Rethinking risk management in times of crisis: the effect of COVID-19 on small and medium-sized enterprises in Scotland

Abstract

Purpose

The Scottish economy was experiencing steady growth prior the hit of the COVID-19, with the pandemic causing the government to announce extreme lockdown measures with unprecedented impact on small and medium-sized enterprises (SMEs). Whilst some of the industry sectors in Scotland took a lighter hit, a large part of the organizations had to either adapt or completely disrupt their business. An essential aspect of their survival, risk management (RM) was among the areas requiring the most significant acceleration. This study compared the RM practices implemented by Scottish SMEs prior and after the outbreak as well as examined the attitudes of key decision-makers in the SMEs in relation to risk, including their perceived readiness for another crisis of similar significance.

Design/methodology/approach

An online survey based on ISO 31000 RM guidelines was distributed to 232 Scottish SMEs. Based on the official government reports and existing knowledge on how SMEs around the world have handled crisis events within the past 20 years, the authors developed the hypothesis that crisis events significantly accelerate SMEs' RM implementation. Around 13 items were tested in relation to the hypothesis and responses were tested via two-tailed T-test to establish significant statistical difference.

Findings

The research provides insight into the current state of risk management practices implemented by Scottish SMEs. As expected, SMEs showed significant difference in their RM implementation prior and after the COVID-19 outbreak. Whilst this has been viewed as a positive, motivations, priorities and approaches in managing risk demonstrated by the SMEs is questionable with views to their sustainable long-term recovery. The study highlights the lack of confidence instilled within the SMEs that they can handle another crisis of similar significance and provides directions for further investigation and improvements with the aim of helping the SMEs prepare better to mitigate the consequences of future crisis events.

Originality/value

In academic sense, the study offers a tested universal framework and a detailed questionnaire for assessment of RM strategy, applicable to organisations of various type, size and geography. Several implications with regards to managerial practices have been highlighted, including the neglect of the SMEs’ own internal environments and its significance in their risk strategies, the predominantly reactive approach to RM displayed by most Scottish SMEs as well as the neglect of compliance risk leading to potential quality and customer satisfaction issues preventing SMEs from full post-crisis recovery.

Citation

Arnaudova, R., Viza, E. and Cano, M. (2025), "Rethinking risk management in times of crisis: the effect of COVID-19 on small and medium-sized enterprises in Scotland", The TQM Journal, Vol. 37 No. 2, pp. 484-503. https://doi.org/10.1108/TQM-12-2022-0353

Introduction

Unlike other disciplines, risk management (RM), both as an academic discipline and a corporate function, is a relatively recent concept, the study of which has begun just after the World War II (Harrington and Niehaus, 2003). Since then, managing risk has mostly been associated with financial and insurance services. RM is defined as “the practice of identifying, evaluating, and controlling individual risk events to avoid or mitigate potential harmful effects” (Association for Project Management, 2019). Following a sharp increase in COVID-19 cases, the UK officially began lockdown measures on the 16th of March 2020 (UK Government, 2020). The pandemic demonstrated the systemic nature of risk, beyond the single aspect of health sector by exhibiting severe economic consequences, challenging the functioning of the entire system (Fernandes, 2020; Rizwan et al., 2020; Duan et al., 2021). Within a month, the UK Government’s report on the percentage of businesses with zero monthly turnover hit all-time high. Fast-forward to March 2021, the pandemic had an immensely damaging impact on all aspects of life. Looking at businesses, SMEs, representing 45% of the UK’s total revenue and 60% of the private sector employment (approximately 17 m jobs), were estimated to have suffered higher losses than large businesses, due to a huge proportion of them working in sectors vulnerable to COVID-19 (Bank of England, 2021). Financial Times and Federation of Small Businesses (2021) report that by January 2021, despite all the provided government support, over 250,000 small businesses were still at the risk of collapse. Approximately 80% of the UK SMEs have reported revenue impact from the COVID-19 crisis (McKinsey and Company, 2021). By September 2020, about 234,000 SMEs have already permanently ceased trading (Simply Business, 2020). McKinsey and Company (2021) reports that the biggest concerns of SMEs owners at the beginning of the crisis were related to running out of money (36%), followed by being unable to pay back borrowed money (20%) and paying their employees (20%). A year down the line, having fought back in the crisis, the SMEs have reported significant strategy changes and positive acceleration of practices that would not have taken place if it was not for the pandemic (Figure 1).

Scotland transpired to be the second hardest impacted by the pandemic region in the UK after London, with an average loss of income per citizen at £11, 779 (Enterprise Research Centre, 2021). Being the backbone of the Scottish economy, it is of essential importance to know how SMEs have dealt and still deal with the consequences. Whilst the overall business turnover index remains lower than its normal range, the impact of the pandemic in Scotland varies from sector to sector, with accommodation and food services performing the worst out of all industries (Scottish Government, 2021), focussing on the Scottish SMEs, ERC Business Futures Survey (2020) reports that the businesses have experienced a shift of focus and have implemented new strategies for navigation of the pandemic. Although the implementation of the new strategies clearly hints at the acceleration of RM practices, there is not enough information on whether and how, the Scottish SMEs have changed their outlook and practice of RM.

