SME risk management – an island of their own? Open Access

Risk management is a critical concern for organizations heightened by the broadening scope of risks that they have to consider, e.g. digital, cyber, environmental and financial risks. Responding to this broad scope of risk management makes it difficult for organizations to have in-house risk management processes and responses, i.e. doing it themselves. This is particularly true for smaller organizations who may lack the resources needed to carefully and effectively manage the wide variety of risks (Hong et al., 2012). Thus, there is a need for organizations to develop stronger networks in-house and outside of the organization to help them manage these risks. In other words, smaller organizations, which are the focus of this study, should rely on their ecosystem.

Cultivating an ecosystem approach to risk management is difficult practically and theoretically. In particular, it is unclear which aspects of their ecosystem are more important for a small organization’s risk management. Understanding which ecosystem aspects are more important can drive research and policy efforts; specifically, policy measures can be implemented to leverage important ecosystemic factors to improve the risk management processes of smaller businesses. Our study contributes exploratory evidence to enable the design of such policies and future research through addressing the research question of what factors of a small business’s ecosystem are important in shaping their risk management processes?

As there is limited empirical evidence on this area, we conduct a systematic literature review to understand how smaller organizations implement risk management focusing on their responses to risks that have eventuated. We take this approach as evidence suggests that most smaller organizations tend to have ad hoc risk management processes, which are only evaluated once the organization faces the eventuated risk or crisis. We analyse these risk management responses in the context of an ecosystem leveraging Bronfenbrenner’s (1977) ecosystemic theory as our analysis lens. This theory has the roots of focusing on the individual or owner, who is a key member of a smaller organization, making it appropriate for this context. In addition, this theory has begun being used by organizational literature, e.g. Tsen and Ko (2025), indicating its utility in this context.

Understanding the role of different ecosystem factors for smaller organizations in light of risk management processes and responses may generate insights around how more inclusive societies and organizations can overcome resource constraints when facing uncertainty. These insights, though generated from understanding smaller organizations, are likely to be able to be generalized to any sized organization. Furthermore, these insights can be leveraged to generate resources and policies to support smaller organizations in time of crises.

We structure the remainder of this study as follows. Firstly, we provide an overview of the literature on SME risk management focusing on how they respond to eventuated risks, due to the likelihood that most SMEs tend to not have formalized risk management processes or responses. Hence, their risk management approaches can be interpreted based on how they respond. We then illustrate our research method followed by our systematic literature review. A discussion and conclusion follow.

Due to the seriousness of crises on small businesses and the importance of small businesses in the global economy as described above, there has been significant literature investigating small business risk management. For instance, there are numerous extensive systematic literature reviews, such as de Araújo Lima et al. (2020), Crovini et al. (2021a), Henschel et al. (2024). While focusing on various areas, these studies identify that the literature has identified the need for a focus on small business crisis and risk management. Furthermore, from the perspective of small businesses, Crovini et al. (2021a) identified that risk management in small businesses tends to be unsystematic with responsibility falling on the owner primarily. This latter aspect means that, due to the existing responsibilities an owner has, there is benefit in integrating risk management with existing decision-making, as noted by Crovini et al. (2021b). Thus, there is value in research further exploring integrating risk management in small businesses particularly with empirical evidence. Yet, while the literature has established the value for risk management integration, the relevance of crisis management is less established. As an example of a contrasting perspective to that of Crovini et al. (2021b): de Araújo Lima et al. (2020) observed that there were current gaps in research on small business risk management relating to different aspects of risk management, such as enterprise risk and other components. But, the authors noted that “no further studies are suggested for engineering risk management or for disaster risk management as these streams are significantly more suitable for large companies and usually not applicable for SMEs and, in the case of the disaster risks, are managed also by the Public Authority” (de Araújo Lima et al., 2020).

While we acknowledge that larger organizations may have greater scope for disaster risk management, there is still a need for small business risk management for disasters and crises. However, what crisis management means for smaller businesses may not necessarily be similar to its meaning in larger organizations. As an example, Henschel et al. (2024) conceptualize crisis management as the crisis response when facing a crisis, whether they complete risk management processes and if they have a business continuity or risk management certification. Henschel et al.’s (2024) conceptualization of crisis management recognizes the importance of the crisis response for smaller businesses. The response is considered crucial as many SMEs do not prepare for crises, i.e. implement risk management processes. Instead, they will leave the risk management to when the crisis occurs. For example, Crovini et al. (2021b) found risk management tended to be informal. Thus, the crisis response is a proxy for their risk management maturity. In studying crisis response, typically, the literature has focused on three aspects: the role of the broader environment, the business’s characteristics and the owner’s characteristics. By business-level characteristics, we refer to characteristics specific to an SME, e.g. their age, size, etc.

