Adoption of enterprise risk management (ERM) in small and medium-sized enterprises: evidence from Malaysia

Purpose The critical success factor of enterprises is the ability to identify risks and subsequently adapt to the ever-changing technology, as well as the business environment. This paper aims to investigate the top risks faced by small and medium-sized enterprises (SMEs). In the meantime, this paper outlines the perspectives on enterprise risk management (ERM)-based best practices and the adoption level of ERM practices in SMEs. Design/methodology/approach A mixed methodology was used to collect a comprehensive understanding of the adoption of ERM, especially in SMEs. The research is based on cross-sectional questionnaires and collected from risk practitioners in Malaysia. Detailed analysis of the top risks and best practices presented in this paper to identify the developments of risk management in changing organizations. This study used chi-square tests to examine the distribution of the adoption of the ERM programme using risk and insurance management society risk maturity model attributes. Logit regression was used to test the association of ERM efforts with the probability of adopting/considering ERM practices. Findings The findings indicated that business interruption risk and economic slowdown risk are the major concern for companies in Malaysia. A business continuity plan was found to be the most common risk management practice. Efforts such as the establishment of a risk management team and the development of risk appetite and/or risk tolerance statements in an organization are associated with the probability of adopting/considering ERM practices. Research limitations/implications This paper helps to identify challenges of implementing risk governance and management in SMEs that shed light on the regulatory setting which we rather know a little about its impacts. Originality/value There are limited studies conducted in emerging countries on ERM and the application of the ERM framework in SMEs. Prior research studies are mostly generalized and lack details of risk management strategies applying to specific risks. This paper successfully examined the low maturity level of ERM practices and how SMEs in Malaysia managed those risks that emerged in their organizations.