In impact investing, impact risk encompasses the probability that investment projects may fail to achieve the expected positive impact (i.e., positive impact risk) and/or may have a negative impact (i.e., negative impact risk). Using an inductive research approach, this study examines how impact investing organizations adopt control mechanisms to manage impact risk. It finds that impact investors adopt a wide range of input, behavior, and output control mechanisms to manage impact risk that may arise from investee-level, investor-level, and system-level operations. Also, to manage impact risk, investors establish control mechanisms to influence relevant actors not only within a firm’s boundary but also outside its boundary. Given the inherent complexity and ambiguity in managing impact risk in impact investing, control mechanisms appear to rely heavily on judgment and experience and adhere more to the “satisficing” principle. Furthermore, investors tend to focus more on managing positive impact risk than negative impact risk.