How risk perception influences CEOs ’ technological decisions: extending the technology acceptance model to small and medium-sized enterprises ’ technology decision makers

Purpose – Thispaperaimstoinvestigate the factorsinfluencingchief executiveofficers ’ (CEOs ’ ) intentionsto implement cloud technology in Italian small and medium-sized enterprises (SMEs). Design/methodology/approach – The study proposes a model that integrates the theoretical construct of the technology acceptance model (TAM) with a classification of perceived benefits and risks related to cloud computing. The study employs a structural equation modeling approach to analyze data gathered through a Likert scale-based survey. Findings – Thefindingsindicatethatriskperceptionhasastrongnegativeeffectontheintentiontointroduce cloud technology in firms. This effect is partially offset by the perceived ease of use of the technology. Originality/value – The study provides a new theoretical framework that integrates the TAM and a classification of perceived risks to provide a clear view of management ’ s cognitive processes during technological change. Moreover, the results show the main factors influencing decisions regarding the implementation of cloud computing in firms in light of the perception of risks. Finally, this study provides interesting findings for cloud service providers (CSPs) about their customers ’ decision-making processes.


Introduction
This paper falls under the domain of studies devoted to investigate the role played by information and communications technology (ICT) systems in increasing the efficiency and effectiveness of firms' processes (e.g. Venter, 2014) and reshaping them (Andrews et al., 2018). Over the last 15 years, major attention has been devoted to cloud computing, which has been identified as a means to pursue greater competitive advantage (Ross and Blumenstein, 2015;Varghese and Buyya, 2018).
Cloud computing is a distributed computing technology that enables access to virtualized resources, including computers, networks, storage, development platforms and applications powerful influencer in cloud computing adoption (Slovic, 2000(Slovic, , 2016 remains an unexplored area. Any interpretation of adoption intentions is incomplete without an analysis of the effect of risk perception on CEOs' decision-making (Renn and Benighaus, 2013;Benischke et al., 2019); this constitutes another major gap that the present study aims to address.
The majority of studies in this area investigated the implementation dynamics in large firms because of the lack of contributions on SMEs; therefore, the authors of this study decided to focus on this type of firm. SMEs represent most of the firms in different continental European countries, including Italy (Hillary, 2017;Jianwen and Wakil, 2019). SMEs are often drivers of industrial technological innovation (Brunswicker and Vanhaverbeke, 2015;Kapitonov et al., 2017;Fakhreddine and Castonguay, 2019). Advanced ICT tools can help these firms survive in competitive business environments (Chinedu Eze et al., 2014;Ekberg and Gao, 2018;Jianwen and Wakil, 2019). For this reason, an understanding of the factors affecting cloud computing adoption in SMEs is paramount; however, research on these factors is lacking. Any investigation of decision-making dynamics in SMEs cannot leave aside the risk dimension, given its undeniable impact on these firms' strategic and operational choices (Caldarelli et al., 2017).
Consequently, the aim of this paper is to investigate what factors influence CEOs' intentions to implement cloud technology in Italian SMEs. To achieve this aim, the study proposes a model that integrates the theoretical construct of the technology acceptance model (TAM; Davis, 1989) with a classification of perceived benefits and risks related to cloud computing (Caldarelli et al., 2017).
The integration of risk dimensions into the TAM has been proposed by several other studies (Pavlou, 2003;Nam and Lee, 2009). These studies considered risk from a broad perspective and were unable to tap into the impact of individual risks. By contrast, to better account for the complexity of the decision-making process, this paper further extends the framework, following Caldarelli et al. (2017), to encompass a more detailed categorization of risks.
This study relies on a Likert-based survey that was disseminated to first-time adopters of cloud computing within Italian SMEs. After the survey, structural equation modeling was performed to provide a clear view of the main factors that could influence the decision to implement cloud computing.
The findings indicate that perceived usefulness and perceived risks are the most important determinants of cloud computing adoption in SMEs, drawing attention to the importance of these variables in the decision-making process. Furthermore, the results explain the extent to which each category of risk described by the literature contributes to the CEOs' overall perceived risk of cloud technology.
