Enterprise risk management in small and medium family enterprises: the role of family involvement and CEO tenure

The last economic crises showed the increasing dynamics and complexity of markets evoking a hot debate about the importance of implementing enterprise risk management (ERM) (McShane 2018; Bromiley et al. 2015). Various studies support cost reductions and better performance by implementing ERM (Chen et al. 2019; Hoyt and Liebenberg 2011; Pagach and Warr 2011). Even for Small and Medium Enterprises (SME) the awareness of the importance of managing risks and develop risk models (Angeline and Teng 2016; Altman et al. 2010) to perform successfully in a competitive market has risen (Yang et al. 2018). Risks that endanger their competitive advantage might come from innovative technology, legislation or a more globalized market and the entrance of new niche competitors (Laforet and Tann 2006). On the other hand, ERM risk identification is also opportunity recognition and allows innovative business solutions. SME have restricted capital and human resources making them more vulnerable to external economic shocks (Rehman and Anwar 2019; Wright et al. 2001). ERM may be used to prevent or mitigate the effects of such shocks (Chen et al. 2019; Yang et al. 2018; Falkner and Hiebl 2015).

However, ERM might be a substantial cost factor for SME, putting pressure on the limited financial resources. In addition, the entrepreneur might be able to identify risks informally not feeling any need of formalizing or rendering information explicit and transparent (Cantonnet et al. 2019). Thus, the impact of ERM on SME performance seems not to be straightforward. To assess this basic ERM-performance relationship seems necessary, since informal management structures tend to dominate in SME pointing towards trade-offs because of the costs of implementing ERM (Brustbauer 2014; Arocena and Núñez 2010). ERM studies using samples of SME are only in the beginning (Rehman and Anwar 2019; Angeline and Teng 2016), while suggesting that certain ERM elements impact SME performance (Yakob et al. 2020) and ERM working as moderator for increasing competitive advantage (Yang et al. 2018). When looking at the informal decision-making processes one should not forget that the majority of SME are family firms (Chua et al. 2012; Eurostat 2011). Family firm theory, including agency theory (Hiebl et al. 2019), behavioral agency model and socio-emotional wealth (Gomez-Mejia et al. 2017), point to different dynamics in family firms influencing the trade-off of costs and benefits of ERM, leading to heterogeneity among the firms. Therefore, we focus on small and medium family enterprises (SMFE) leaving other important characteristics relevant for the ERM adoption trade-off for further research.

In this study, we specifically focus on two characteristics of SMFE, namely CEO tenure and family involvement, as they are intimately involved with information flows in firms. In SMFE, owner-managers typically decide how much risk is taken, which makes the decision process fast, however, dependent on the owner-managers ability to identify and assess risks (Feltham et al. 2005). Independent on the effectiveness of such risk assessment, a family member is not easily removable from the business in times of crises (Kellermanns et al. 2008). This results in a longer CEO tenure (Kellermanns et al. 2008), which was found to negatively influence risk taking (Zahra 2005). In addition, as Finkelstein and Hambrick (1990) point out, longer CEO tenure may result in restricted information processing and analysis. To prevent negative effects of missing information in the firm, ERM might have more benefits for firms with longer-serving CEOs. On the other hand, more generations of family members might be involved in the daily business of SMFE (Gallucci et al. 2015), which may increase diversity and thus prevent the family firm from falling into rigid routines and losing the innovational edge. Other family members might also influence the risk assessment of the owner-manager and therefore the necessity of ERM implementation. In this way, family involvement may also enhance the informal information flows in the firm, making ERM more costly.

To our best knowledge, we are the first to assess the influence of ERM on SMFE performance dependent on the SMFE characteristics of CEO tenure and family involvement. By studying SMFE, we follow the calls for examining ERM in family firms (Hiebl et al. 2019) and in SME (Rehman and Anwar 2019; Falkner and Hiebl 2015) applying a resource-based view (Wright et al. 2001). We therefore propose that the need for investing resources of the firm into a formal ERM depends on the ability of the entrepreneur to use resources, and identify and assess risks informally given different levels of CEO tenure and family involvement. Specifically, we investigate the risk-performance relationship and its moderation by CEO tenure and family involvement for Western Austrian tourism SMFE. The Western Austrian tourism industry is heavily shaped by SMFE making it an appropriate sample, with all firms facing a similar risk structure (Glowka and Zehrer 2019). Next, the literature review develops the theoretical background of this work and models the hypotheses tested in this study. This is followed by a section on methodology, results and conclusions including implications for theory and practice.