At the time of conducting this study, the need for acceleration of RM practices during crisis is an issue, generating significant amount of discussion. Currently, there is limited research on the Scottish SMEs' previous RM practices, how they have collectively reacted to the pandemic and whether their attitudes towards RM processes have been affected by the recent events. The objectives of this research were to: (1) identify to what extent the Scottish SMEs have utilised RM practices before the outbreak of COVID-19 and (2) discover whether the attitude of Scottish SMEs towards RM and its utilisation has been affected following the first outbreak of COVID-19. The research also tested the theory established in the literature review that crisis events significantly accelerate the RM implementation within companies.

The article is organised as follows: Section 1 provides a brief context, focus and scope of the research and its relevance. Section 2 presents the theoretical background in support of the new research activity and establishment of the research hypothesis. Section 3 explains and justifies the chosen methods. Section 4 presents and interprets the results from the primary research within the specified context and in relation to the developed hypothesis. Section 5 summarises the research results and provides practical recommendations as well as suggestions for further research activity.

Literature review

Characteristics of SMEs in the context of risk management

According to the UK Government (2021), SMEs are defined as ‘organisations, that employ no more than 250 employees, with a turnover of less than €50 million’. SMEs make up over 95% of the organisations' population in the UK. According to the Scottish Government (2019) as of March 2019, there were estimated 354,125 SMEs operating in Scotland, providing an estimate of 1.2 m jobs. Due to the pandemic Scottish SMEs have suffered tremendous losses in several ways, among the most significant being the average 70% drop of income, experienced by more than a quarter of the SMEs (Alderomore, 2020). The lack of risk and uncertainty management culture and practices within SMEs was viewed as a significant contributor to the losses.

When it comes to risk and uncertainty management, SMEs tend to face a lot more challenges due to the liabilities they are often associated with – one of them being the liability of smallness (O’Regan and Ghobadian, 2005; Carroll et al., 1983; Crovini, 2019). It is also discussed that organisations that are newly created, tend to suffer a lot greater risk of failure than organisations that have been established some time ago – the liability of newness (Barbera and Hasso, 2013). Nonetheless, Piette and Zachary’s (2015) study discusses that normally banks perceive SMEs as organisations presenting a lot higher risk during crisis situations, which leads to toughening of their credit conditions, adding an extra strain. On the other hand, studies have also shown that firms have a higher chance of surviving while still in a start-up stage, rather than during their growth periods (Simón-Moya et al., 2016). In addition, Cowling et al. (2018) identified that among the companies, there was a disproportionately high share of growth associated with SMEs during a crisis. SMEs also own a few characteristics, particularly useful when dealing with crisis situations, such as their flexibility towards new threats and opportunities and their close connection with their stakeholders (David et al., 2012). The peculiar features and limited resource, however, have prevented SMEs from having universal approach to dealing with risks or at least one seems to have not been studied or understood (de Araújo Lima et al., 2020). Bureaucracy of activities and formalisation of procedures is close to non-existent, as often only a few, if not one, person has the authority to make key decisions within the business (Scherer, 1988). For the immense significance of SMEs in modern economy, there is a disproportionately small amount of literature on risk management in SMEs, unlike the studies published in relation to large enterprises. Literature tends to focus on RM in large companies as more structured and easier to examine, leaving a gap in the empirical evidence addressing small companies (Testorelli et al., 2022). Demographic background of the businesses is a critical feature to be explored when studying the SMEs, as their diverse origins suggest uniqueness of needs and approaches to RM (Younus and Abumandil, 2021). Limited research generalising the behavioural pattern of SMEs, registered and operating within the same country exists currently, none in Scotland in particular. Regardless the higher exposure to risk than large organisations, SMEs still have a long way to go in terms of adopting proactive risk management approaches (Pereira et al., 2015).

