riskiness (COSO, 2012).

3.2 Sample selection

Following the approach of Hernandez et al. (2008), the questionnaire was disseminated among a sample of CEOs working in Italian SMEs. The Italian setting was chosen, given the country's growing attention to the importance of cloud computing, which has resulted in an increasing number of government programs. Since 2012, the Italian Government, especially in its report “Agenda Digitale 1.0,” has expressed the need to use cloud computing for public data storage (Italian Government, 2012; Bank of Italy, 2013; 2018). Furthermore, in Italy, this technology has a good rate of diffusion (around 20%) in firms, so it is considered sufficiently mature (EUROSTAT, 2016; 2018). This is a valuable characteristic that allows a deep understanding of the phenomenon, avoiding distortions coming from the fear of new technology.

This paper focuses on SMEs for different reasons. First, SMEs represent most of the firms in different continental European countries, including Italy (Hillary, 2017; Jianwen and Wakil, 2019). Second, SMEs are the main drivers of industrial technological innovation (Brunswicker and Vanhaverbeke, 2015; Kapitonov et al., 2017; Fakhreddine and Castonguay, 2019). Third, SMEs require the newest and most advanced ICT tools to survive in innovative and competitive business environments (Chinedu Eze et al., 2014; Ekberg and Gao, 2018; Jianwen and Wakil, 2019).

To determine the effects of the perceived risks and benefits on CEOs' intentions to implement cloud computing in their firms, data from the firms were collected through three independent CSPs. The sample includes only those SMEs that contacted the CSPs to understand the possibility of implementing a public cloud computing solution using the software as a service (SaaS) model. This paper focuses on SMEs that decided to introduce public cloud computing for two reasons. First, public cloud computing is considered a riskier model of cloud computing, so a CEO should consider all the possible risks. Second, this paper aims to determine the effect of perceived risks on CEOs' intentions to implement cloud technology; thus, to understand how the TAM constructs affect CEOs' technological decisions and to avoid influences from the previous use of this technology, this paper considered only firms that are already interested in the potential introduction of cloud computing. The CSPs were asked to list firms classified as “cloud computing first-time adopters,” and the questionnaire was disseminated in the “decision period,” which is the period between the first contact with the CSP and the introduction of cloud technology.

The dissemination phase lasted for 90 days. The survey was manually disseminated before the colloquium between CEOs and the CSP consultant. Data were copied in Excel by two researchers of the team to avoid the risk of data mismatch. A total of 166 CEOs agreed to participate in the survey. Also, five incomplete forms were removed, resulting in a final sample of 161 CEOs. Table 2 shows the descriptive statistics of the sample.

As Table 2 shows, the sample is quite balanced. Thus, personal variables (e.g. gender, age and education) should not influence the results.

3.3 Reliability and the confirmatory factor analysis

To assess the reliability of the questionnaire, different tests were performed. First, the scale was analyzed using the principal component analysis and varimax rotation with Kaiser normalization (Hair et al., 2010). The result for Bartlett's test of sphericity was 0.000, and the Kaiser-Meyer-Olkin (KMO) value was 0.782. The KMO value should be higher than 0.5 to ensure high sampling adequacy and data factorability. No items were dropped after the exploratory factor analysis. Finally, the variables were grouped into 12 factors explaining 74.22% of the total variance. This result means that the factors extracted from the analysis can explain a great part of the CEOs' intentions to adopt cloud computing.

The survey reliability was checked using Cronbach's alpha and the average variance extracted (AVE) test (Diamantopoulos and Siguaw, 2000). The results of the tests are summarized in Table 3.

Table 3 shows that Cronbach's alpha results are comparable with those reported in other studies. Cronbach's alpha values range from 0.793 to 0.915, showing a high degree of reliability (exceeding the minimum recommended level of 0.6). Like Cronbach's alpha results, the AVE results show a high degree of reliability, as they are higher than 0.5 (Hair et al., 2010).

