The business management literature has largely neglected the theme of risk management for SMEs. So the aim of this research was to explore the current state of risk management in German SMEs and to reveal the problems which firms have with implementing a risk management system.
Risk management is a relatively new discipline. Thus until now no general standard has been developed what to understand by a holistic risk management. Based on an extensive literature analysis, this study - besides risk management in the stricter sense - also sees the following components as essential for a holistic risk management: business planning and modern instruments of performance measurement. The present investigation places a special focus on these subsystems.
Because of lacking empirical data a nationwide postal questionnaire has been chosen to obtain a broad picture of current risk management practices in German SMEs. A validation and further deepening of the results has been carried out by a larger number of research interviews.
Derived from a comprehensive analysis of the questionnaire and the interview results, a scoring approach to assess the risk management sophistication of SMEs has been developed. The approach does not, as usual, evaluate one single scoring figure. Instead it allows a differentiated assessment by evaluating separates coring figures for each component of a holistic risk management system. The scoring approach presented is very transparent and thus can easily be adapted for similar research problems of risk management.
Based on the scoring approach, this study introduces a new typology of risk management practices, derived from the empirical findings. It extracts three types of firms' risk management practices: reactors, defender/prospectors and analysers. The typology draws on the well-established approach of Miles and Snow who developed their types for classifying business organizations. The present study develops the Miles and Snow typology and makes it applicable for the purpose of risk management practices.
Each of the three risk management types is described by its determinants with respect to the components of a holistic risk management. Then recommendations are formulated which actions a firm of the respective type should take to improve its risk management, thus contributing to the firm's further positive development.