The paper offers several contributions to the literature and practice. It complements and extends the debate, drawing attention to the role played by several categories of risk in CEOs' technological decision-making. It provides a newer theoretical model that can also be useful in exploring other settings (not limited to the SMEs explored here) and tools (e.g. blockchain). Additionally, the results of this study can be used by practitioners to support strategic decisionmaking and the implementation phase. The findings can also be used by CSPs to develop a broader strategy toward technological innovation in support of SMEs' competitive advantage.
The remainder of this paper is organized as follows: Section 2 reviews the literature and describes the model development. Section 3 presents the research design, while section 4 presents the findings of the analysis. Finally, section 5 discusses the results and puts forth some concluding remarks.

Model development 2.1 Prior literature on cloud computing
Cloud computing can be defined as a set of technologies that enable, store and process data through the use of hardware and/or software that is distributed and made virtually available CEOs' technological decision on the Internet (Mell and Grance, 2011). These services are provided by qualified CSPs to users through a set of technologies and information resources available online. The literature on cloud computing has increased considerably over the last few years. According to Yang and Tate (2009), the studies on this topic can be divided into four areas: technology (e.g. performance, network and data management), business economics (e.g. costbenefit analyses, market analyses, risks and legal issues), applications (e.g. purely engineeringbased studies) and general studies (e.g. nonempirical studies regarding the introduction and implementation of cloud computing). Bearing in mind the purposes of the current study, a full understanding of the benefits associated with cloud computing is necessary.

The technology acceptance model and cloud computing studies
This section offers an overview of the features of TAM and explains why this model is relevant to explore the issues cited earlier, which constitutes the main subject of this study. The TAM is a widely accepted model for understanding information technology (IT) adoption and technology acceptance processes (King and He, 2006;Turner et al., 2010). A broad range of empirical and conceptual studies have justified the significant role of TAM, defining it as a reliable model in technology acceptance studies. The TAM is an adaptation of the theory of reasoned action (Fishbein and Ajzen, 1975) and was mainly designed to model user acceptance of IT (Davis, 1989). The TAM explains much of the variance in users' behavioral intentions related to adopting new technology in a wide variety of contexts, and it predicts the determinants of user technology acceptance (Venkatesh, 2000;Howell, 2015). The model hypothesizes that technology use is directly determined by the behavioral intention to use the technology, which in turn is influenced by users' perceived ease of use (PEOU) and the perceived usefulness (PU) of the system. More specifically, the model posits that the intention to use a technology depends on two motivational factors: PU and PEOU. These two theoretical constructs provide an accurate measure of users' technology acceptance (Davis, 1989;Venkatesh, 2000). According to the TAM, the user's intention to use a technology (INT) is determined by these two particular beliefs. Finally, intention leads to the final behavior (BI) of using (or accepting) the technology and generating the actual usage behavior (Davis, 1989;Venkatesh and Davis, 2000). The TAM requires integration with several variables to improve its predictive value (e.g. Teo et al., 2007;Hernandez et al., 2008;Opitz et al., 2012;Li ebana-Cabanillas et al., 2015;Coeurderoy et al., 2014;Joo et al., 2018;Verma et al., 2018). The model is useful for explaining people's reactions toward technology and predicting their degree of acceptance (Davis, 1989), but it does not take into account all the variables that affect the decision-making process (Turner et al., 2010;Reymen et al., 2017). Table 1  CEOs' technological decision understanding technological acceptance, they also revealed a gap in the field. To date, research has been limited to focusing on the final users of any given technology and has overlooked the perspective of the firm and of the decision makers in particular (which usually differs from that of the final users). Second, even if PU and PEOU are considered the key factors of cloud computing implementation, to better interpret the phenomena under scrutiny, it is important to integrate a key variable of technological choices: the risk dimension (Pavlou, 2003;Caldarelli et al., 2017). Risks are acknowledged as a fundamental dimension affecting human decision-making processes (Slovic, 2000(Slovic, , 2016. People decide to perform an action by taking into account all the possible outcomes in terms of action's benefits (positive outcomes) and risks (negative outcomes). Despite the importance of the perceived risks, only a few studies have tried to integrate this variable into the TAM. Pavlou (2003) integrated the TAM with the theory of reasoned action and with risk variables to predict consumer acceptance of e-commerce. Nam and Lee (2009) showed that perceived risks are considered resistance factors in adopting new technology. Other studies suggested that considering risk is paramount to understanding technological adoption choices (Forsythe and Shi, 2003). What remains hidden in extant studies using the TAM is the multifaceted phase of risk. For this reason, this paper goes further by considering, in addition to the overall perceived risk, factors such as organizational (ORs), technical (TRs), legal (LRs) and other general risks (OGRs), in line with previous research (Caldarelli et al., 2017). This paper adapted the TAM theoretical construct to ICT decision makers by following the same approach used by other authors (e.g. Hernandez et al., 2008;Opitz et al., 2012;Chen et al., 2017;Hassan et al., 2018) and introducing "perceived risks" as a variable that affects CEOs' intentions to introduce cloud technology in firms.