4. Results

The overall goodness-of-fit was assessed using the chi-square test, which is widely used to assess the adequacy of a model in terms of its ability to reflect the variance and covariance of data (Byrne, 2013). The result shows an overall χ²/df of 0.536 (p < 0.001). Because of the tendency of this measure to be particularly sensitive to the sample size, other fit indices were calculated. Table 4 summarizes the results.

Tests were also carried out for the average block variance inflation factor (AVIF = 4.500, acceptable if ≤ 5, ideally ≤ 3.3), average full collinearity variance inflation factor (AFVIF = 3.134, acceptable if ≤ 5, ideally ≤ 3.3) and Simpson's paradox ratio (SPR = 0.889, acceptable if ≥ 0.7, ideally = 1).

After measuring the goodness-of-fit, structural equation modeling was carried out to understand the effect of each latent variable on the intention to use cloud technology. We employed a formative scale to measure each construct. Figure 2 presents the research results.

The results show that CEOs' decision-making processes with regard to the introduction of cloud technology are strongly affected by RP and PU, while PEOU has a weaker effect than the other variables. These three variables explain 45% of the total variance intention (R² = 0.45), while the model explains 72% of CEOs' behavior (R² = 0.72).

More specifically, PU has a stronger positive effect on the intention to implement cloud technology (b = 0.27, p < 0.01) than other factors do. This means that CEOs perceive cloud computing as an important tool that can provide their firms with several advantages, such as increased efficacy and reduced general IT costs, thereby increasing the firms' effectiveness. This finding is in accordance with those of previous studies showing that cloud technology provides advantages mainly in terms of cost savings and increased flexibility (Almulla et al., 2012; Lee and Mautz, 2012; Lawler et al., 2012; Ross and Blumenstein, 2015; Arvanitis et al., 2017; Varghese and Buyya, 2018; Gonel and Akinci, 2018). As a result, hypothesis 1 is fully supported.

PEOU has a positive effect on both INT (b = 0.07, p < 0.05) and PU (b = 0.68, p < 0.01). The positive effect of PEOU on PU shows that cloud technology is perceived as highly useful when the technology is easier to use. This finding is consistent with those of other studies conducted in different fields and countries (e.g. Gangwar et al., 2015; Ratten, 2015; Arvanitis et al., 2017; Caldarelli et al., 2017). On the other hand, the weak effect of PEOU on INT could be because CEOs are not interested in ease of use since they are not the final users of the new technology. This is in line with other studies (Opitz et al., 2012) that showed that when the technological decider is not the user of the technology, PEOU can be less important in the decision-making process. Thus, hypotheses 2 and 3 are supported.

The results show that RP has a strong negative effect on INT (b = −0.57, p < 0.01). RP significantly affects implementation decisions, as confirmed by other studies (e.g. Dahbur et al., 2012; Arvanitis et al., 2017; Caldarelli et al., 2017). This supports hypothesis 4. Moreover, the results enhance knowledge about how each risk category affects RP. The different risks categories highlighted in the literature have a strong positive effect on overall RP, confirming the finding of Caldarelli et al. (2017) that cloud technology is still perceived as risky.

OR has a strong positive effect on overall RP (b = 0.36, p < 0.01); this shows that organizational and reputational risks contribute positively to RP. This is in accordance with several studies indicating that a high perception of OR is one of the main barriers to the adoption of cloud computing in firms (Latif et al., 2014; Arvanitis et al., 2017; Caldarelli et al., 2017). Therefore, hypothesis 5 is supported.

The results show that TR has a positive effect on RP (b = 0.44, p < 0.01). This means that risks such as isolation problems and data leakages are the most negatively perceived events. Thus, hypothesis 6 is supported. This is in line with a previous study that found that CEOs are more interested in cloud technology issues than in other kind of issues. Gangwar et al. (2015) suggested that trust in CSPs plays an important role in ensuring good migration to cloud technologies.