Operating in uncertain and ever-changing environments, SMFE constantly have to make decisions under risk, which greatly influence their financial performance (McShane 2018; Ellul and Yerramilli 2013; Aebi et al. 2012). The concept of risk is traditionally based on a scenario that bears consequences together with probabilities that these will occur (Kaplan and Garrick 1981), while the common ground of different approaches is “the distinction between reality and possibility” (Renn 1998, p.50). However, risk can also be defined in a wider approach, e.g. following Brühwiler (2011), who identifies risk as a threat that might lead to a deviation from future goals. This reflects the current trend in risk research to consider uncertainty rather than probabilities and to tentatively incorporate more insecurity and define risks more generally (Shortridge et al. 2017). For example, Aven et al. (2013) incorporate background knowledge used in the risk assessment process in their description of risk.

In this wider view on risk management, ERM emerged as a management approach to assess all kinds of different risks regarding the business (Chen et al. 2019; Gatzert and Martin 2015). For the purpose of this research, we follow Yang et al. (2018), p.2) and Gatzert and Martin (2015, p. 32) defining formal ERM as.

“a process, effected by an entity’s board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risks to be within its risk appetite, to provide reasonable assurance regarding the achievement of the entity’s objectives”. (Committee of Sponsoring Organizations of the Treadway Commission 2004, p. 2).

Generally, higher risk taking is positively related to performance according to entrepreneurship literature (Rauch et al. 2009). However, offensive risk taking is not leading to success, but rather identifying innovative opportunities and proactively pursuing them with a willingness to take risks (Miller 1983). Risk identification, monitoring and assessment is therefore at the heart of the entrepreneurial process (Brühwiler 2011). If risks are identified and understood, they might become opportunities and enhance the potential for risk taking and innovation (Eshima and Anderson 2017). Implementing a formalized ERM system as defined above, therefore, while reducing risks, also impacts better risk-taking (Stulz 2015).

For SMFE, too, the awareness of the importance of managing risks to perform successfully in a competitive market has risen (Yang et al. 2018). However, the cost benefit analysis of implementing a formal ERM is different for SMFE compared to large firms. From a resource-based view (Barney 1991), larger firms have more resources available than SMFE and often employ a risk manager or form expert boards of directors for risk management, while in SMFE usually firm owners manage risk and take the decisions (Watt 2007). One major benefit of ERM, also for SMFE, is that implicit knowledge is made explicit and that a more complete picture of the firms arises. The advantage of ERM is that shared causes for risks are identified and assessed, while information asymmetries, that would help reduce related risks, are decreased (Hoyt and Liebenberg 2011). This may be useful whenever communication is necessary, e.g. in financial negotiations with banks, but also in easing succession problems. In addition, systematic risk identification through ERM might also be showing unrecognized opportunities especially for rapidly changing and new environments and allows innovative business solutions (Rehman and Anwar 2019).

In an SME context, recent studies find that the relationship of business strategy and SME performance is partially mediated by ERM (Rehman and Anwar 2019). In addition, ERM positively impacts SME performance and competitive advantage (Yang et al. 2018). While Yakob et al. (2020), p. 164) find an overall positive effect of ERM on SME performance, this is due to “only one element of ERM i.e. objective determination has a significant effect on SME performance, while the remaining seven elements namely internal environment, identification of risk events, risk assessment, risk response, activity control, information and communication, and monitoring were found to be insignificant.” Brustbauer (2014) finds two different clusters of SME which he calls “active ERM approach” with high and “passive ERM approach” with low risk management activity. Active SME are strategically offensive trying to increase their competitive advantage and grow. Passive SME aim for long-term stability conducting defensive strategies. These firms are generally less keen on expanding and investing in risky capital. Based on the past decades of research, SMFE seem to be more long-term oriented and probably tend towards a passive ERM approach (Brustbauer 2014).