Hypotheses development
Several theoretical models have been proposed to better understand the decision-making process for cloud technology adoption (e.g. TAM 1, TAM 2, TAM 3 and unified theory of acceptance and use of technology-UTAUT; Gangwar et al., 2015;Chang et al., 2016;Sabi et al., 2017). This study employed the TAM because it is considered one of the most reliable models for identifying the main determinants of technology usage (Teo et al., 2007;Hernandez et al., 2008;Opitz et al., 2012;Li ebana-Cabanillas et al., 2015;Coeurderoy et al., 2014;Joo et al., 2018;Verma et al., 2018).
PU is a factor that reflects people's beliefs about the use of technology and whether it will be helpful in improving performance (Davis, 1989). PU represents the users' subjective assessment of job performance enhancement arising from the usage of a new piece of technology (Davis, 1989). It is a theoretical construct that has repeatedly been revealed to influence attitude (ATT) and is a direct determinant of continued ICT usage intentions (Lee and Mautz, 2012). In addition, PU mediates the effect of PEOU on behavioral intention (Davis, 1989).
PU has been identified as a variable that significantly influences the inclination of different types of users to use cloud computing in different settings (Alraimi et al., 2015;Gangwar et al., 2015;Opitz et al., 2012;Park and Ryoo, 2013;. However, relying on an evolution of TAM, Nikolopoulos and Likothanassis (2018) found that the main determinant of the intention to use is computer self-efficacy; they also discovered that PU has a lower effect, even though it exerts a positive effect on users' intention.
In the current research, the concept of PU overlaps with the benefits of cloud computing. The PU of a piece of technology is directly related to the expected benefits arising from the adoption of that technology (Dalcher and Shine, 2003;Safeena et al., 2013;Gangwar et al., 2015). In line with previous studies (e.g. European Union Agency for Cybersecurity [ENISA], 2009;Almulla and Yeun, 2010;Marston et al., 2011;Lawler et al., 2012;Lee and Mautz, 2012;Caldarelli et al., 2017), this paper considers five expected benefits: cost reduction, the reduction of ICT employees, increased flexibility, increased mobility and information access and lessened focus on ICT. CEOs' opinions about the benefits of adopting cloud technology are crucial to the implementation of this technology. Based on this, the following hypothesis was formulated: H1. PU has a positive effect on CEOs' INT.
PEOU reflects people's beliefs regarding whether the technology can be used without effort (Venkatesh and Davis, 2000). This factor is inversely related to the concept of perceived complexity proposed by Rogers (1995).