Risk management and SMEs

For large part of SMEs, proactive RM remains a significant challenge (Banwet et al., 2007). Eggers (2020), aiming to develop a framework for effective RM strategies in times of the COVID-19 crisis for organisations worldwide, researched 69 small and medium-sized organisations in terms of the challenges they have faced during previous catastrophic events (such as the Global Financial Crisis in 2007–8, the Asian Financial Crisis, 1997; the Thailand Floods in 2011) as well as the strategies used to overcome the effects of those disasters. Based on the case studies, three most faced categories of challenges regarding RM were within the finance, strategic orientation and institutional environment (Eggers, 2020). Achilles (2019) noted that following the Global Financial Crisis, 53% more of the SMEs have started paying more attention to their business strategy and RM implementation, focussing on long-term planning. Mostly associated with a higher risk of failure, SMEs have limited external finance options and often tougher credit conditions than the large firms. This in turn not only leads to SMEs in the UK but also worldwide, having to rely on funding from the government and various official governing bodies (David et al., 2012). Apart from helping the organisations deal with challenges and mitigate possible losses (Bajo et al., 2012) effective RM practices were also associated with innovation and exploitation of new business opportunities (Radner and Shepp, 1996). In times of crisis, the businesses have a better chance to thrive by exploring new market opportunities, rather than the ones that started out of necessity (Covin and Lumpkin, 2011). Innovative capability of the organisations has shown to have a strong connection to effective RM practices (Foli et al., 2022). On the contrary, it is believed that in difficult economic times, innovative moves often trigger stronger risk perceptions within stakeholders, particularly investors (Cowling et al., 2018). Cioppi et al. (2014) believed that finding the right balance between satisfying immediate customers’ needs while searching for ways to innovate and go beyond these needs is the best strategy that SMEs can implement to mitigate the effects of a crisis. In the field of quality management, a focus on the customer and satisfying and exceeding their needs is a well proven formula for success and survival. Indeed, the field of quality has moved to recognising that a risk-based thinking approach is ISO9001:2015 (Chiarini, 2017). It has also been argued that being able to innovate in difficult times can be a very resource-intense activity (Beliaeva et al., 2018). In comparison, Hill et al. (2008) discuss that what stimulates innovation in times of crisis, is mainly the organisations being left with a significant number of uncommitted resources, which is rarely the case. Speaking of the managerial experience as a key factor in controlling the COVID-19 crisis, Cowling et al. (2018) believed, that COVID-19 as a new source of unexpected systemic risks was too different to everything SMEs have experienced before and that no relevant previous experience could have been applied to the situation. It is also important to acknowledge the significance of the internal organisational environment. The culture within an organisation should bring all the elements of the RM infrastructure together, by letting the shared vision, values and goals of the team influence the chosen risk management mechanisms and reinforce them in its operating processes. Unfortunately, the importance of culture in RM is often ignored, especially when the risk is managed primarily by senior management or executive boards (Lipton et al., 2019). To be effective, the responsibility and the accountability for RM practices must be distributed throughout the various staff levels as well as expertise from all areas of the business (ISO 31000, 2018). Continuous improvement and adaptation to the latest standards and environment are vital for a well-functioning RM system (ISO 31000, 2018) and a fundamental part of the international standard for Quality Management Systems (QMS), which also notably recognises the importance of ‘risk-based thinking’ in their requirements (Chiarini, 2017; de Araújo Lima et al., 2020). SMEs must constantly adapt to change within the business environment (Sadaba et al., 2014). Organisations must develop the practice of investing resources into the development of the employees, involved in RM, to ensure they are up to date with the latest practices and able to make confident decisions, based on high quality risk assessments. This in turn increases their risk sensitivity and leads to the long-term sustainability for the organisations (Piette and Zachary, 2015). In addition, most of the tools and software, utilised by larger organisations are often viewed as too expensive and complex for SMEs to adopt (Pereira et al., 2015). Helpful resources such as enterprise risk management system software are considered useful in terms of the implementation of a structural and comprehensive approaches fall way beyond the skills and capabilities of the ordinary small business and certainly beyond its affordability (Association for Project Management, 2013). Due to the difference in the structures of the organisations, some of the best practice guidelines could also be considered inapplicable (Blanc and Lagasse, 2006). Hence, to survive and remain competitive, it is often up to SMEs to develop systems and ways that work for them from scratch.

Acceleration of RM practices in times of crisis – evidence from the rest of the world

During the background research for this study, the authors reviewed a total of 75 relevant studies of SMEs across the globe that have been affected by and responded to a crisis in the past. A “crisis” is defined by Cambridge Dictionary (2023) as a “time of great confusion or suffering” or “an extremely difficult or dangerous point in a situation”. While disruptive events are often experienced at an organisational-level (mergers and acquisitions, joint ventures and business model changes), a crisis is seen by authors and authorities to represent a source of systemic risks for a whole “ecosystem” including several sectors (Fernandes, 2020; Rizwan et al., 2020; Duan et al., 2021). Therefore, disruptive events have the potential to escalate into a crisis, which is how many researchers view the consequences of the COVID-19 pandemic, based on its impact (Sarkis, 2020; Cankurtaran and Beverland, 2020; Chang et al., 2021; Ding et al., 2021). Crisis events vary from financial crashes to natural disasters, with the Global Financial Crisis in 2008 being the most prevalent due to the time frame criteria. Table 1 is a representative summary of a variety of countries in which other researchers have investigated how various samples of SMEs have coped. Overall, the studies support the authors' hypothesis that Crisis Events Significantly Accelerate the Risk Management Implementation within SMEs. Whether the studied organisations have strengthened the existing RM practices or have introduced brand new practices and strategies, it is clear that all their actions can be referred to the steps and processes, presented in the ISO 31000 framework, even if lacking awareness of the guidelines.

Considering the significant impact of the COVID-19 crisis on Scottish SMEs, the existing national statistical analysis is useful as a starting point for further investigation of the issues concerning the neglect of RM practices by SMEs, but not entirely sufficient. Therefore, it is necessary to undertake further research among the impacted enterprises from each sector to identify the challenges they have faced as well as how they overcame them. The following section explains in detail how the authors will test the hypothesis.

Methodology

The authors identified the necessity for creating a universal framework and a questionnaire concerning RM practices and attitudes within companies, regardless of their characteristics that could be applied to any large sample of companies and establish the significance in their reaction to crisis events via positivist philosophical standpoint and deductive reasoning (Saunders et al., 2012), the authors aimed for a structured, quantitative approach to test the established hypothesis:

H0.

Crisis events do not accelerate SMEs' RM implementation

H1.