Despite all promising improvements of ERM implementation, the cost factor is the major counterargument (Chen et al. 2019) for SME having restricted capital and human resources (Larsson et al. 2007). Missing organizational structures and the absence of guidelines on how to implement or adapt ERM for the SME sector are barriers to implement ERM successfully (Brustbauer 2014). Additionally, research points out that many SME are not convinced that they need a formalized risk management and often implement risk measures only to meet legal restrictions (Cantonnet et al. 2019; Bonafede et al. 2016). Regarding risk management, SME often deploy a reactive strategy, rather than proactively managing risks (Falkner and Hiebl 2015). Generally, being more agile, communicating informally and having flat organizational hierarchies are characteristics of SME which all contribute to a more effective informal risk management (Agostini and Nosella 2019).

To sum up, as theory and the literature suggest it is far from obvious, if for SMFE managing risk formally or informally, is better for performance. Most likely, the heterogeneity of firms will influence the overall relationship of ERM and performance, which makes it necessary to look at firm characteristics influencing the cost and benefits of ERM and thus acting as moderating variables. Thus, our focus lies on SMFE.

The vast majority of SME are family firms (Chrisman et al. 2012; Eurostat 2011). Typically, an owner-manager is in charge of the SMFE (Feltham et al. 2005). Such firms have longer CEO tenure than non-family firms do, which in turn influences the entrepreneurial behavior (Kellermanns et al. 2008). One reason is that firing or replacing a family CEO is not an easy task due to different ownership structures. Over the years, the CEO contributes essentially to the entrepreneurial culture and nature of the firm (Kellermanns et al. 2008). Family CEOs gain an industry and firm-specific knowledge, which makes them experts in their field, however reduces opportunities in other industries (Revilla et al. 2016). Often, the owner-manager builds personal relationships important for performance, which is a special characteristic of family firms (Gersick et al. 1997). Therefore, professionalization in the case of family firms may lead to negative reactions of business partners, who build trustworthy relationships with the family over the years (Zhang and Ma 2009). Other research reveals that family firms tend to have more informal structures, while non-family firms are more formal (Kotey 2005). In family firms, agency problems are considered less present due to an aligned management and ownership structure (Fama and Jensen 1983), which reduces the need to professionalize (Stewart and Hitt 2012). In the same vein, ERM literature assesses that owner-managed firms are less likely to implement ERM (Paape and Speklè 2012). Hiebl et al. (2019) find a lower ERM adoption in family firms and this effect increases when a family CEO manages the family firm. All these findings seem to suggest that for SMFE the owner-manager management style and knowledge are an important characteristic also for the level of formal or informal control in managing the risk.

However, there is also the argument that there might be the need for becoming more professionalized (Stewart and Hitt 2012). At a certain point of the business life cycle, SMFE have to implement formal structures to cope with the increasing complexity of its operations, however, this requires resources, which are limited in SMFE (Massaro et al. 2016; McAdam and Reid 2001). Another breaking point for SMFE is leadership succession, which is often problematic (Ward 2011), since it involves a change in the family, a change in the ownership profile, as well as a change in the business (Leiß and Zehrer 2018). Having a professionalized and formal risk management system might help to make this transition smoother by enhancing the knowledge transfer.

In SMFE, family CEOs are not replaced by other managers, which contributes to longer CEO tenure (Huybrechts et al. 2013). Zahra (2005) finds that CEO tenure has a negative effect on entrepreneurial risk taking. Other studies support that longer CEO tenure results in less innovative behavior of the firm and believe this is due to inertia, which constrains the ability to adapt to change and stay competitive (Hambrick and Finkelstein 1987). While longer CEO tenure might favor the establishment of relationships and informal risk taking, the CEO can miss to stay open-minded because of developing routines and rigid habits. Relevant information for the risk identification process might be ignored or lost due to the focus of maintaining the business rather than staying innovative and taking risk (Finkelstein et al. 1996). Thus, one way to prevent inertia is introducing a more professional process structure of ERM into the business that requires transparency. In this case, ERM would help to mitigate the negative effects of inertia provoked by longer CEO tenure.

