Small and medium-sized enterprises are businesses in the private sector and across all industries employing between 10 and 200 employees. The definitions of SMEs by industry sector or subsector in accordance with the Standard Industrial Classification are presented in Table 1. These definitions are based on the National Small Business Act No. 26, 2003 (South Africa 2003). SMEs are usually independently owned and operated and are closely controlled by their owners. Thus, the owners are responsible for the management of the business on a day-to-day basis, including areas such as marketing, production, human resources and finance (Nieuwenhuizen 2007:2; Smit & Watkins 2012:6325).

Small and medium-sized enterprises play an important role in the economies of many countries and therefore governments globally focus on the development of the SME sector to promote economic growth. The contribution to most economies by SMEs is significant as they constitute the largest number of businesses and employ a significant proportion of the labour force (Islam & Tedford 2012:2; Sousa & Aspinwall 2010:476). The role of SMEs in South Africa is no exception. According to the National Development Plan, South Africa’s SMEs play a key role in the creation and promotion of employment, particularly in labour-intensive industries (Davis Tax Committee 2014:5). SMEs are employers of unskilled labour and develop and nurture entrepreneurial skills (Smit & Watkins 2012:6324). However, SMEs are perceived as high-risk enterprises as their entry and exit levels in the market are high. It is estimated that 50% of the small businesses started in South Africa have eventually failed (Islam & Tedford 2012:2). Despite these high failure rates, SMEs continue to be a key part of the economy as they collectively employ a large overall workforce. It is estimated that the SME sector contributes 55% to private sector employment and accounts for approximately 40% of the gross domestic product of the country (Radebe 2014:para. 2; Sanlam Financial Services 2014:para. 7).

Small and medium-sized enterprises thrive on their adaptability, their agility based on their closeness to their customers, their openness to processes that enhance their efficiency and their ability to take risks (Smit & Watkins 2012:6324). Nevertheless, while SMEs operate in the same environment as larger organisations, they do not have the resources of these larger organisations (Sousa & Aspinwall 2010:476). Globalisation, legislation, market expansion and the removal of trade barriers have fuelled an increase in the competition faced by SMEs. Moreover, they, in common with every business, are susceptible to unwanted internal and external setbacks in their daily operations (Islam et al. 2012:2).

The business environment is dynamic and highly competitive. To survive, businesses are under pressure to satisfy all their stakeholders and excel at the same time (Cocca & Alberti 2010:186). Therefore, all enterprises including SMEs need to adopt a formal risk management strategy as a tool to survive and grow. Kagwathi et al. (2014:9) found that, unlike the larger businesses in developing countries, there is a lack of formal risk management in SMEs which can identify and mitigate their risks. Islam and Tedford (2012:3) suggest that risk management is less developed in SMEs. Despite the evidence that businesses that adopt a formal risk management strategy are more likely to survive and grow, SMEs are reluctant to do so as it is viewed as time consuming and entrepreneurs would rather focus their energies on running their businesses based on their known skills and experience. Paradoxically, a formal approach to risk management and risk-mitigation could alert them to the realities of some of the threats and risks.

One of the first definitions of risk can be ascribed to Bernoulli, who in 1738 proposed measuring risk with a geometric mean and minimising risk by spreading it across a set of independent events (Verbano & Venturini 2013:187). Risk is always linked to the uncertainty of the occurrence of a certain event that can cause loss or damage. It combines the probability and severity of a risk (Aven 2016:4; Islam & Tedford 2012:258). The International Organization for Standardization (ISO) defines risk as the effect of uncertainty on objectives. An effect is described as a deviation from the expected objectives and can apply at different levels, that is, financial, health and safety, reputation, natural environment and legal. The uncertainty is related to understanding or knowledge of an event and its consequence or likelihood (ISO 2009). Li and Zeng (2014:45) define risk as the level of exposure to uncertainties that the business must understand and effectively manage as it carries out its strategies to achieve its business objectives and create value. To refine this from an operational point of view, operational risk can be defined as the risk of loss as a direct consequence from inadequate or failed processes, people and systems from external and internal events (GARP 2014:41).

The business environment constantly changes. In this changing environment, risk taking is a key element of the entrepreneurial function and ultimately crucial in the creation of economic value and innovation (Dempster 2009:151). Changes in factors such as interest hikes, material price increases and strikes influence the business environment and result in uncertainty about the future path of an enterprise. Uncertainty about the future manifests itself as a risk (Hugo & Badenhorst-Weiss 2011:97). Operational risk and uncertainties are important in the academic and practical application. The field of operational risk management materialised as a result of several catastrophes and natural disasters, globalisation, intensified competition and integrated production methods (Cheng & Kam 2008:347). Thus, operational risk management is a developing focus area in supply chain management research (Aven 2016:3; Hoffmann, Schiele & Krabbendam 2012:1).