We describe each of these aspects below. As risk management literature has undergone some recent development, due to emerging risks, such as COVID-19, we focus our literature review on more recent literature to better account for the current state of small business risk management literature.

As identified earlier, small businesses typically lack the resources for risk management. In particular, the financial resources may be limited in relation to responding to crises, which is a key facet of risk management, as noted by Hong et al. (2012). Consequently, in the literature, there has been significant focus on the role of environmental factors that enable or hinder a small business’s ability to obtain financing (Owen et al., 2023). For example, Martín-García and Morán Santor (2021) studied the impact of reducing risk through mutual guarantee schemes on small businesses, including microenterprises in Madrid. In a similar vein, Amamou et al. (2023) focused on the impact of public financial institution’s lending programs for small businesses and how their support helps with risk management. Their study investigated the role of the support provided by the European Investment Bank on small businesses in the European Union over a six-year period beginning in 2008. Generally, the findings from this study indicated that, unsurprisingly, such support was usually beneficial for small businesses as it alleviated the financial constraints that they face.

Linked to this focus on financing, there has also been a focus on the role of government support through wage subsidies to reduce risk (Miocevic and Srhoj, 2023) and government loans (Wan, 2023). The importance of government actions is also noted through studies exploring the role of government policies at a national and local government level, e.g. Prasetyo (2020), Adam and Lestari (2023) and Corredera-Catalán et al. (2021). For instance, Ford et al. (2024) studied how grant funding from local government can benefit SMEs in the UK context. Their findings identified that such funding can be beneficial for SMEs improving their resilience and prioritizing risk management. Another study that investigated government policies at a national level is Kurniawan et al. (2023). The authors studied how tax incentives provided to SMEs impacted SMEs in the context of four Indonesian cities and regencies (Cianjur, Sukabumi, Bandung and Bogor). It was identified that the provision of tax incentives and the positive perception of those incentives were beneficial for SMEs.

Besides focusing on the support that can be provided formally to small businesses, the literature has also briefly explored other support systems, such as how community connections can benefit smaller businesses, e.g. Bednarik and Marshall (2024).

The importance of the limited resources of SMEs has also shaped the literature’s discussion of business-level characteristics, which is the second strand of current research. This was evidenced in the discussions investigating the role of the SME’s resources, such as financing and capital structure, technology and knowledge (Le et al., 2024; Shore et al., 2024; Fawad Sharif et al., 2024). In particular, financing and capital structure of the SME was a common discussion point in the literature recently with a number of authors exploring this variable, e.g. Moya-Martínez and Del Pozo-Rubio (2021) and Arrieta-Paredes et al. (2020). For example, Monda et al. (2023) investigated how an SME’s financial infrastructure affects their risk management capacity through impacting their ability to obtain support from suppliers, i.e. through supplier credit, during a crisis. They observed that it was easier for SMEs to obtain supplier credit if they were in a better financial state at the time of crisis. Similarly, Kaur et al. (2023) studied supply chain finance as a solution for SMEs for risk management.

In light of the limited resources, the literature emphasized the importance of flexibility and dynamism by businesses (Iborra et al., 2022; Bressan et al., 2021) . For instance, Rashid and Ratten (2021) investigate how small businesses respond to COVID-19 through the perspective of dynamic capabilities leveraging their entrepreneurial ecosystems to mitigate potential risks. Leveraging broader networks is also recognized as an important resource for small businesses (Sabel et al., 2024). Coles et al. (2021) reference the role of social networks in their conceptual model of micro-small tourism and hospital businesses’ resilience.

Another way to embed dynamic capabilities may also involve using emerging technology, such as artificial intelligence. Shore et al. (2024) note that using generative artificial intelligence may support entrepreneurial resilience as it can build dynamic capabilities. Technology is generally studied in the literature as an enabling factor (Caon et al., 2025; Khurana et al., 2022), with other studies noting the ability of technology indirectly with digital transformation, e.g. Roman and Rusu (2022).