However, the longer the CEO tenure lasts the more likely it is that different generations of the family work in the company, which impacts the organizational structure and business decisions (Samara and Berbegal-Mirabent 2018; Kellermanns et al. 2008). With its involvement in the daily management, the family keeps control and pursues family-centered goals and interests (Yeniaras et al. 2017; Gallucci et al. 2015). SMFE follow a shared family vision of the business and have goals like passing the business to the next generation and protecting the family wealth (Berrone et al. 2012; Gómez-Mejía et al. 2007). Thus, the value of non-economic, family-related goals contributes to a distinct set of priorities that are important for SMFE, which impacts the risk taking behavior and risk management (Llanos-Contreras et al. 2019; Hernández-Perlines et al. 2019; Gomez-Mejia et al. 2017). To achieve such family related goals, SMFE are willing to accept higher degrees of business risk, while acting risk averse for goals not relevant for protecting their socio-emotional wealth (Gomez-Mejia et al. 2017).

Often, succeeding generations grow up working in the family business (Alessandri et al. 2018). This enables them to gain tacit know-how of the industry (Gallucci et al. 2015). Working in the business, members bring in new ideas and have different opinions on strategic decisions (Revilla et al. 2016). If this involvement of different generations works, smoothly implementing ERM becomes less relevant. However, family involvement can also result in agency conflict between family members (Madison et al. 2016; González-Cruz and Cruz-Ros 2016; de Massis et al. 2015). Formal control mechanism like ERM might lead to better performance by reducing conflicts. However, Kallmuenzer et al. (2018) found more complex results of the effects implementing control mechanisms in SMFE specifically innovativeness had a less positive effect on performance when control mechanisms are present.

This section reports the results of the data analysis. Table 2 summarizes the Spearman’s correlations including the means and standard deviations. All correlations are below the recommended threshold of .65 and thus indicate that multi-collinearity is not an issue (Tabachnick et al. 2007).

Regarding validity of the data, we first conduced an exploratory factor analysis (EFA), which assesses the degree of internal cohesion of the constructs. Factor loadings were above .5 for all items, indicating acceptable levels of validity (Hair et al. 2006) (Table 3).

Second, we conducted Cronbach’s alpha to assess the reliability of the constructs. The minimum score of α > 0.7 (Alpha) was the necessary requirement (Hair et al. 2006), commonly used in current family business research (Arzubiaga et al. 2018; Lee and Chu 2017; Memili et al. 2010). Both scores for ERM and financial performance passed this threshold, respectively, and thus fulfilled the necessary requirements. To pass the average variance extracted (AVE), principal component analysis concerned a threshold score of 50%, yet ideally around 70% (Lee and Chu 2017; Memili et al. 2010). The AVE scores were 56.960 for risk propensity, 54.864 for ERM, 55.594 for generational ownership and 72.135 for financial performance, indicating that our constructs seemed to be reliable and valid (Hair et al. 2006).

The results for the regression analyses are shown in Table 4. ERM shows no significant effect on financial performance. Therefore, Hypothesis 1 cannot be confirmed. The moderating effects of CEO tenure and the family involvement, however, both show significant effects on the ERM-performance relationship of family firms, confirming Hypotheses 2 and 3. Hypothesis 2 states that the moderating effect on ERM and CEO tenure positively affects firm performance (β = 0.010, p < 0.05). Hypothesis 3 argued that the moderating role of family involvement and ERM on the firm performance is negative. The regression coefficient is negative and significant (β = − 0.261, p < 0.05) supporting hypothesis 3. Firm age as control variable has no significant effect in the regression analysis. Firm size and risk propensity have the usual positive impact on performance, both effects being significant in our data.

R² and adjusted R² remain relatively low, explaining 19.5% of the variation in SME performance in Model 3. However, the F value for Model 1 is F = 5.344 with ρ = 0.002, for Model 2 F = 2.840 with ρ = 0.013 and for Model 3 F = 3.239 with ρ = 0.002, implying significance at 1% and 5% level respectively. In addition, Yakob et al. (2020) find comparable values of R², adjusted R² in their recent study of ERM on SME performance.

In terms of theoretical implications, the findings of the study make a valuable contribution to the debate on issues surrounding ERM in SMFE. Several patterns and observations emerge from our findings, which increase the knowledge about the benefits of ERM for SMFE. We find that in the case of SMFE, ERM has no significant direct effect on firm performance. The most likely explanation is that the firms in the sample are rather small and thus, costs and needed resources for establishing ERM and formalizing risk management are too high. Bearing in mind our specific sample of SMFE operating in the tourism industry, the result suggests that the positive impact of ERM on firm value has to be analyzed for different size and industry separately as it seems that studies on large firms or high risk sectors do not generalize easily (McShane 2018; Gatzert and Martin 2015).