The sources of risks in operations are many and multifaceted and include strategy misalignment, regulatory requirements, changes in consumer preferences and the impairment of key assets (Lavastre, Gunasekaran & Spalanzani 2012:829). Other risks include skills shortages, unreliable suppliers, as well as economic, technological, social factors and information security (Blome, Schoenherr & Eckstein 2014:309). Consequently, entrepreneurs must be able to identify and mitigate potential risks, as failure to do so could result in reduced productivity or even lead to bankruptcy. For example, an SME may find the costs of enforced responsibilities such as a product recall or a site clean-up could reduce or eliminate expected profits (Sanders 2012:394). Risk management is not well defined, which can give rise to challenges in any organisation and specifically to SMEs (Blanc-Alquier & Lagasse-Tignol 2006:273).

Risk management can be described as the process of identifying potential risks, assessing the likelihood of their occurrence, mitigating these risks before they occur or reducing the risk probability and putting contingency plans in place to mitigate the consequences if they do arise (Monczka et al. 2016:259; Waters 2009:277). The four concepts of risk management are illustrated in Figure 1.

Turner and Keetelaar (2005:13) remark that risk management should be viewed from three perspectives: (1) why businesses would want to implement risk management; (2) why businesses should implement risk management; and (3) why businesses have to implement risk management. Small businesses can expect many benefits from managing their risks such as: an improved understanding of the impact that management practices have on a business; increased competitive advantage; and increased efficiency and productivity (Scarborough et al. 2009:730; Smit 2012:20). Likewise, there are many reasons why a small business should implement risk management, such as protection of assets and the longer-term viability of the small business (Hoffmann et al. 2012:2; Sanders 2012:394). Lastly, there are legislative and regulatory requirements relating to risk management, for example, occupational health and safety legislation and fair-trading legislation (Scarborough et al. 2009:736; Turner & Keetelaar 2005:13).

The responsibility of managing risk requires the development of a framework which is not too cautious or too reckless and which guides the owner-manager towards action or improvement (Cocca & Alberti 2009:187). The framework must focus on the control of risk, the minimising of loss through prevention and avoidance and the exploitation of opportunities (Kim & Vonortas 2014:456). The management of risk offers businesses a sustainable competitive advantage by optimising the risk and return (Andersen 2008:156; Kim & Vonortas 2014:456; Smit & Watkins 2012:6324; Verbano & Venturini 2013:186). Though there are some existing frameworks on risk management, such as the risk management framework, the conceptualisation of risk management must be driven by the values and goals of the business (Kim & Vonortas 2014:455). Dimopoulos et al. (2004) acknowledge that there are tools available to assess risk. However, SMEs generally do not assess risk or, if they do, they do not assess the risks they are exposed to properly, leaving them in a vulnerable position (Islam & Tedford 2012:3; Kagwathi et al. 2014:9).

Small and medium-sized enterprise owner-managers need a good understanding of risk identification and analysis in order to successfully manage risks. The adaption of a risk management framework for SMEs is key as by using this they will be better suited to assess and manage their risks, thus benefiting from their resources and yielding a positive return (Smit & Watkins 2012:6324).

Figure 2 shows the proposed operational risk management framework that SMEs could use. This proposed framework is underpinned by and analysed into the four process steps of risk, namely risk identification, risk assessment, risk response-mitigation strategy and risk monitoring and control. These terms head the four main columns across the top of the proposed framework, and the rows down the left side of the framework detail the four broad risk categories of operational risks, market risks, technical risks and financial risks. The columns listing the four process steps are further analysed into subcategories as are the four risk categories down the left side of the model. The details of the risk process steps, covering the various risk categories, are outlined below, to explain the construct of Figure 2.

This is the first key step for identifying and understanding the possible risk sources. To add depth to this process stage, the risk identification column has been split into three sub-columns of objective, description of risk and responsible person. The objective column will assist in identifying the broad business issue, the description column defines the specific risk and the responsible person column defines the responsibility for managing and mitigating the risk. This feature will be explained in more detail later.

As can be seen in the rows of the framework, each potential risk area of the business, namely operational, market, technical and financial risks, is listed.

The first broad category of risk is operational risks. Operational risks encompass the various operational activities within the SME, including production, warehousing and distribution. The second risk category, after operational risks, is market risks. This includes risks such as understanding customer needs, future market needs, new opportunities and market share. The third risk category is technical risks and includes risks such as the current product range design, which can result in loss of position in the market and failure to identify, launch and design new products, which will result in a lack of growth and possible loss of market share. Finally, the fourth risk category is financial risks. These risks may have legal and other implications for the SME. For example, legal risks could include loss to the company should legal claims be lodged and/or, if a customer declares insolvency, it could result in irrecoverable sales and financial losses.