Furthermore, the role of specific characteristics of a business are also studied, e.g. size and age (Assefa et al., 2022; Martinez et al., 2023). In addition, the literature has also considered the role of industry; Krasniqi et al. (2021) evaluated the impact of firm size and industry type on policy preferences for SMEs and their recovery in response to COVID-19. It was identified that smaller firms face and are affected by uncertainty relating to customer demand and cash flows, which can increase their susceptibility to the crisis.

The third strand of current research on small business resilience focuses on owner-level characteristics and how it affects their risk management processes during a crisis. Unsurprisingly, considering upper echelons theory (Hambrick and Mason, 1984) and its popularity, the owner is considered a critical component in businesses.

In the literature, there is significant discussion of business owner characteristics (Angeles, 2024; Hanggraeni and Sinamo, 2021). Such discussion focuses on demographic characteristics, e.g. gender or race, resources, cultural characteristics and psychological characteristics (Baier-Fuentes et al., 2023; Koul et al., 2022; Mchiri, 2022). For instance, Grözinger et al. (2025) investigated how the psychological capital of owners affects their decision-making regarding crises and risk management. Precisely, Grözinger et al. (2025) observed that owners with higher psychological capital tended to prefer investment decisions with positive impacts on their performance during a crisis.

However, other characteristics are also studied. Henschel et al. (2024) found that knowledge management and entrepreneurial orientation are significant predictors of crisis management illustrating the importance of these factors for crisis management maturity in small businesses. In their study, they conceptualized crisis management as the crisis response when facing a crisis, whether they complete risk management processes and if they have a business continuity or risk management certification. The findings from Henschel et al. (2024) study bear similarity to Herbane (2019) who identified that social capital can be critical. Novelly, Herbane (2019) also suggested that crisis management does not have a binary outcome of vulnerable and resilient; rather, organizations can be on the spectrum between these two points.

Besides the owner characteristics, the literature has also explored the role of personal family support in enabling owners (Mourao, 2020). Bressan et al. (2021) observed that stakeholders, broadly, in the wine industry are critical for micro and small firms. In particular, family, clients and staff were influential in supporting these micro and small firms.

While the literature is expansive in discussing various factors that may shape a small business’s response to a crisis focusing on three types of factors (environmental, organization level and owner level), there does not appear to be any study that integrates these three types of factors in a single study. Such integration of factors appears to be overlooked, at the time of writing, which is interesting because it is likely that these factors will influence each other. For instance, the support provided by government, i.e. through incentives, may increase the organization’s financial resources or their access to financial support. In addition, if education is provided to government around crisis management, this may affect the owner’s capability to handle these events. Lastly, older businesses may mean that owners have more experience in handling unexpected events improving their resilience.

Considering these examples and the reality that the three types of factors interact, we suggest that a more systematic approach is needed to describe factors contributing to a small business’s resilience to crises. One approach, drawing on human development research, is Bronfenbrenner’s (1977) ecosystemic model. We choose this model as it aligns with the existing literature described above and also is individual-focused matching the emphasis on the owner in small businesses.

This model comprises five layers that describe how the broader environment interacts with the immediate environment of an individual. These five layers are microsystem, mesosystem, macrosystem, exosystem and chronosystem. The microsystem is the relationships and interactions between the individual and their immediate environment, such as family and employees/co-workers (Bronfenbrenner, 1977; Teng-Calleja et al., 2024). A mesosystem considers a broader environment comprising of other microsystems relevant to an individual and how these systems may interact (Bronfenbrenner, 1999). For instance, it is commonly accepted that the mesosystem may include the workplace, schools, churches and neighbourhoods (Cecconello and Koller, 2019; Kilanowski, 2017). The exosystem comprises social structures, such as systems which indirectly influence an individual, but the individual cannot access (Bronfenbrenner, 1977). By contrast, the macrosystem contains contextual factors that are relevant but not personally related to the individual. This may include laws (Bronfenbrenner, 1977). Lastly, the chronosystem recognizes that an ecosystem evolves (Mizokawa and Komiya, 2014). All five layers are expected to interact.