The argument of too high costs has to be regarded in relation to the benefits resulting from ERM, which consist mainly in more pervasive and systematic information about processes, risk and opportunities. In SMFE, usually all available information passes to the owner-manager and is concentrated in one person. This however, might offset the need for ERM as a catalyst to be able to form strategies and make the right decisions for increasing the performance of the firm. This is in line with the findings of Paape and Speklè (2012) that owner-managed firms are less likely to implement ERM. As long as the information flows are working well, ERM is not generating sufficient value added. However, also SMFE may face difficulties e.g. because of succession or because it loses its completive advantage in its niche because of changes in the business environment. Interestingly, some authors find that ERM moderates the effect of business strategy on performance, as well as it moderates the effect of competitive advantage on performance (Rehman and Anwar 2019; Yang et al. 2018). They find that financially educated owner-managers benefit from ERM, presumably because they can understand the information provided by ERM and use it (Yang et al. 2018).

The common thread between these findings and the moderating variables is that they are linked to the crucial information flows specific to family firms. CEO tenure can be thought of as a proxy for the danger of increasing rigidity and problems with the information flows, while family involvement points to a vibrant and agile SMFE with well working communication structures. The first moderating effect of ERM and CEO tenure examined is significantly positive. This shows that ERM might provide a way to inhibit stagnation of family firms evoked through long CEO tenures and their failure towards risk taking (Zahra 2005). ERM therefore provides a structure for a systematized approach for firm-wide risk management (Bromiley et al. 2015) in case of deficient information flows. An additional effect might be that more knowledge on risk is more easily accessible and transferred, e.g. in case of leadership succession.

The second moderating effect of ERM and family involvement on performance is significantly negative. Thus, the costs of ERM implementation exceed the benefits of an ERM approach to professionalized risk management in firms with high family involvement. This could be an indicator that more generations actively involved in managing the family business increase the ability to identify risks and opportunities, supporting the idea that family members bring in new ideas and have different opinions (Revilla et al. 2016). In line with this argument is that family businesses “provide the seedbed for nurturing entrepreneurial talent across generations” (Wang and Poutziouris 2010, p. 370) and so are able to stay competitive over years. For a very specific sample, this study does not support the findings from recent research in which family involvement affected innovation or performance negatively (Arzubiaga et al. 2018; Stewart and Hitt 2012).

The study makes several theoretical contributions to the literature and adds to the current body of ERM in SMFE. First, from a theoretical perspective, Yakob et al. (2020) propose the resource-based view as a theoretical lens to understand ERM in SME, which was also applied in the current paper. Therefore, we also argue based on the resource-based view that SME have restricted capital and human resources that are relevant for the cost-benefit analysis of implementing a formal ERM. In SMFE, further resources might include personal resources (e.g., characteristics of individual family members such as self-esteem, knowledge and skills); family system resources (e.g., internal attributes of the family unit such as cohesion, adaptability and communication); as well as social support (e.g., capabilities of people outside the family on which the family can draw or a network in which the family is valued, such as the tourism destination in this sample) (Leiß and Zehrer 2018). Second, to assess dynamics in family firm theory, this study applies some elements of agency theory (Hiebl et al. 2019), and the concept of socio-emotional wealth (Gomez-Mejia et al. 2017) to suggest the owner-manager risk behaviour. The results point to the importance of investigating more deeply how information flows in SMFE are positively working or negatively failing, which determines the firm’s ability to identify risks sufficiently in an informal manner. Thirdly, regarding the influence of CEO tenure and family involvement on the effect of ERM in SMFE, we contribute to understand more complex dynamics and interrelated processes (Wang and Chugh 2014) underlying ERM activities. Our findings are congruent with previous research that the involvement of the family and their collective actions, along with CEO tenure, affect the quality of decision-making in SMFE (de Massis et al. 2015), which also applies to decisions on ERM.