Crisis events significantly accelerate SMEs' RM implementation

This study can be best described as causal-comparative. Causal-comparative research involves comparing groups to explain existing differences between them on some variable or variables of interest and establish a cause-effect relationship (Gay, 1987). The term “causal-comparative” originated in the early 20th century (Good et al., 1935) and has been considered by researchers as a strong nonexperimental method, providing better evidence for causality as opposed to merely establishing correlation between variables (Charles, 1995; Fraenkel and Walen, 1996; Martella et al., 1999). This study can be best described as causal-comparative, due to its adherence to the three necessary conditions for establishment of cause and effect (Johnson and Christensen, 2000), namely the relationship association condition of the two variables, temporal antecedence condition (the time order of conditions occurring) and the lack of alternative explanation condition. The only difference between causal-comparative (also previously called “ex post facto research”, Kerlinger, 1966) and experimental research is that the groups in causal-comparative research have already been formed any treatment has already been applied, without researchers' direct control over the independent variable (the COVID-19 pandemic) because of it being inherently non-manipulable and its manifestation has already occurred at the time of the study (Burke, 2020). In this study, the authors attempted to establish whether there was a relationship between the crisis event and the acceleration of RM implementation within the Scottish SMEs by comparing the behaviour of Scottish SMEs prior to and after the COVIID-19 outbreak. The COVID-19 crisis represents an independent variable that is given and cannot be manipulated throughout the course of the research. A theoretical rationale for the observed relationship is also essential to make sense of the causal relationship and to lead to hypotheses to be tested with new research data (Johnson and Christensen, 2000). Based on a thorough literature review, the hypothesis suggested that the SMEs' behaviour can be influenced by the crisis; therefore, the SMEs are studied in relation to 13 dependable variables (statements) in relation to risk management practices (Table 2). The study compared the behaviour of the same study sample before and after the crisis via a two-tailed t-test (Table 3). The method was considered appropriate also due to its efficiency when it comes to human and economic capital. None of the variables can be influenced and even the smallest differences in behaviour can be detected so the outcomes of the method are considered more reliable (Fulmer, 2018).

The questionnaire design

Focussing on RM processes and procedures SMEs have implemented prior and after the pandemic, the authors mapped out a structured framework based on the ISO 31000 guide (Figure 2), which helped organise the survey results in a structured manner. The standardised questionnaire is known to have a greater potential for scalability within the short time frame for this research (three weeks) ensuring the necessary flexibility and anonymity of the respondents and preventing participant bias. It has been also endorsed as the best possible instrument for gathering and analysing data in relation to RM practices (Stiller and Joehnk, 2014). Considering pandemic-related restrictions, the best way for the authors to conduct the questionnaire was online. The survey was formed based on the ISO 31000 – a set of universal guidelines, developed by the International Organisation for Standardisation, providing the framework and principles for effective RM (ISO 31000, 2018). The survey, designed in Google Forms, was divided into three main sections: (1) Screening questions, (2) RM practices before the COVID-19 outbreak and (3) RM practices after the COVID-19 outbreak. With the approval of UWS Ethics Committee, the online questionnaire was sent to a database of 232 SMEs. The participants were approached via email or LinkedIn. Due to the varying sizes and employee roles of the SMEs, the authors considered that not all companies would have a dedicated risk manager; therefore, several key decision-makers were considered and split into four main categories – Founder /Owner of the SME, Director, Business Manager and a Risk/Project Manager (Table 4). The survey ran for three full weeks, from the 15th of March 2021 to 5th of April 2021, collecting a total of 63 responses (27% response rate).

Data analysis

Out of 63 submitted responses, 59 valid responses were validated after cleanse. Following the provision of the descriptive statistics generated with Excel, a t-test was performed to test the hypothesis, estimating the significance of the behavioural difference of the SMEs prior and after the COVID-19 crisis based on 13 statements. Internal consistency reliability of Likert scale questions within the survey was tested with Cronbach’s alpha – scoring at 0.9, interpreted as a high internal consistency score (Cronbach, 1951).

The respondents

About 74.6% of the surveyed organisations were classified as small enterprises and 25.4% as medium-sized enterprises. Most of the organisations were classified as private (52.5%), followed by 20.3% as social enterprises and an even split between charities (13.6%) and public sector organisations (13.6%). About 100% of the participating organisations have noted that they are registered and running at least part of their operations in Scotland and that they involved a ‘Business for Good’ element within their structures. The survey received responses from a variety of the industry sectors, with the most responses obtained from organisations within the creative industries (20.3%) and followed by organisations within the health and life sciences field (18.6%). Overall, despite the uneven split between the industries, an adequate variety of industries was represented in the responses. About 64.4% of the responses came from respondents, categorised as a Founder/Owner of the business, 18.6% from Business Managers, 15.3% from Directors and only 1.7% from Project /Risk Managers (Table 4).