In addition to the five layers, there are proximal processes and the characteristics of the individual. Proximal processes were introduced by Bronfenbrenner and Morris (2006) to recognize the ongoing interaction between individuals and their environment. The individual and their characteristics are also a critical component with three characteristics identified: force, resource and demand (Bronfenbrenner and Morris, 1998; Bronfenbrenner and Morris, 2006). Force characteristics are “behavioral dispositions” (Bronfenbrenner and Morris, 2006), such as curiosity. Resource characteristics are assets and liabilities of the individual, such as skills and knowledge (Bronfenbrenner and Morris, 2006). Lastly, demand characteristics are typically demographic characteristics (Rosa and Tudge, 2013), e.g. age and gender.

From the above description, it is clear that there is an overlap between these layers and components and the three types of factors studied in the literature. Specifically, the individual comprising force, resource and demand overlap with the owner characteristics studied. The microsystem also overlaps with the owner characteristics studied, particularly the discussion around family support. Similarly, the organization level factor aligns with the microsystem and mesosytem layers. Lastly, the environmental factor aligns with the exosystem, macrosystem and chronosystem layers.

While there appears to be a theoretical alignment between Bronfenbrenner’s (1977) model, further research is needed to provide empirical evidence supporting such a perspective. In addition, it is unclear how the combination of layers can support a small business’s risk management and their survivability. Linked to this, it is also unclear whether particular layers are more important to small businesses in terms of their crisis resilience, which relates to our research question. We address this research gap and question in the next subsections.

To address our research question, we use a systematic literature review as there is a current lack of empirical evidence in our research area around the important ecosystem factors that shape risk management in smaller businesses. The systematic literature review provides insight into the current state of the research identifying how small businesses typically respond to crises.

We use a systematic literature review approach to identify relevant literature relating to SME crisis response applying Moher’s et al. (2015) PRISMA-P methodology. To be included, articles needed to be published or available by March 2024. They also needed to be accessible either through open access or through the researchers’ institution access. We consulted the following databases: Web of Science, Scopus, ScienceDirect, Emerald. The selection of databases allowed for a variety of literature to be identified. Initially, we encompassed risk management as a search term, but we observed that it was not truly representative of the type of approaches that SMEs take for risks in that they tend to be more reactive than proactive. Hence, we switched the search terms used to be “disaster” or “emergency” or “crisis” or “cyber incident” or “incident” or “attack”, “response” or “respond” and a variety of terms referencing small business terms (“small business” OR “small enterprise” OR “SME” OR “small to medium-sized enterprise” OR “small and medium-sized enterprise” OR “small and medium sized enterprise” OR “SMB” OR “small firm” OR “sole trader” OR “small organisation” OR “small organization”).

A total of 381 studies were initially identified. These were then screened to remove any studies that did not focus on small businesses, crisis events or response of small businesses. There were 112 studies remaining, which are listed in  Appendix. A figure summarizing the literature review process is provided in Figure 1.

The remaining studies were coded to identify the different responses. The initial codes were then recoded to confirm accuracy of coding. Codes were further classified into summary codes.

We then analysed these codes in the context of the layers of the Bronfenbrenner (1977) ecosystemic model.

From these 112 studies, the types of risks discussed include flooding, economic crises, e.g. global financial crisis, earthquakes and general crises. The most common incident or risk management, unsurprisingly, was COVID-19 (89.56%). The full list of descriptive statistics is provided in Table 1.

In response to these risks, risk management approaches noted related to five categories: digital transformation (8.39%), operational transformation (59.62%), human-centric transformation (13.67%), financial changes (15.52%) and general disaster recovery (2.79%). The first four categories tended to focus on the containment and recovery phase following cyber incident response research. The latter category focused on recovery. Regarding crisis management phases, the first four categories related to period of crisis and the latter category, general disaster recovery, related to post-crisis.

Regarding our research question, using the lens of Bronfenbrenner’s (1977) theory, we analysed the studies to identify ecosystemic factors. We conduct this analysis at two layers. Firstly, we applied the lens to the risk management responses of small businesses to identify whether small businesses actively involve their ecosystem in their response. Secondly, we applied the ecosystem lens to identify whether small businesses recognize their ecosystem in their broad response. This provides insight whether small businesses and their risk management responses are enabled through their ecosystem and how they are enabled.