It must be pointed out that these risk categories are suggestions and that they would differ from SME to SME depending on the size and type of business. It is suggested that a cross-functional team be formed within the SME to discuss the objectives of the SME’s operations and identify potential operational risks. It is for this reason that in this proposed framework some generic risks are presented as examples that SMEs could use.

By way of explaining Figure 2, the category of operational risk has been split into the key operational activities of production, warehousing and distribution. Production risks consist of risks that will impact on the production of the SME. These include supplier risks regarding quality and pricing, inventory risks, process risks, downtime risks and quality risks. Even though the list of production risks is not exhaustive, these risks have the possibility of reducing competitiveness and may have financial implications for the SME. The risks that come under warehousing include sending products from the site to warehouse, holding slow-moving stock and protecting and safeguarding stock. Under distribution are included risks such as accurate stock picking, effective control of stock and the transport of goods.

In order to explain the risk management process and the use shown in Figure 2, let us assume that a cross-functional team of key employees within the SME is undertaking this risk assessment or identification process. Under the heading of production risk, the team would note the key potential business or operational issues that could negatively affect the production environment. The team would look at these issues from an objective or desired outcome perspective and create a positive statement that the SME would want to achieve in the production area. The idea here is that, if the SME achieved this objective or outcome, then any risk that could negatively impact on the outcome would have been eliminated or at least mitigated against. This becomes the measure against which the risk is gauged. In the example shown above of the operational category of production risk, a positive outcome or objective of source quality materials at competitive prices could be listed. The question to be asked of the cross-functional team is what the likelihood of this objective being achieved is and, if it cannot be achieved, what the issues are leading to its non-achievement. The identification of these issues results in a listing of the negative risks to be detailed under the description of risk column. An example of this risk could be the naming of a particular key raw material which is vital for the SME to produce a quality finished product. If the quality of this raw material from a supplier has in the past been variable, then this is a key risk to the business or, if the supplier has proven to be one that is unreliable from an on-time delivery basis, then again this is a risk. If the supplier is in the habit of increasing his prices based on, for example, a fluctuating exchange rate, meaning that he does not take forward cover for his inputs, then again, the SME could face risk exposure, this time from a cost basis.

For explanatory purposes, let us assume that the issue of risk that will detract from the SME achieving the objective or positive outcome of source quality materials at competitive prices is a key raw material supplier RM Steel who provides a raw material of variable quality 30% of the time. In this example, the actual risk to be listed in column 2, alongside the objective of source quality materials at competitive prices would be ‘variable raw material quality from RM Steel’.

The next and final step in the identification process is the nomination of the responsible person and this detail would be inserted in the third column. As the problem is related to the supply of raw materials, the buyer’s name would be placed in this third column.

In this way, we have the objective or desired outcome listed in column one, the actual risk detailed in column two (there could be a number of risks related to the one objective) and, finally, the name of the individual who is responsible for managing and monitoring the particular risk. In the example of source quality materials at competitive prices, this could be the buyer. This is a key issue as it is important that someone within the SME takes ownership of achieving the positive outcome or objective, and of managing and mitigating the risks, or the risk management exercise will be futile.

The three subheadings of objective, description of risk and responsible person represent the first step of the risk process, namely risk identification. The cross-functional team will now move to the next section, which is risk assessment, or risk priority.

The first column under the risk framework of risk assessment deals with the severity rating of the identified risk. Here the risks are subcategorised according to the impact that the risk may have on the various aspects of the business, such as finances, health and safety, the natural environment and the reputation of the SME or the possible legal consequences (Ho et al. 2015:44; Hoffmann et al. 2012:4; Kannan & Martin 2016:33). The risks are then ranked on a severity rating scale from 1 to 10, with a 10 being of the highest severity. There could be many risks attached to any one objective. Examples are ‘delayed supply’, ‘current supplier is unable to supply’, ‘quality of materials’, ‘uncompetitive price’ among others. In the example being explained under the first objective, source quality materials at competitive prices, the issue of ‘variable raw material quality from RM’ has been listed. This could have severe financial implications for the SME, as the final product produced by the SME using the materials from RM could be sub-standard, resulting in returns to the SME and financial loss. This issue could also negatively impact on the reputation of the company, which could in turn have financial and legal implications. Further, it could impact on health and safety and the natural environment. However, because the severity rating may not be equally severe on all the business aspects, in our example the following ratings are assigned: financial (8), health and safety (1), natural environment (1), reputation (8) and legal (4). These ratings are then combined as follows:

8 + 1 + 1 + 8 + 4 = 22.