The literature on new technology adoption has shown the positive effect of PEOU on INT and BI (Davis, 1989;Taylor and Todd, 1995;Venkatesh and Davis, 2000). Some cloud computing studies have found a strong positive relationship between PEOU and INT (Opitz et al., 2012;Gangwar et al., 2015;Nikolopoulos and Likothanassis, 2018). For example, Berhend et al. (2011) found that PEOU is the main determinant of the intention to use cloud computing in a community college in the USA. Other authors obtained similar results with PEOU in different fields and countries (Opitz et al., 2012;Park and Ryoo, 2013;Changchit and Chuchuen, 2018;Al-Somali and Baghabra, 2019). They found that PEOU positively influences PU because if a tool is easy to use, the effort to implement it will be low and the perception of usefulness will increase (Davis, 1989;Changchit and Chuchuen, 2018;Al-Somali and Baghabra, 2019). In the current study, PEOU is defined as the degree to which the CEO believes that adopting cloud computing in their firm would be free of effort for their employees. In light of the aforementioned literature, PEOU is expected to directly influence CEOs' technological decision PU and ATT in a positive way (Davis, 1989;Venkatesh et al., 2002;King and He, 2006). Thus, the following hypotheses were formulated: H2. PEOU has a positive effect on CEOs' INT.
H3. PEOU has a positive effect on CEOs' PU.
Despite the large number of studies on the determinants of cloud computing adoption in firms (Low et al., 2011;Chang et al., 2013;Lumsden and Gutierrez, 2013;Gangwar et al., 2015;Alharbi et al., 2016;Alismaili et al., 2016;Sharma et al., 2016), there is a lack of knowledge about the effects of risk perception (RP) on people's intention to use this technology.
To provide a complete view of CEOs' decision-making processes, RP was added to the TAM in this study. Previous research merging the TAM and RP issues has shown that RP is a relevant dimension to take into account (i.e. Pavlou, 2003).
Several studies have revealed that RP is a fundamental variable in human decisionmaking processes (Slovic, 2000(Slovic, , 2016Yuan and Woodman, 2010). More specifically, people decide to perform an action by considering all the possible outcomes in terms of action's benefits (positive outcomes) and risks (negative outcomes). Despite the importance of the perceived risks, only a few authors have tried to integrate this variable into the TAM. Pavlou (2003) warned that due to the impersonal nature and implicit uncertainty of the online environment, e-commerce choices are largely affected by RP. Thus, risk is understood as a direct antecedent of intention, and it has a negative effect on intention. Nam and Lee (2009) explored factors influencing the adoption of online banking by customers. His results indicated that the intention to use a new technology is adversely affected by risks and positively affected by the perceived benefits, attitude and PU. Other authors addressed the issues of risks and technology acceptance and obtained similar results (Pavlou, 2003;Forsythe and Shi, 2003). They cautioned that an increasing perception of risks is likely to limit technological acceptance. Based on the literature, the following hypothesis was formulated: H4. RP has a negative effect on CEOs' INT.
RP is a multifaceted theoretical construct that deserves more detailed investigation. Hence, this paper considers the risk classification proposed by Caldarelli et al. (2017), which identifies 18 different risks associated with cloud computing implementation. These risks can be divided into four classes: organizational, technical, legal and other general risks. ORs are associated with the potential impact of cloud computing on the firm's organizational structure (Committee of Sponsoring Organizations of the Treadway Commission [COSO], 2012; Tiwari and Mishra, 2012;Latif et al., 2014); they include risks such as ICT organizational change and loss of business reputation. TRs include all the possible technical problems caused by CSPs, such as resource-sharing problems, data leakage and sharing technology vulnerabilities (COSO, 2012;Gangwar et al., 2015). LRs are related to the problems arising from the storage of data in different countries with laws and regulations different from those of the client firm, as well as the responsibility of the CSP in the case of business interruption (Dove et al., 2015;Rittinghouse and Ransome, 2016;Jones et al., 2017). Finally, OGRs include data protection, physical security and privacy (COSO, 2012;Ullah and Kahn, 2014). Deciders in SMEs perceive all of these risks as high, providing a map of RP in terms of probability and impact (Caldarelli et al., 2017). Although there is a strong perception of all the risks, the studies did not describe the effect of each category on the overall RP and hence on CEOs' implementation decisions.
In line with previous research, all the risks listed above represent negative events that could be significant barriers to cloud computing adoption. The final user must find the right EJIM 24,3 trade-off between these risks and the benefits they can gain when adopting this tool. Based on the literature, the following hypotheses were formulated: H5. OR has a strong positive effect on RP.