For the first layer, we note that the previously identified categories of risk management responses tend to be focused on the small business and their microsystem. For instance, the human-centric transformation focused on the internal operations of the business particularly the staffing, i.e. changing labour or changing to remote work. Similarly, the financial change sub-categories were focused on what the business could do independently, e.g. sell assets or postpone investments. External organizations were only referenced with regard to the mesosystem by mentioning changing social network or collaborations and seeking specialist advice. Thus, it appears that small business risk management responses have largely been concerned with the immediate aspects of the organizations with minimal, at the time of writing and based on our sample, awareness and discussion of the broader ecosystem.

Regarding the second layer of analysis, we observed most discussion of ecosystems was concentrated in the macrosystem. This is illustrated in Table 2, which shows the descriptive statistics for the sampled literature from the perspective of Bronfenbrenner (1977). Specifically, 32.15% of studies cited the macrosystem as enabling factors. Of the 32.15%, government support was acknowledged by 50% of those studies. Other factors noted included the general environment (11.11%), stakeholders (8.33%), policymakers (8.33%), changing demands (5.55%), industry norms (5.55%) and regulations (5.55%). Broad access to finance and innovation policies were only mentioned once.

The second most referenced layer was the mesosystem (24.56%). Factors recognized included rental/financial support (17.86%), which is likely offered by landlords, local government (14.29%), supply chain support (10.71%), local community (10.71%) and, more broadly, market support (7.14%) and support (7.14%). The latter factor encompasses general discussion in the studied literature on the importance of support, which was not defined more precisely.

Other layers of the ecosystem were less referenced. For example, the chronosystem did not appear to be referenced by any study. By contrast, the exosystem layer was referenced in 10.91% of sampled studies and the microsystem layer was referenced in 10.00% of sampled studies. In Table 3, we describe each of the layers with the percentages showing what factors were identified by the studies. Some studies cited multiple factors; this is reflected in the table where the percentages of frequency relate to the frequency of the factor being mentioned in the entire sample of the layer, i.e. not the entire sample of studies.

Across the layers, there appears to be overlaps between factors indicating that the distinction between these layers was less clear. For example, government as an enabling factor was referenced in the mesosystem, exosystem and macrosystem layer. Similarly, industry including industry norms was referenced across these three layers and was also noted in the microsystem layer under the factor of competitors. While the former overlap relating to government reflects that government is a broad mechanism encompassing local, state and federal government, which may explain the overlap, the latter overlap relating to industry is different. The overlap of a government factor is reasonable as different levels of government may have varying closeness with SMEs, i.e. may fall within different ecosystem layers. One would expect that local government is likely to be more closely involved with SMEs with face-to-face interactions. Thus, local government is likely to be recognized in the mesosystem layer. By contrast, national governments may allocate funding or resources for small businesses but are unlikely to form an ongoing relationship with small businesses.

By contrast, the overlap between industry across layers is different. For example, while there may be differences in locality of factors, e.g. industry or sector norms within the region compared to national industry or sector norms, there is less likely to be as much of a distinction as industry norms are unlikely to vary significantly. Thus, this overlap between factors and the layers they sit at indicates that in practice these layers are unlikely to be distinct but will depend on the context.

Nevertheless, we observed three factors were repeatedly identified across the layers: the government, industry/sector and the community or neighbourhood. Illustrated in Figure 1, these three factors provide varying types of support. With community and neighbourhood observed frequently in the more immediate layers of the ecosystem, i.e. the mesosystem and microsystem, this implies that it is the more personal unique relationships that form out of the community and neighbourhood that are important for SMEs. By contrast, government was more common at the more external layers, e.g. exosystem and macrosystem, indicating that the relationship with SMEs is more distant.

Further differences emerged by the type of support provided by the factors. For example, in Figure 2, it is shown that the relationship between government and SMEs tends to be focused on financial help and resources. This is reflected in our analysis of the sampled studies, which tend to at the layers where government is mentioned, focus more on financial support and funding. By contrast, at the layers closer to the SME, e.g. microsystem and mesosystem, it is common to see SMEs reference advice and general support in addition to financial support. Thus, it appears that the type of support that SMEs experience relating to risk response varies by the factor and the ecosystem layer.

Our analysis identified the importance of the concerns and foci of SMEs in affecting how SMEs relate to their ecosystem (which are two themes). Specifically, the combined effect of these concerns and foci of SMEs led to an overall trend of SMEs having a narrow static approach to risk management where they are isolated from broader society. We discuss each theme below.