Findings and discussion

The respondents were asked to rate the extent to which their organisations managed risk prior to the COVID-19 outbreak in the UK in March 2020 and after the event (1 being the lowest score, 5 being the highest). It is noted that most of the SMEs (42%) rated the extent to which they have implemented RM practices as little (2), whilst 19% have rated it as very little (1). A significant increase can be noticed in the RM practice implementation after the hit of COVID-19, where 51% of the SMEs have rated themselves with a neutral score of 3 and a total of 39% rate themselves above the average with large to very large extent of RM implementation. A positive change that can be noted here is that post COVID-19, the SMEs rating themselves with a score 1 is 0%, which can lead to the interpretation that after the crisis, whilst some organisations have implemented changes to their RM practices more than others, all responding SMEs have initiated action. These findings were predictable, as they are in line with the summary of RM responses to previous crisis events listed in Table 1.

Impact of internal and external organisational environmental factors

Speaking of factors influencing the RM practices within the SMEs, prior to the crisis 80% of the organisations have designed their RM processes in response to the external environment, whilst only 20% have considered the internal. The percentage considering the internal environment reduces even further, following the crisis with only 14% taking their internal environment into account. This is not surprising as even on a national level, government structures treat such challenges as external risks (Benzie and Persson, 2019). Whilst the pandemic can be considered an event caused by the external environment, its systemic impact should not be neglected as with any disruptive events it heavily affects the internal environment of organisations (Ringsmuth et al., 2022). The SMEs response goes against the claims of internal factors such as shared vision, goals and team influence in culture being the driving force behind a successful RM strategy during uncertain times (Lipton et al., 2019). Letting the external environment dictate the actions of the SMEs shows their reactive instead of proactive approach to RM, compromising on the suggested risk-based thinking approach suggested in ISO 9001:2015.

Internal factors

Motivation to manage the risk

Effective RM requires organisations to take ownership of the risk (Young and Jones, 2017, 2018) rather than implement practices as a reactive measure. Unfortunately, it was noted by respondents that the Requirements of Law, Auditor and Credit Institutions and Suppliers were the main factors behind the implementation of their RM practices. Following the pandemic, 80% in total (70% more than before the pandemic) states that their negative experience of events with significant consequences is now among the main reasons to manage risk more effectively. This finding again circles back to the choice of SMEs to be reactive to external forces in their approach to RM.

Employee engagement

The largest percent of SMEs (81.4% prior and 83.1% after the pandemic) report that their Chief Executive Officers are fully in charge of the RM within their organisations. While the RM accountability of both the non-executive and executive boards has remained the same before and following the crisis, a positive trend can be noted with the Senior Managers being 19% more involved in the RM implementation after the COVID-19 outbreak. This is a step forward in the pursuit of effective RM, as ISO 31000 holds the position that dispersed responsibility and accountability for the management of risk is essential for the success of any organisation. A small percentage (9%) of SMEs has assigned more responsibilities (or potentially have hired) a Project or Risk Manager, whist only 1% of the respondents have outsourced to an external agency. According to Hussain et al. (2006) SMEs benefit significantly from improved managerial knowledge and competences, this continuous managerial training and development is crucial. The lack of procedures and forward strategic planning are directly corelated to managers' and owners' risk attitudes and knowledge (Crovini et al., 2021). A positive trend of +0.94 following the COVID-19 crisis was noticed (Table 2), when looking at the extent to which SMEs have provided RM training to the organisations' employees. Adequate personnel have been considered the most critical factor in the maintenance of a company’s existence during a crisis (Belas et al., 2022; Dvorský et al., 2021) and such efforts for continuous improvement are recognised as fundamental by the international standard for QMS (Chiarini, 2017; de Araújo Lima et al., 2020).

Structure

Risk management practices

The respondents were further asked to rate if their RM practices involve several key activities, listed by the ISO 31000 framework (Table 2). An average of 23% of the SMEs agree that they have implemented several of the listed 13 key activities, 48% remained neutral, whilst 30% have disagreed that those activities took place within their organisations prior to COVID-19. A significant increase is noticed in the first category with an average of 69% of the SMEs paying attention to the key RM activities following the outbreak (+47% from before) whilst 23% of the inactive SMEs have moved towards either working on all or some of the key activities. Approximately two-thirds of the respondents reported that currently RM plays a fundamental role in their entire organisation’s activities, their approach to it is structural and comprehensive and the risk assessments are conducted more regularly than before. Activities receiving not so much attention both prior and following the crisis remain related to the organisations' internal environments, including not letting company culture influence the risk management decision making process, not assigning RM responsibilities to all team members within the organisations as well as not being able to allocate enough resources to RM activities. According to ISO 31000 principles (2018), RM must consider the organisation human and cultural factors and be as inclusive as possible regardless of the circumstances and according to this research, this is among the principles where the Scottish SMEs seem to have failed the most. The ISO 31 000 standard refers to company culture as an asset in the pursuit of effective and sustainable RM practices, although the results from the survey are not surprising as they remain aligned with previous research showing that the importance of culture in RM is often ignored when left to senior management and executive boards (Lipton et al., 2019), which is also the case for the Scottish SMEs.