H6. TR has a positive effect on RP.
H7. LR has a positive effect on RP.
H8. OGRs have a positive effect on RP. 3. The research method 3.1 The questionnaire To achieve the aim of this study, a Likert-based questionnaire was created. The questionnaire was divided into five sectionsone for each variable of the model. The first section included the respondents' personal information. The second section contained questions about PU, using the perceived benefits of cloud computing as an indicator of PU. The third section focused on PEOU, following Davis (1989) approach. The fourth section focused on the different categories of risks (identified in section 2.3), while the last section was about intention and behavior. An even-numbered Likert scale was used for all questions, ranging from 1 (strongly disagree) to 6 (maximum agree) (Likert, 1932).
With reference to the perceived risks, the respondents were asked to explain their perceptions of the likelihood and impact of the negative event verification. An event is considered risky if it has a high probability of verifying and if it could have a large impact on the organization (COSO, 2012). To take into account both the perceived probability and impact for each risk, the interaction between probability and impact was considered a measuring factor. More specifically, each risk was measured as follows: where R is the measure of the risk, L is the perceived likelihood of the risk and I is the perceived impact of the risk. The concept of perception refers to subject's expectations about CEOs' technological decision a phenomenon that could (or could not) happen (Renn and Benighaus, 2013;Slovic, 2016). Generally, to perceive something does not imply full knowledge of the events. Perception is strongly related to individuals' personal experiences, education, culture and other subjective variables. The interaction between likelihood (L) and impact (I) was used to catch both dimensions of RP, avoiding the possibility of having just a partial view of the CEOs' perception of riskiness (COSO, 2012).

Sample selection
Following the approach of Hernandez et al. (2008), the questionnaire was disseminated among a sample of CEOs working in Italian SMEs. The Italian setting was chosen, given the country's growing attention to the importance of cloud computing, which has resulted in an increasing number of government programs. Since 2012, the Italian Government, especially in its report "Agenda Digitale 1.0," has expressed the need to use cloud computing for public data storage (Italian Government, 2012;Bank of Italy, 2013;2018). Furthermore, in Italy, this technology has a good rate of diffusion (around 20%) in firms, so it is considered sufficiently mature (EUROSTAT, 2016;2018). This is a valuable characteristic that allows a deep understanding of the phenomenon, avoiding distortions coming from the fear of new technology. This paper focuses on SMEs for different reasons. First, SMEs represent most of the firms in different continental European countries, including Italy (Hillary, 2017;Jianwen and Wakil, 2019). Second, SMEs are the main drivers of industrial technological innovation (Brunswicker and Vanhaverbeke, 2015;Kapitonov et al., 2017;Fakhreddine and Castonguay, 2019). Third, SMEs require the newest and most advanced ICT tools to survive in innovative and competitive business environments (Chinedu Eze et al., 2014;Ekberg and Gao, 2018;Jianwen and Wakil, 2019).
To determine the effects of the perceived risks and benefits on CEOs' intentions to implement cloud computing in their firms, data from the firms were collected through three independent CSPs. The sample includes only those SMEs that contacted the CSPs to understand the possibility of implementing a public cloud computing solution using the software as a service (SaaS) model. This paper focuses on SMEs that decided to introduce public cloud computing for two reasons. First, public cloud computing is considered a riskier model of cloud computing, so a CEO should consider all the possible risks. Second, this paper aims to determine the effect of perceived risks on CEOs' intentions to implement cloud technology; thus, to understand how the TAM constructs affect CEOs' technological decisions and to avoid influences from the previous use of this technology, this paper considered only firms that are already interested in the potential introduction of cloud computing. The CSPs were asked to list firms classified as "cloud computing first-time adopters," and the questionnaire was disseminated in the "decision period," which is the period between the first contact with the CSP and the introduction of cloud technology.