Based on the review and the second part of analysis, different types of relationships formed between SMEs and identified factors. Linking this second part of analysis to the first part of analysis on the frequency of risk responses, there appears to be a pattern showing that the concerns of SMEs, which are derived from where they focus their response on, drives how SMEs form relationships with factors. Specifically, relationships form where factors can provide the support that helps SMEs address these concerns.

For example, it was observed that SMEs were concerned with their operations, financial state and employees, which parlayed into affecting how they interacted with their ecosystems. While surprisingly the most common category, the operations is a key concern for SMEs who may be required to have lean operations to allow them to offer profitable goods and services as they cannot rely on economies of scales. Interestingly, this sub-category was more frequent than the financial state indicating that in the context of response to a crisis, an SME will look to their operations. This may also indicate, besides the importance of operations, that this is the one area that SMEs feel they can change or have control over. By contrast, the other categories may be harder to invoke change. An early study from Huck and McEwen (1991) noted that operational characteristics, such as planning and management, can be critical. From an industry perspective, Brooks (2021) notes that operations is critical as “details matter more when you have to maximise a smaller number of resources”. Due to the importance of operations, this meant that SMEs would want support to enable their operations. Hence, SMEs would form stronger relationships with factors that provide this support. This can be seen in the second part of analysis, which showed in the microsystem and mesosystem, SMEs tended to form relationships where advice, general support and financial support was provided.

This pattern was also observed with regard to SMEs’ concern with financial matters. The second most important category was financial state, aligning with the SME context with 77% of small businesses surveyed by Goldman (2024), indicating their concern with access capital. Notably, 70% of the sub-categories in the financial change category referenced cutting costs or similar defensive actions. This indicates that SMEs will typically act defensively regarding risk management, i.e. managing risks involve ensuring that they are able to continue operating in the long-term through immediate cost cutting. According to the Reserve Bank of Australia (McCowage and Nunn, 2022), most small businesses are reliant on loans leaving them vulnerable to interest rates worsened by their perception as riskier investments. In addition, SMEs may not necessarily have the financial resources available to continue operations if their revenue decreases (Goldman, 2024). Hence, it is natural that the financial category was significant for SMEs. Thus, with regard to their ecosystem, SMEs rely more on factors that provide financial support, such as the government across layers.

The second theme, foci of SMEs, demonstrated that SMEs in regard to risk management focus on specific areas on “during the period of a crisis” with many of the observed risk management approaches fitting into this phase. In other words, SMEs tend to be reactive regarding risk management rather than proactive, which is emphasized further by their limited resources meaning that there is little choice but to be reactive as they do not have spare resources to save for subsequent events. Changing how they focus may not always be possible, so our findings indicate how solutions may need to be developed and delivered to build on SME’s existing approach to risk management. Our interpretation of these findings assumes that these risk management responses were made during the crisis, where appropriate, and may have been reversed or changed after the crisis. However, there was little consistent clarification in the studies around the timing and duration of the responses.

The focus on the period of crisis requiring risk management indicates that SMEs are typically focused on the current time. Based on the studies and analysis, there is a much-reduced focus on long-term risk management. An exception is the 1.55% of the responses that cited developing flexibility and learning from experiences. None of the studies appeared to reference preparation. As a result of their foci, SMEs are then less likely to be concerned with the planning and preparation for risk management, which may force them to make on-the-fly stressful decisions when faced with eventuated risks, i.e. a crisis. In other words, SMEs may be more likely to be reactive in crises as evidenced by Herbane (2013) and Mikušová and Horváthová (2023). Though reactiveness can be useful, Klyver and Nielsen (2024) note that risk management or preparing for a crisis can be useful helping to direct strategic actions. Hence, there may be relevance in developing preparation capability in SMEs, i.e. a more typical risk management.

Thus, focusing on the present meant that SMEs will tend to rely on one-time support from ecosystemic factors. This is noticeable in our second part of analysis, which illustrated that SMEs relied on support, financial support and advice. However, the frequency of suggestions of long-term support, i.e. working towards resilience, was low. Hence, having a short-term focus affects the ecosystemic relationships that exist for SMEs making these relationships also short-term oriented. Their risk management process will then be heavily reliant on their own resources. Considering that their resources are acknowledged as limited, this may encourage more stagnant risk management processes making it difficult for SMEs to have dynamic approaches to risk management and, more importantly, be less able to manage in a changing risk environment. Thus, SMEs will continually be on the back foot for their risk management processes exposing them to risk.