Policies and procedures

Against past literature claims that SMEs lack in establishing formal RM policies and procedures (Scherer, 1988; de Araújo Lima et al., 2020), most of the SMEs (75%) had documented RM policies and procedures prior to the pandemic. This percentage shows a slight increase post-pandemic, with additional 6% adding written policies and procedures to their RM practices. Being ahead from SMEs in other countries when it comes to policies and procedures can be due to the extensive support SMEs receive from the diverse mix of the third-sector enterprise support organisations that Scotland is pride itself with (Scottish Development International, 2019). But it cannot be neglected the fact that the introduction of ISO9001:2015 quality management standard explicitly requiring a novel risk-based thinking approach to managing quality may have left its mark on SMEs just in time to face the crisis. Further investigation is recommended into the reasoning behind the mismatch of findings between Scotland and other countries when it comes to risk policies and procedures, as what encourages the Scottish SMEs to keep on top of them, may be crucial for foreign SMEs too.

External factors

Risk awareness and prioritisation

The purpose of RM is to assess and prioritise all kinds of risks in the operating environment to minimise the possibility of negative consequences (Rass et al., 2020). Whilst studies emphasise on the importance of product risk (Louisly et al., 2023), when it came to prioritising types of risk, the only difference noted following the pandemic by the Scottish SMEs, was that SMEs have started prioritising brand reputation risk higher than prior the pandemic, along with business continuity, market and regulatory risk (Table 5). Having systems of precautions and prevention of negative reputational risks for the business has been widely supported as an essential component of RM in the literature (Sipayung and Ardiani, 2022; Angelina et al., 2023). There seems to be widespread tendency of SMEs viewing market risk as more significant in times of crisis, as the results from Scottish SMEs are consistent with views of SMEs of the Czech and Slovak Republics (Belas et al., 2022). Compliance risk, however, is an essential aspect of ISO 9001:2015, encouraging organisations to ensure that customers get consistent, high-quality products and services (ISO 9001:2015). It is observed that post-pandemic, compliance makes its way out of the top three prioritised risks, implications of which could have a direct effect over customer satisfaction and must be investigated further.

Do Scottish SMEs feel ready for another crisis?

About 40.7% of the respondents feel a lot more confident that they can deal with a similar event in the future. In comparison, 59% still do not think they can handle another crisis, based on their current practices. It is not clear whether the lack of confidence stems from poor approaches to risk management or exhausted resources in battling the systemic risks caused by the pandemic, as the study was done immediately after the event. SMEs have been known for their ongoing battle with the limited external funding options as well as difficult credit conditions that toughen significantly following crisis events (Eggers, 2020).

Tools and technology

Regarding the utilisation of enterprise risk management software and tools, the majority (68%+) did not and still do not use them, with a negative usage rate of 2% following the pandemic. As discussed previously, most of the ERM tools can be unsuitable for use by smaller organisations due to being too complicated and expensive (Pereira et al., 2015). As mentioned by Cowling et al. (2018), at the start of the crisis, approximately 120,000 UK SMEs were at the risk of completely running out of cash, with 8,000 to 10,000 Scottish businesses facing threat of closure immediately. A reduction in the income of the SME’s is seen as possible reason for a percentage of them to give up on their ERM software, if seen as a non-essential expense while navigating through the crisis. The statement is supported by Belas et al. in research from the 2021 of Slovakian and Czech SMEs, both confirming the pandemic has had a significantly negative impact on their financial performance. Here again occurs the question regarding the significance of company culture. Syrová and Špička (2023) claim organisational culture to be the missing dimension between effective use of ERM and improved financial performance, a dimension that the Scottish SMEs lack consideration of according to the findings of this study.

Stakeholder engagement

In addition, 46% more of the SMEs report that following the COVID-19 crisis, they have begun to involve their various stakeholders within all aspects of their RM processes, which again is considered a crucial step in navigating through crisis events in previous examples (the Portuguese SMEs following the Global Financial Crisis in 2007–8) where this step has played an essential role in their survival (Dias et al., 2020). The effective, regular communication via the relevant channels, considered the main factor in disaster prevention by the Thai SMEs in 2011 (Pathak and Ahmad, 2018) has also improved for Scottish SMEs by 52%.

Hypothesis testing

Previously, the literature review of case studies around the world hinted that crisis events significantly accelerate SMEs' RM implementation as an alternative hypothesis where the null hypothesis is:

H0 = Crisis events do not accelerate SME’s RM implementation.

To test the null hypothesis, the authors selected a two-tailed t-test as the most suitable tool (Table 3) – a statistical way to measure and compare the mean of two samples, used for within subject design (meaning the two samples are made of the same subjects or dependable variables, where their behaviour has been compared prior and after an independent variable such as the COVID-19 crisis) (Salkind, 2019).

The test was performed on the responses of a Likert scale question with 13 items (Table 5), taken from the ISO 31000 guide to establish whether there has been a significant difference in the behaviours of SMEs prior and after the COVID-19 outbreak. The variance in the responses of the dependable variables was calculated and the Mean for both was established. Excel was used to automatically generate the t-test, based on the data from the responses to the key question in the research. As a common practice in t-tests, α was set as 0.05, the results showed the following (Table 3):

1. P-value = 4.13303E-14 > α: The difference between the means was statistically significant, in support to the statement that crisis events significantly accelerate SMEs' RM implementation

Conclusion

Several studies focus on the risk management practises in large firms, where RM guidelines for adoption of effective practices are not necessarily suitable for SMEs (de Araújo Lima et al., 2020). SMEs are nonetheless expected to have different risk attitudes than larger firms since they are exposed to a different view of risks in comparison with large corporations (Durst and Henschel, 2021). With the ease of lockdown measures and hope for returning to normality, the spring of 2021 was considered an excellent opportunity to look back and reflect on how the Scottish SMEs had coped with the pandemic when it came to RM. Looking at the various RM principles within the ISO 31000 framework, it can be concluded that the improvements in the practices in the Scottish SMEs outweigh the areas with decreasing trends. Unsurprisingly, the 13 tested statements in relation to RM practice acceleration showed that SMEs have significantly progressed in the area in comparison with prior the pandemic, successfully accepting the null hypothesis.