The dissemination phase lasted for 90 days. The survey was manually disseminated before the colloquium between CEOs and the CSP consultant. Data were copied in Excel by two researchers of the team to avoid the risk of data mismatch. A total of 166 CEOs agreed to participate in the survey. Also, five incomplete forms were removed, resulting in a final sample of 161 CEOs. Table 2 shows the descriptive statistics of the sample.
As Table 2 shows, the sample is quite balanced. Thus, personal variables (e.g. gender, age and education) should not influence the results.

Reliability and the confirmatory factor analysis
To assess the reliability of the questionnaire, different tests were performed. First, the scale was analyzed using the principal component analysis and varimax rotation with Kaiser normalization (Hair et al., 2010). The result for Bartlett's test of sphericity was 0.000, and the Kaiser-Meyer-Olkin (KMO) value was 0.782. The KMO value should be higher than 0.5 to EJIM 24,3 ensure high sampling adequacy and data factorability. No items were dropped after the exploratory factor analysis. Finally, the variables were grouped into 12 factors explaining 74.22% of the total variance. This result means that the factors extracted from the analysis can explain a great part of the CEOs' intentions to adopt cloud computing.
The survey reliability was checked using Cronbach's alpha and the average variance extracted (AVE) test (Diamantopoulos and Siguaw, 2000). The results of the tests are summarized in Table 3. Table 3 shows that Cronbach's alpha results are comparable with those reported in other studies. Cronbach's alpha values range from 0.793 to 0.915, showing a high degree of reliability (exceeding the minimum recommended level of 0.6). Like Cronbach's alpha results, the AVE results show a high degree of reliability, as they are higher than 0.5 (Hair et al., 2010).

Results
The overall goodness-of-fit was assessed using the chi-square test, which is widely used to assess the adequacy of a model in terms of its ability to reflect the variance and covariance of data (Byrne, 2013). The result shows an overall χ 2 /df of 0.536 (p < 0.001). Because of the tendency of this measure to be particularly sensitive to the sample size, other fit indices were calculated. Table 4 summarizes the results.
After measuring the goodness-of-fit, structural equation modeling was carried out to understand the effect of each latent variable on the intention to use cloud technology. We employed a formative scale to measure each construct. Figure 2 presents the research results.
The results show that CEOs' decision-making processes with regard to the introduction of cloud technology are strongly affected by RP and PU, while PEOU has a weaker effect than the other variables. These three variables explain 45% of the total variance intention (R 2 5 0.45), while the model explains 72% of CEOs' behavior (R 2 5 0.72).
More specifically, PU has a stronger positive effect on the intention to implement cloud technology (b 5 0.27, p < 0.01) than other factors do. This means that CEOs perceive cloud computing as an important tool that can provide their firms with several advantages, such as increased efficacy and reduced general IT costs, thereby increasing the firms' effectiveness. This finding is in accordance with those of previous studies showing that cloud technology provides advantages mainly in terms of cost savings and increased flexibility (Almulla et al., PEOU has a positive effect on both INT (b 5 0.07, p < 0.05) and PU (b 5 0.68, p < 0.01). The positive effect of PEOU on PU shows that cloud technology is perceived as highly useful when the technology is easier to use. This finding is consistent with those of other studies conducted in different fields and countries (e.g. Gangwar et al., 2015;Ratten, 2015;Arvanitis et al., 2017;Caldarelli et al., 2017). On the other hand, the weak effect of PEOU on INT could be because CEOs are not interested in ease of use since they are not the final users of the new technology. This is in line with other studies (Opitz et al., 2012) that showed that when the technological decider is not the user of the technology, PEOU can be less important in the decision-making process. Thus, hypotheses 2 and 3 are supported.
The results show that RP has a strong negative effect on INT (b 5 À0.57, p < 0.01). RP significantly affects implementation decisions, as confirmed by other studies (e.g. Dahbur et al., 2012;Arvanitis et al., 2017;Caldarelli et al., 2017). This supports hypothesis 4. Moreover, the results enhance knowledge about how each risk category affects RP. The different risks categories highlighted in the literature have a strong positive effect on overall RP, confirming the finding of Caldarelli et al. (2017) that cloud technology is still perceived as risky.