Our findings illustrate that empirical studies investigating recovery and follow up were less common in the studied literature. While this gap may be because SMEs are focused on short-term risk responses, it may be relevant to explore why SMEs have this focus and what can be done to expand this focus. There is a need to further study these subsequent risk management responses to understand how SMEs manage risks throughout the cycle. Our study also novelly illustrates key factors relevant to SMEs, e.g. government, industry/sector and community, which can be further explored in future research.

For SME owners-managers, our study illustrates that there is a pressing need to expand focus to acknowledge the broader ecosystem and the less-practiced elements of risk management process. We noted that preparation, recovery and follow-up were less common in the studied literature. This is interesting in the context of risk management where preparation or prevention is crucial and is generally defined as the first step in any risk management process. Consequently, there may be a disconnect between SMEs and best practice as the latter emphasizes prevention/preparation and the former does not tend to emphasize it for crises.

Secondly, aspects of the ecosystem, as defined by Bronfenbrenner (1977), were not as frequently mentioned. SMEs were tending not to leverage their ecosystem and society relying instead on short-term support. For instance, the human-centric transformation focused on the internal operations of the business particularly the staffing, i.e. changing labour or changing to remote work.

However, there were implicit links made to the ecosystem, particularly the mesosystem (i.e. those forming the immediate network of the SME excluding family and friends, etc.), thus indicating that these factors are important, which addresses our central research question. For instance, sub-categories of digital transformation relating to shifting online appear to rely on a broader ecosystem than the organization. Specifically, to shift online, a smaller business would need to use existing tools or seek help from other organizations, e.g. website developers, postal services, etc. In addition, in the financial change sub-categories relating to seeking or finding alternative capital would imply some interaction with another organization, such as a bank or investor. One exception where the broader ecosystem was discussed explicitly was during operational transformations to manage risks by choosing to change the social network or collaborations and seeking specialist advice, which forms part of the mesosystem.

Nevertheless, it appears that SMEs have largely been concerned with the immediate aspects of the organizations with minimal, at the time of writing and based on our sample, awareness and discussion of the broader ecosystem that may support small businesses. Hence, this means that their risk management process will be heavily reliant on their own resources. Considering that their resources are acknowledged as limited, this may encourage more stagnant risk management processes making it difficult for SMEs to have dynamic approaches to risk management and, more importantly, be less able to manage in a changing risk environment. Thus, SMEs will continually be on the back foot for their risk management processes exposing their business to risk. Leveraging their ecosystem may then help improve their resilience.

Regarding policy and SME supporting agencies, our findings illustrate that support should be structured along the concerns of SMEs, e.g. financial, operations and employees. Such support is likely to be taken up by SMEs. In addition, support that leverages existing factors, such as government, may allow for SMEs to then use their existing relationships to find support. These existing relationships could also be used to encourage SMEs to take a broader and long-term focus to risk management helping to enable long-term resilience.

This study investigated common risk management responses for SMEs focusing on the in-crisis risk management as SMEs tend to be less prepared for risks creating a tendency to use less preventative risk management. Our findings indicated that SMEs tend to respond through operational, financial or employee changes demonstrating their importance for SMEs. Most SMEs tended to focus on responding during the crisis. Furthermore, critical factors for SMEs’ risk response includes government at various ecosystem layers, industry/sector support and neighbourhood/community support. Notably, these factors provided support that aligned with the foci and concerns of SMEs.

Both these broad findings identified gaps in SME risk management processes creating hurdles for effective and dynamic risk management – crucial for the current and future risk environment with evolving threats. Considering the need for risk management, additional functionality may need to be developed to prevent risks and build collaborative and supportive relationships with their value chain or ecosystem to enable risk management.

As a result of our study, we contribute to research on risk management for SMEs by clarifying the current state, based on literature, of risk management relevant for future research. This state may explain why risk management can be difficult for SMEs as their approaches are under-developed. Future work could explore this and develop an updated resilience and response process that is appropriate for SMEs. Practically, our study can enable the development of solutions to uplift SME risk management approach. This may improve the SME risk management maturity and protect their organization, their data and customer data in scenarios of eventuated risks.

The authors wish to acknowledge the anonymous reviewers and editor for their insightful comments during the review process, which greatly improved the manuscript.