LR has a weak positive effect on RP (b = 0.09, p < 0.10). This finding contrasts with those of previous studies showing that CEOs are more interested in the legal issues of cloud computing than the technological issues (Dove et al., 2015; Rittinghouse and Ransome, 2016; Jones et al., 2017). As with any disruptive technology, cloud computing has legal issues that need to be addressed before migration. Moreover, the findings of this study show that LR is the least important in terms of the effect on CEOs' RP, as LR has a negligible effect on intention. A possible explanation for this is that the largest portion of CEOs in the sample chose top Italian CSPs, avoiding risks such as changes in jurisdiction. As a result, hypothesis 7 is supported.

Finally, the OGR category has a weak positive effect on RP (b = 0.25, p < 0.01). The risks considered “residual” in the literature have a strong effect on CEOs' RP, contradicting the results of other studies showing that these risks are perceived as less important than others (Ullah and Kahn, 2014; Caldarelli et al., 2017). It should be noted that this category includes risks related to cloud security and, more generally, to any kind of technology. This category influences RP more than LR does but has a weaker influence than the other risk categories. Therefore, hypothesis 8 is supported.

All risk categories have a positive effect on RP. These results confirm the finding of Yoon et al. (2013) that cloud technology is still considered risky. This perception has a negative effect on CEOs' implementation intentions.

5. Discussion and conclusion

This study shed light on the factors influencing CEOs' intentions to implement cloud technology in Italian SMEs. It developed an integrated version of TAM for cloud computing adoption that includes the theoretical construct of the perceived risks of cloud technology. The findings show that PU and RP are the most important determinants of cloud computing adoption in SMEs, confirming the importance of these variables in the decision-making process.

The results indicate that despite the strong negative effect of RP, the expected benefits (represented by PU) have a strong effect on CEOs' implementation intentions. The effect of PU inclines CEOs to agree to introduce a risky technology because they expect a strong positive impact in terms of cost savings, flexibility and lessened focus on ICT in a short period. Thus, CEOs perceive cloud technology as necessary for their firms to improve efficiency without considering the final user's point of view (as shown by the weak negative effect of PEOU). The analysis is not limited to the overall RP but shows the effect of the different risk categories. In particular, the results show that TR and OR have a stronger effect on the overall perceived risk of cloud computing. Surprisingly, LR has a low positive effect on the overall perceived risk. In light of these results, to reduce the overall RP, CSPs should inform CEOs of the actions taken to reduce the risks of cloud computing. What should be noted is the strong positive effect of PEOU on PU and the weak negative effect of PEOU on the intention to implement cloud technology. A possible explanation for this is that CEOs are not interested in the ease of using a new technology, but they think that ease of use is a driver to improve usefulness.

The findings support the integration of TAM and risk categories as a viable theoretical framework for analyzing these complex phenomena. This model has high reliability and, notwithstanding the application limited to cloud computing that is proposed in the paper, could be crucial to investigate the dynamics of decision-making involving different or multiple technological changes.

The findings contribute to the literature by offering an integrated model to better interpret how technology decisions are made and can become effective. While other studies focused on the perceptions of cloud computing users, this study is the first to explore the CEOs' perspective. This paper not only measures the impact of each risk category on the overall RP but also provides insights into CEOs' technological decision-making processes in relation to these risks. Therefore, the paper offers a basis for deeper reflection on the role of the risk dimension in technology-related decision-making, and it goes even deeper by detailing how and to what extent different risk categories may exert an impact – a topic that is still overlooked in the literature despite its relevance. The paper also reveals that previous studies investigating CEOs' decisions to introduce cloud computing through a cost–benefit approach are hardly incomplete.

The contribution of the paper extends even further as it not only covers a still overlooked domain of investigation, namely, SMEs but also offers basis for reflection that can be used by large firms and can be used to analyze decision-making processes involving different technological devices. The findings are also relevant to practitioners, as the study calls for more attention to daily practice and cooperation within the company when dealing with technological change decisions. The paper offers insights that are largely relevant for practitioners and highlights implications for CSPs.