Implications

This research has implications both in academic and business sense as well as in government policy and law. From an academic point of view, the study addresses an affirmed empirical evidence-based research gap on the topic of RM (de Araújo Lima et al., 2020; Testorelli et al., 2022), especially with SMEs as the scope of research (Marcelino-Sadaba et al., 2014; Neves et al., 2014). Among existing research can be found various classifications of risks (De Camprieu et al., 2007; Dey, 2012; Qazi et al., 2016), conceptual frameworks emergent from literature reviews (Marcelino-Sadaba et al., 2014; Naude and Chiweshe, 2017; Testorelli et al., 2022) and RM tools and methodologies (Kirytopoulos et al., 2001; Leopoulos et al., 2006), barely any of those frameworks and tools; however, have been tested with SMEs. Considering the variety of industry fields and levels of knowledge and awareness of risk management, the authors developed a standardised framework for assessment based on ISO 31000, which captures the attitudes and perceptions of SMEs about RM with ease and can be universally applied to any geographical area or the industry field around the world.

The study presents several significant implications for managerial practice. The Scottish SMEs showed to have seriously neglected their internal organisational environment, which is considered essential by authors (Lipton et al., 2019; Belas et al., 2022; Syrová and Špička, 2023) in relation to its positive influence over their overall risk management strategy. The SMEs mostly displayed characteristics of reactiveness, rather than proactiveness in their approach to managing risk, contrary to the risk-based thinking approach encouraged by ISO9001:2015. In their quest of prioritising Brand and reputation /Marking risk during the crisis, the SMEs have neglected compliance risk, which in turn may have severe implications over the quality of their products and services – quality, that has been deemed essential in satisfying and exceeding customer needs to survive the crisis event and remain sustainable beyond it.

With regards to policy, risk has been viewed as the missing link between governance and crisis (Magnan and Markarian, 2011; Crovini et al., 2021), as SMEs are considered to have always had little to no guidance on how to manage risk or where to seek advice if necessary. From this study it becomes clear that all Scottish SMEs are motivated to implement RM practices because of the law. Whilst this should not be considered as the only motivator for effective RM, it can be viewed as a positive aspect, meaning that new laws can be introduced and enforced to encourage businesses to act more in the specific areas of weakness, outlined in this study. All of that of course, should be done with additional packages of support, including both resource and education support for the SMEs.

Limitations and future research

Despite their significance to the economy, RM practices in SMEs remains an understudied area (Testorelli et al., 2022; Marcelino-Sadaba et al., 2014; Neves et al., 2014). Having begun the process of exploration of RM practices within the Scottish SMEs, following COVID-19, the authors suggest the research should be furthered. Focus groups and interviews could give further insight and elaboration on the issues, reported via the survey.

Whilst literature suggests that when governments, businesses and communities can sacrifice and adapt at speed when taken by surprise (Ringsmuth et al., 2022), in addition to risk management practices, concerns regarding building resilience should not be neglected either (Gössling et al., 2021). Understanding how to intervene in the system to optimise the measures to reduce the cascading impacts of events such as COVID-19 must become an essential part of the resilience planning of SMEs (Manzanedo and Manning, 2020). Here is where organisational resilience standards such as ISO 22316 can be adopted, similarly to ISO 31000 and used to assess and nurture the resilience practices of SMEs.