The study also has several practical implications that we believe are noteworthy, and of particular interest and relevance for SMFE in tourism. Firstly, the study offers important managerial implications, recommending that smaller firm owner-managers should implement ERM with the increase in years of the family CEO. This might prevent the firm from rigidity and business routines, and increase the identification of opportunities, which is important to stay competitive (Eshima and Anderson 2017; Rae 2006). Additionally, this suggest that CEO of SMFE benefit from a deeper understanding and reflection on ERM implementation. Secondly, if more generations are involved, the need for spending on ERM implementation diminishes, since intergenerational learning might emerge in the SMFE along daily business activities, with children acquiring role-specific knowledge and coping with lacking skills of older generation family members (Leiß and Zehrer 2018). This last point is important to know for SMFE and highlights the importance of learning across generations, which might benefit ERM implementation (Walsh 2002). This might counter-balance that SMFE are usually more operationally oriented and risk management is conducted rather on a spontaneous and/or intuitive level. Thus, given the dynamics of time, considering formal ERM in a time-bound context of generations might be beneficial.

This study produced a number of findings that are noteworthy, and contributes to the on-going research stream on ERM and SMFE. The results both reinforce and complement former studies and create foundations for future research on ERM implementation. The findings generally show that the implementation costs of ERM seem to contribute to an insignificant overall effect of ERM on financial performance in the case of SMFE and confirming the importance of firm size as determinant of ERM effectiveness. However, findings also and most notably also show that in the case of SMFE, ERM can have an effect on firm performance if ERM is moderated by CEO tenure. In this case, the effect on firm performance turns significantly positive. This means that ERM implementation becomes more important, the longer the CEO tenure is. Contrary, the moderating effect of ERM and family involvement shows to be significantly negative for performance. This finding suggests that if more family members are involved in the business, different perspectives contribute to better risk management, although in an informal manner. Nevertheless, to prevent the firm of rigidity caused by a long CEO tenure, the implementation of a formal management structure like ERM can significantly increase financial performance.

Before discussing future research avenues, it is important to reiterate the study’s limitations. This study has limitations, mainly because of the specific context of our sample and the contents of the information available. As mentioned above, the sample we study consists only of small and medium-sized tourism firms. Obviously, this limits the generalizability of the results because the sector-specific context that shapes perceptions and behaviors may drive some of our results. Considering the heterogeneity of SMFE, we think it is fruitful to examine such specific data sets because one may assume that sector specific homogeneity of the business controls partially for this variability. It would be very interesting to perform similar studies in other sectors to further compare similarities and show differences; e.g. within the services industries, the banking or financial service sector would equally be interesting. One advantage of our specific sample is that several control variables considered in the ERM literature are not relevant for the small and medium-sized firms in our sample including leverage, capex or asset turnover. However, the lacking use of other suitable control variables might be regarded as a limitation of this study. In addition, providing a cross-sectional study, the temporal dimension is limited to a snapshot, which makes causal inference difficult and excludes the assessment of firm-fixed effects.

For future research, we propose a more integrated risk management approach. This includes focusing not mainly on the risk propensity of family firms and its effects on performance, but also comprehensively investigating risk identification and risk perception in more detail (Brustbauer 2014; Brühwiler 2011). We believe that doing so would enrich family business research by asking if they are able to identify or perceive risks objectively, caused by a dominance of risk scenarios regarding SEW (Gomez-Mejia et al. 2017). Moreover, future studies should evaluate if knowledge transfer from one generation to the other (Hatak and Roessl 2015) might be improved as generations work alongside each other, which decreases the need for a formalized ERM. This could be especially relevant in case of succession problems (Cabrera-Suarez et al. 2001). Future research could also consider multiple research methods, e.g., a qualitative study would be of value to gain further knowledge and an in-depth understanding of the underlying reasons of risk identification and its impacts on firm performance. Even a multiple case study approach would enhance the understanding on ERM in SMFE on an individual basis as well as along the generations of the firms. Also, continuing with quantitative research and investigating an alternative array of mediating factors would considerably advance our understanding of ERM in SMFE and would additionally help derive further implications. Hence, further research is needed to elaborate on risk behaviour of family firms using different research methods and investigating the issue from different angles. It is our hope that the findings of this paper encourage other researchers to explore the topic further by using larger samples, investigating other industries and making use of mixed methods to confirm the fundamental premises we made.