As for CSPs, the availability of a measure associated with the different risk categories enables an understanding of the main issues affecting CEOs' adoption of decisions. This represents crucial strategic information for CSPs, which should pay attention to these issues to better target and communicate such important aspects, thus reassuring firms and possibly enhancing adoption chances. Mentoring and tutoring solutions could, for instance, represent a viable solution toward smoother adoption, especially in firms such as SMEs, where internal figures' expertise may not be available. Further clarification is needed on this matter. The paper suggests that SMEs lag behind in cloud computing adoption due to a pervasive perception of risk that outweighs the perception of benefits that could be derived from the technology. This implies that actions in this regard have to be prompted by both CSPs and policymakers, possibly in a systemic and generally agreed-upon effort. CSPs should focus on arrangements toward firms' clearer comprehension of risk probability and impact, especially on the strategies that could be taken to mitigate risky circumstances. That is, CSPs should work on firms' awareness that cloud computing adoption is not merely a matter of risk; they should exert risk management efforts to show the firms all the potential advantages of the tool. This would allow SMEs to grab the opportunity to rely on a disruptive technological innovation, enhancing their competitive and relational advantages.

Before concluding, several caveats need to be considered. First, the research focuses only on the Italian setting. Thus, even if the above-discussed implications are relevant to other contexts, future research should validate the study findings in other contexts and use a case-based approach, which may shed light on the differences in CEOs' technological decisions across countries and sectors. Second, the sample was composed of first-time adopters of cloud computing. Further research could explore whether and how decision makers' perceptions vary after technology adoption and use. Third, the paper focuses only on CEOs; it could be interesting to trace any misalignment between their views and users' views to better identify areas of improvement in coordination and collaboration. Finally, future research can map differences relating to firms' sector, size and age.

Figures

Figure 1

Theproposed model

Figure 2

Research results

Table 1

Variables used in previous cloud computing technology acceptance model (TAM) studies

Authors	Research context	Interviewees	Additional variables	Dependent variables	Integration motivations
Behrend et al. (2011)	USA colleges	Students	Personal innovation, technology anxiety, instructor support, reliability and access to software	PU, PEOU and future usefulness	Examined a range of predictors and outcomes relating to the acceptance of a cloud computing platform in the USA
Wu (2011)	Taiwan IT firms	IT practitioners	Marketing efforts, social influence, perceived benefits, security and trust	PU, PEOU, ATT and INT	Developed an explorative model that examines the factors affecting SaaS adoption
Alharbi (2012)	ICT firms	IT practitioners	Gender, age, education level, job domain and nationality	ATT	Investigated users' acceptance of cloud computing by integrating TAM with factors believed to affect users' acceptance
Opitz et al. (2012)	Listed German firms	CTO and CIO	Subjective norms, image, job relevance, output quality and results demonstrability	PU	Examined the technology acceptance of cloud computing by analyzing empirical data from 100 CIOs and IT managers
Park and Ryoo (2013)	Korean universities	Students	Social influence, personal innovativeness, expected benefits and expected costs	INT	Examined the relationships between switching factors and users' intention to switch to cloud computing
Park and Kim (2014)	Korean private universities	Students	Perceived connectedness, perceived security, service and system quality and perceived mobility	ATT	Investigated the main cognitive factors that contribute to shaping users' perceptions of and attitudes toward mobile cloud computing
Hsieh (2015)	Taiwan health care professions	Doctors	Rational decision bias theory variables	INT	Explained how users evaluate ICT change in relation to the health cloud and how they decide to resist it
Gangwar et al. (2015)	IT, manufacturing and finance firms	IT practitioners	Trading partners' support, competitive pressure, relative advantage, compatibility, complexity, organizational competency, top management support and training and education	PU, PEOU and INT	Integrated TAM and TOE framework for cloud computing adoption at the organizational level
Ratten (2015)	Cloud computing customers	Students	Consumer innovativeness, performance expectancy and security	INT	Examined which factors affect consumer attitudes toward cloud computing in the USA and Australia
Changchit and Chuchuen (2018)	USA universities	Students	Perceived security, perceived speed of access and perceived cost of usage	INT	Investigated which factors encourage potential users to adopt this technology