OR has a strong positive effect on overall RP (b 5 0.36, p < 0.01); this shows that organizational and reputational risks contribute positively to RP. This is in accordance with several studies indicating that a high perception of OR is one of the main barriers to the adoption of cloud computing in firms (Latif et al., 2014;Arvanitis et al., 2017;Caldarelli et al., 2017). Therefore, hypothesis 5 is supported.

CEOs' technological decision
The results show that TR has a positive effect on RP (b 5 0.44, p < 0.01). This means that risks such as isolation problems and data leakages are the most negatively perceived events. Thus, hypothesis 6 is supported. This is in line with a previous study that found that CEOs are more interested in cloud technology issues than in other kind of issues. Gangwar et al. (2015) suggested that trust in CSPs plays an important role in ensuring good migration to cloud technologies.
LR has a weak positive effect on RP (b 5 0.09, p < 0.10). This finding contrasts with those of previous studies showing that CEOs are more interested in the legal issues of cloud computing than the technological issues (Dove et al., 2015;Rittinghouse and Ransome, 2016;Jones et al., 2017). As with any disruptive technology, cloud computing has legal issues that need to be addressed before migration. Moreover, the findings of this study show that LR is the least important in terms of the effect on CEOs' RP, as LR has a negligible effect on intention. A possible explanation for this is that the largest portion of CEOs in the sample chose top Italian CSPs, avoiding risks such as changes in jurisdiction. As a result, hypothesis 7 is supported.
Finally, the OGR category has a weak positive effect on RP (b 5 0.25, p < 0.01). The risks considered "residual" in the literature have a strong effect on CEOs' RP, contradicting the results of other studies showing that these risks are perceived as less important than others (Ullah and Kahn, 2014;Caldarelli et al., 2017). It should be noted that this category includes risks related to cloud security and, more generally, to any kind of technology. This category influences RP more than LR does but has a weaker influence than the other risk categories. Therefore, hypothesis 8 is supported.
All risk categories have a positive effect on RP. These results confirm the finding of Yoon et al. (2013) that cloud technology is still considered risky. This perception has a negative effect on CEOs' implementation intentions.

Discussion and conclusion
This study shed light on the factors influencing CEOs' intentions to implement cloud technology in Italian SMEs. It developed an integrated version of TAM for cloud computing adoption that includes the theoretical construct of the perceived risks of cloud technology. The findings show that PU and RP are the most important determinants of cloud computing adoption in SMEs, confirming the importance of these variables in the decision-making process.
The results indicate that despite the strong negative effect of RP, the expected benefits (represented by PU) have a strong effect on CEOs' implementation intentions. The effect of PU inclines CEOs to agree to introduce a risky technology because they expect a strong positive impact in terms of cost savings, flexibility and lessened focus on ICT in a short period. Thus, CEOs perceive cloud technology as necessary for their firms to improve efficiency without considering the final user's point of view (as shown by the weak negative effect of PEOU). The analysis is not limited to the overall RP but shows the effect of the different risk categories. In particular, the results show that TR and OR have a stronger effect on the overall perceived risk of cloud computing. Surprisingly, LR has a low positive effect on the overall perceived risk. In light of these results, to reduce the overall RP, CSPs should inform CEOs of the actions taken to reduce the risks of cloud computing. What should be noted is the strong positive effect of PEOU on PU and the weak negative effect of PEOU on the intention to implement cloud technology. A possible explanation for this is that CEOs are not interested in the ease of using a new technology, but they think that ease of use is a driver to improve usefulness.
The findings support the integration of TAM and risk categories as a viable theoretical framework for analyzing these complex phenomena. This model has high reliability and, notwithstanding the application limited to cloud computing that is proposed in the paper, could be crucial to investigate the dynamics of decision-making involving different or multiple technological changes.

