Information technology (IT) extensively regulates organizational processes in contemporary organizations by allowing or preventing behaviors —either to the benefit or detriment of the organization. Yet regulatory processes that create, maintain, and enforce rules in IT-rich contexts have not been extensively analyzed in sociomaterial inquiries. We address this gap by conceptualizing and empirically exploring the interplay of rules and IT-based practices. We define a set of constitutive and enabling relationships between a rule, an IT artifact, and practice, and we narrate their relationships from the following perspectives: 1) how rules are materialized in IT artifacts, 2) how practices are interdependent on IT artifacts, and 3) how rules and practices are temporally coupled. To illustrate and analyze the nature of these relationships, we conduct a longitudinal study of the implementation of an e-learning system in a French public university. In particular, we examine how these relationships were constituted and how they evolved by probing regulatory episodes clustered into five modalities, which we label opportunity-, tool-, functionality-, role-and procedure-oriented modalities. These modalities exemplify specific regulation orientations toward germane features of either the IT artifact or the practice. Accordingly, regulatory episodes differ in terms of the application of the rule (to IT-and/or non-IT–related practices); the scope of the rule (all or part of IT or non-IT related practices); the source (exogenous or endogenous to the practice); and the dynamics and their impact on regulatory processes; they also differ in their form of agency. We conclude by discussing implications of our findings for sociomaterial theorizing and consequent policy implications for regulating contemporary organizations. In summer 2007, Jérôme Kerviel, a trader in the large French bank, Société Général (SG), was fired. He was accused of exposing SG to a massive financial risk resulting in a €5 billion loss. Jérôme managed to conceal his excessive trading positions through clever violations and (mis)use of SG’s control procedures, most of which were information technology (IT)-based. Although the trading system imposed a maximum ceiling of €125 million for trades, Kerviel succeeded in consistently leveraging positions in the order of €600 million. At the same time, he concealed his real positions by “transferring” them to his computer, from which he either erased them or maintained them as fake positions. His practice involved a series of violations of regulations that governed trading in SG: theft of user names and passwords, faking of e-mails, and engaging in inverse operations, among others. By doing so, Kerviel “created” his own (more or less shared with his colleagues) regulated world of high risk-bearing operations. He also demonstrated how advanced IT-based control systems could be misused beyond their intended designs. In fall 2011 we learned that the SG incident is not an isolated phenomenon: Similar IT-based trading systems had also been circumvented by a UBS trader, generating thus far a €1.5 billion loss. The reason why SG and UBS stories are so interesting is the lesson they teach about rules and their sociomaterial foundations. In a world where money at hand is a sum of daily transactions displayed on a computer screen and the vault’s walls are a combination of access and authorization passwords, screen interfaces, and software-inscribed trading limits, a new understanding of the relationship between social and material is needed, of how rules become inscribed in their material foundations and how related practices are affected. The cases suggest caution about the effectiveness of rules in regulating practice: instantiating material constraints into IT does not necessarily result in social compliance. Adding more rules and controls inside the IT system is not automatically effective in shaping practices in the same way that concrete walls and armed guards shaped them. Crucially, students of regulation have known for some time that as more rules are introduced, which was the case at SG, actors can play more games that can result in more unexpected outcomes (Crozier and Friedberg 1977). Despite the pervasive presence and richness of contemporary IT-inscribed rules, we see a paucity of studies on IT use as a form of material-based organizational regulation and associated forms of control. We define IT-based regulation as the regulatory processes that create, combine, and embed rules within IT artifacts and by doing so maintain and enforce rules that, by constraining or enabling social behaviors, govern both the organizational use of IT artifacts and their organizational effects. Organizational studies on regulation have remained faithful to the notion of pure social regulation and have largely ignored its material elements — in particular, the growing presence of IT (Latour 1994, 2005; Orlikowski and Scott, 2008). A handful of studies has focused on the material dimension of regulation but engaged mainly with “pure” material elements of control, including walls, police, or asylums (Hook, 2001; Latour, 2005). Recent growing interest in material foundations of social life (Orlikowski and Scott 2008, Orlikowski 2008, Leonardi 2011)—labeled sociomateriality—has heeded on a high level the presence of rules and their scripting—their entanglement —in IT artifacts (Orlikowski 2005). But how rules emerge as scripts or how such materialized rules influence practices has remained clouded because the epicenter of sociomaterial debates has been the agent’s genius in overcoming materialized scripts in ways that harbor conflict or include illegitimate behavior (Markus and Silver 2008; Barley and Leonardi 2008). In this paper we address this gap by specifically theorizing about sociomaterial regulation that is carried out by embedding rules in IT artifacts. We address the following two questions: 1) What is the nature of IT-based regulations in organizations? We define IT-based regulation as a set of constitutive and enabling relationships between the rules, the IT artifacts, and organizational practices, which we operationalize using three characteristics of rules and their effect over time: 1) the application of a rule (as materialized in the IT artifacts); 2) the scope of a rule (the broad or narrow application to practices); and 3) the source of a rule (whether it is endogenous or exogenous to a practice). 2) How does the embedding of rules in IT artifacts and the related practices evolve through time? We ask whether a sociomaterial perspective can inform how rule creation and its relationship with materiality change over time and influence practices. We juxtapose the sources of rules with the ways in which rules and practices are coupled and identify conflicts between rules and their materialization over time, as informed by our case study.