Table 2

Sample characteristics

Item	Measure	Frequency	Percentage
Age	Less than 30	6	3.7
	31–40	50	31.1
	41–50	42	26.1
	51–60	42	26.1
	60+	21	13.0
Education	Undergraduate	25	15.5
	University degree	96	59.6
	Master's degree	40	24.8
Gender	Male	82	50.9
	Female	79	49.1
Total		161	100.0

Table 3

Questionnaire reliability and descriptive statistics

	Question	Min	Max	Mean	Variance	Cronbach's alpha	Average variance extracted
Perceived usefulness	PU1	1	6	4.75	1.04	0.879	0.838
	PU2	1	6	5.06	0.58
	PU3	1	6	4.78	0.51
	PU4	1	6	4.77	0.54
	PU5	1	6	4.78	0.48
Perceived ease of use	PEOU1	1	6	4.72	0.58	0.901	0.871
	PEOU2	1	6	4.45	0.44
	PEOU3	1	6	4.36	0.41
	PEOU4	1	6	4.37	0.41
	PEOU5	1	6	4.82	0.33
Perceived risks	PR1	1	6	3.45	0.82	0.889	0.796
	PR2	1	6	3.46	0.74
	PR3	1	6	3.46	0.89
	PR4	1	6	3.38	0.60
Organizational risks*	OR1	1	6	4.18	1.11	0.739	0.677
	OR2	1	6	4.26	1.66
	OR3	1	6	4.00	1.23
	OR4	1	6	4.68	1.35
	OR5	1	6	4.51	1.16
	OR6	1	6	4.29	2.30
Technological risks*	TR1	1	6	4.23	1.18	0.897	0.791
	TR2	1	6	4.47	1.45
	TR3	1	6	3.91	0.88
	TR4	1	6	4.09	1.45
	TR5	1	6	3.57	1.17
	TR6	1	6	3.84	2.24
	TR7	1	6	3.81	1.46
	TR8	1	6	4.08	1.82
	TR9	1	6	3.79	1.25
	TR10	1	6	3.96	1.85
	TR11	1	6	4.02	1.41
	TR12	1	6	4.60	1.80
	TR13	1	6	4.30	1.08
	TR14	1	6	4.23	1.60
Legal risks*	LR1	1	6	4.20	1.29	0.887	0.855
	LR2	1	6	3.97	1.93
	LR3	1	6	3.88	1.31
	LR4	1	6	4.16	1.88
	LR5	1	6	4.05	1.28
	LR6	1	6	4.30	1.74
Other general risks*	OGR1	1	6	4.13	1.28	0.861	0.794
	OGR2	1	6	3.89	1.57
	OGR3	1	6	3.73	1.35
	OGR4	1	6	4.11	2.18
	OGR5	1	6	3.80	1.53
	OGR6	1	6	3.95	1.59
	OGR7	1	6	3.91	1.25
	OGR8	1	6	4.56	2.01
	OGR9	1	6	4.10	1.12
	OGR10	1	6	4.58	1.78
Intention	INT1	1	6	5.12	0.61	0.915	0.899
	INT2	1	6	5.37	0.49
	INT3	1	6	5.50	0.50
Behavior	BEHA1	1	6	5.53	0.42	-	-

Note(s): *For the risks in this category, the respondents were asked for both perceived probability and perceived impact

Table 4

The model reliability analysis

Fit index	Results	Reference value
Comparative fit index	0.967	> 0.95
Normed fit index	0.948	> 0.95
Relative fit index	0.953	> 0.95
Incremental fit index	0.957	> 0.95
Root mean square error of approximation	0.054	< 0.08