EJIM 24,3
The findings contribute to the literature by offering an integrated model to better interpret how technology decisions are made and can become effective. While other studies focused on the perceptions of cloud computing users, this study is the first to explore the CEOs' perspective. This paper not only measures the impact of each risk category on the overall RP but also provides insights into CEOs' technological decision-making processes in relation to these risks. Therefore, the paper offers a basis for deeper reflection on the role of the risk dimension in technology-related decision-making, and it goes even deeper by detailing how and to what extent different risk categories may exert an impacta topic that is still overlooked in the literature despite its relevance. The paper also reveals that previous studies investigating CEOs' decisions to introduce cloud computing through a cost-benefit approach are hardly incomplete.
The contribution of the paper extends even further as it not only covers a still overlooked domain of investigation, namely, SMEs but also offers basis for reflection that can be used by large firms and can be used to analyze decision-making processes involving different technological devices. The findings are also relevant to practitioners, as the study calls for more attention to daily practice and cooperation within the company when dealing with technological change decisions. The paper offers insights that are largely relevant for practitioners and highlights implications for CSPs.
As for CSPs, the availability of a measure associated with the different risk categories enables an understanding of the main issues affecting CEOs' adoption of decisions. This represents crucial strategic information for CSPs, which should pay attention to these issues to better target and communicate such important aspects, thus reassuring firms and possibly enhancing adoption chances. Mentoring and tutoring solutions could, for instance, represent a viable solution toward smoother adoption, especially in firms such as SMEs, where internal figures' expertise may not be available. Further clarification is needed on this matter. The paper suggests that SMEs lag behind in cloud computing adoption due to a pervasive perception of risk that outweighs the perception of benefits that could be derived from the technology. This implies that actions in this regard have to be prompted by both CSPs and policymakers, possibly in a systemic and generally agreed-upon effort. CSPs should focus on arrangements toward firms' clearer comprehension of risk probability and impact, especially on the strategies that could be taken to mitigate risky circumstances. That is, CSPs should work on firms' awareness that cloud computing adoption is not merely a matter of risk; they should exert risk management efforts to show the firms all the potential advantages of the tool. This would allow SMEs to grab the opportunity to rely on a disruptive technological innovation, enhancing their competitive and relational advantages.
Before concluding, several caveats need to be considered. First, the research focuses only on the Italian setting. Thus, even if the above-discussed implications are relevant to other contexts, future research should validate the study findings in other contexts and use a casebased approach, which may shed light on the differences in CEOs' technological decisions across countries and sectors. Second, the sample was composed of first-time adopters of cloud computing. Further research could explore whether and how decision makers' perceptions vary after technology adoption and use. Third, the paper focuses only on CEOs; it could be interesting to trace any misalignment between their views and users' views to better identify areas of improvement in coordination and collaboration. Finally, future research can map differences relating to firms' sector, size and age. systems and cloud computing. He is interested in quantitative methodologies for accounting, management information systems and risks research.
Rosanna Span o holds a PhD in accounting from the Magna Graecia University of Catanzaro and is an assistant professor of accounting at the Department of Economics, Management, Institutions of the University of Naples Federico II, where she actively undertakes research and teaching activities. Her research broadly looks at accounting, management accounting and organizational change. She also advises and coordinates PhD students of the Department interested in qualitative methodologies for accounting, management accounting and auditing research. Rosanna Span o is the corresponding author and can be contacted at: rosanna.spano@unina.it Clelia Fiondella holds a PhD in accounting from the University of Naples Federico II and is an associate professor of accounting at the Department of Economics of the University of Campania Luigi Vanvitelli, where she actively undertakes teaching activities and advises students of the master degree in accounting and management accounting. She also advises and coordinates PhD students of the Department interested in qualitative methodologies for accounting, management accounting and auditing research.
Marco Maffei holds a PhD in accounting from the University of Naples Federico II and is an associate professor of accounting at the Department of Economics, Management, Institutions of the University of Naples Federico II, where he actively undertakes teaching activities and advises students of the master degree in accounting and management accounting. He also advises and coordinates a group of three PhD students of the Department and other two from foreign universities, interested in qualitative methodologies for accounting, management accounting and auditing research.
For instructions on how to order reprints of this article, please visit our website: www.emeraldgrouppublishing.com/licensing/reprints.htm Or contact us for further details: permissions@emeraldinsight.com EJIM 24,3