Figures

Figure 1

New practices, adopted by SMEs in response to the COVID-19 crisis

Figure 2

Factors for effective risk management in SMEs

Table 1

Investigation of crisis responses of SMEs

Year and Author of study	Country	Crisis	Study method	Crisis responses of SMEs Worldwide
Kapitsinis (2019)	Greece	Global Financial Crisis – 2007–8	Single Case Study, Qualitative Analysis	Sought quality improvement of Small and Medium-Sized firms, combined with significantly lowering their costs by relocating firms to Bulgaria
Morrish and Jones (2020)	New Zealand	2010 and 2011 Christchurch Earthquakes	Theories-in-use, Interviews	Entrepreneurial Marketing (EM) is enacted in post-disaster settings to facilitate speedy business recovery
Setyawan et al. (2017)	Indonesia	Environmental Crisis	Survey	Introduction of a new disaster risk management model in which both SMEs and Government carry accountability
Vargo and Seville (2011)	New Zealand	Variety of Crisis and Disasters	Case Studies	Putting stronger emphasis on effective leadership and leading by example, organisational culture and innovation
aZvikaramba et al. (2020)	Global	Variety of Crisis and Disasters	Theoretical Review, Meta-Analysis	SMEs developing alternative solutions to traditional supply chain management to remain competitive and resilient during crisis
Dias et al. (2020)	Portugal	Global Financial Crisis – 2007–8	Survey	Following the crisis, Portuguese SMEs show significant change of attitude towards building partnerships with various stakeholders and exchanging relevant knowledge
Govender (2019)	South Africa	South African Economic Crisis – 2009	Interviews	Increased corporate governance; Introducing ISO 31000 to harmonise RM practices in private security companies
Auzzir et al. (2018)	Malaysia	Natural Disasters (Floods) – 2016	Survey	Due to lack of sufficient resource to predict the disasters, SMEs have opted for the implementation of Business Continuity Management to manage the effect of the disasters that have occurred
Meutia et al. (2018)	Indonesia	Global Financial Crisis – 2007–8	Interviews	Shifted to proactivity via allocation of resources towards creativity improvement, innovation, and cost-cutting in response to the crisis
Zoghi (2017)	Turkey	Global Financial Crisis – 2007–8	Structured Phone Interviews	Examines positive trends in RM implementation within 2000 SMEs in Turkey, in the years between 2008–2012, particularly in Construction, Capital Goods and IT companies
Deakins et al. (2015)	New Zealand	Global Financial Crisis – 2007–8	Interviews	Firms have expressed preference in being able to fund their initiatives internally post-crisis and not rely on external funding, therefore have focused heavily on bootstrapping from the very beginning to avoid future problems. Consistently reinvesting the earnings back in the business
Cioppi et al. (2014)	Italy	Global Financial Crisis – 2007–8	Case Study analysis in 5 SMEs	Firms from the Italian furniture sector respond to the financial crisis by development of a proactive strategy, mitigating future risks and downturns
Giannacourou et al. (2015)	Greece	Global Financial Crisis – 2007–8	In-depth Case Studies with managers from 8 firms	Managers of manufacturing companies in the food sector significantly change their perception of risk and levels of uncertainty for their companies. This shift in perceptions in turn results in strengthening of RM practices
Pathak and Ahmad (2018)	Thailand	Thailand Floods – 2011	Survey	In the study, companies are trying to address the issue of inter-department miscommunication and misallocation of resources in response to the effects of the Floods, as two main factors worsening the situation
Dionne (2013)	Canada	Global Financial Crisis – 2007–8	Secondary Research	Financial institutions begin stress testing of complex financial products to identify the real risk those products represent. They also began applying risk management in loan issuance
Anghel et al. (2013)	Romania	Global Financial Crisis – 2007–8	Interviews	Shifting of objectives and customer focus; regular re-assessment of the external environment and accordingly adapting the marketing mix to suit the new circumstances

Source(s): Table by authors

Table 2

Key risk management activities considered by SMEs prior and after the COVID-19 outbreak

	Dependent variables	Before COVID	After COVID	Difference
1	RM had a fundamental role in all organisational activities	2.949152542	3.745762712	0.796610169
2	The implemented RM approach was structural and comprehensive	2.93220339	3.830508475	0.898305085
3	Risk assessments were conducted on a regular basis	2.898305085	3.881355932	0.983050847
4	The risk assessment process and its outcomes were documented and reported through the relevant channels	2.949152542	3.881355932	0.93220339
5	The RM framework and processes were customised to the organisation's objectives and (then) current environment	2.983050847	3.796610169	0.813559322
6	Various stakeholders were involved in the RM planning	2.898305085	3.762711864	0.86440678
7	The RM practises were regularly adapted to ensure appropriate response to the changes of the organisation's internal and external environment	2.93220339	3.847457627	0.915254237
8	The information gathered to inform the RM practises was always current, relevant and from reliable sources	2.898305085	3.677966102	0.779661017
9	The organisation was flexible about letting human behaviour and culture influence the aspects of the RM at each level	2.898305085	3.661016949	0.762711864
10	RM was continuously improving as the team was undergoing regular training and development activities	2.830508475	3.779661017	0.949152542
11	Team members from different areas of expertise were involved in the definition of the risk criteria and risk evaluation	2.86440678	3.711864407	0.847457627
12	It was ensured that all necessary resources were allocated to RM activities	2.847457627	3.694915254	0.847457627
13	Team members were assigned responsibilities and accountability at all levels within the organisation	2.847457627	3.576271186	0.728813559

Source(s): Table by authors

Table 3

Hypothesis testing

t-Test: Paired two sample for means	Variable 1	Variable 2
Mean	2.902216428	3.757496741
Variance	0.00211404	0.008397233
Observations	13	13
Pearson Correlation	0.533657108
Hypothesized Mean Difference	0
df	12
t Stat	−39.76366188
p(T ≤ t) one-tail	2.06651E-14
t Critical one-tail	1.782287556
p(T ≤ t) two-tail	4.13303E-14
t Critical two-tail	2.17881283

Source(s): Table by authors

Table 4

Survey respondents

Table 5

Highest prioritised risk types by respondents

Top three prioritised risks
	Before COVID-19	After COVID-19
1	Business continuity risk	Business continuity risk
2	Regulatory risk	Regulatory risk | Market risk
3	Compliance risk | Market risk	Brand and reputation risk

Source(s): Table by authors