The third column under risk assessment deals with the probability rating given to each risk. The SMEs must determine, on a scale from 1 to 10, the likelihood of this risk occurring. A score of 10 will be relative to a risk being probable. So, with regard to our previous example, what is the risk probability of receiving poor quality materials? It would depend on the supplier, but, for the sake of this example, the probability of this risk occurring might not be that severe. Let us say that the cross-functional team decides that 30% of the time the quality of the raw material receipts is below standard; they could assess that there is a probability of 3 out of 10 chances of it happening.

The last column under risk assessment scores the risk. In our example, the total of the severity risk rating is 22 and the probability of the risk occurring is 3. The severity risk rating is then multiplied by the probability rating as follows:

22 × 3 = 66

Sixty-six is the total score. The higher the score, the higher the perception that the risk is likely to happen and impact on the business. Each risk must be scored accordingly. The scores will highlight the more severe risks. This completes the risk assessment portion of the process.

The third step in the risk process framework presents the risk response-mitigation strategy. Once each potential risk is scored, these should be sorted and ranked from top to bottom. The cross-functional team of the SME can then work their way down the list from more severe to less severe risks. It will be the responsibility of the cross-functional team to score all the risks identified and to deal with the highest scoring or most severe risks first.

In our example, let us assume a score of 66 would lift this risk to the top of the value scale, meaning it would be viewed as a key risk requiring attention. The goal of the cross-functional team is to then look at what existing controls are in place and the additional measures needed to be implemented in order to mitigate the more severe risks. In our example, the buyer has been assigned the responsibility for managing the risk. In the open forum of the cross-functional team meeting, a discussion should take place and the buyer would be asked for his input or what his risk-mitigation strategy will actually be.

An obvious point would be for the buyer to contact RM and to raise the SME’s concern with this supplier. This would be risk-mitigation step one. Step two of the risk-mitigation strategy would be for the buyer to visit the RM with the SME’s quality controller to undertake a quality process audit on the production process to ensure that RM’s processes and procedures are under control and to check for consistency and repeatability, which is obviously lacking as problems arise 30% of the time. Such an audit could identify system or process weaknesses, which the SME would insist that RM addresses. Step three could be for the buyer to instruct the quality controller to conduct incoming quality checks of the incoming raw material from the supplier RM and to reject any product that does not conform. Key to the success of the process is for the cross-functional team to be satisfied that the steps identified by the buyer will mitigate against the identified risks.

Using this process in relation to various production objectives, identifying risk types and scoring these risks will complete the final column of the risk framework. This is the fourth and final step. Chang et al. (2015:55) and Wagner and Bode (2008:311) maintain that the monitoring of risks is important, because it can provide an early warning of increasing risk levels, thus giving the SME time to react to these changes and to formulate and/or adapt mitigation strategies.

In the example shown in Figure 2, the results of the actions taken against risk-mitigation strategy steps 1 to 3 as identified above would be written up in this column. This is done once the various actions have been completed and provides feedback to the cross-functional team, evidence that positive mitigating action steps have been taken. It is recommended that the risk management cross-functional team meets at least twice a year, which gives the various responsible individuals time to complete the mitigating action steps. At the next meeting of this team, a follow-up review of the risks should take place, and the team will be asked to re-evaluate the revised risk and rescore each identified risk, overwriting the original rating values. In our example, the original score of 66 will also be noted in the risk monitoring and control column, in order that the progress on the risk strategies can be monitored and progress confirmed. This may be compared with the new revised risk assessment score. This process is key to closing the risk management ‘loop’ and to ensure forward progress and momentum.

It should be noted that the example outlined to explain Figure 2 has assumed an SME with a number of employees and functional responsibilities, hence the possibility of a cross-functional team. The model could equally apply to a smaller operation with, for example, the cross-functional team comprising the owner and just one or two employees, such as the production supervisor and the bookkeeper. The benefit of the process of using cross-functionality is not relative to there being highly skilled functional department heads but is rather about individuals who know the SME and its functioning and who understand the risks that such an operation actually faces.

Figure 2 presents the proposed operataional risk management framework.

It is suggested that the proposed framework complies with the requirements of scholars who specify that a risk management framework must focus on identifying risks, measuring the probability of the impact of risks, mitigating the risks and monitoring and controlling the risks (Chang et al. 2015:55; Sharma and Bhat 2014:26; Wagner and Bode 2008:311; Waters 2009:477). The proposed framework differs from the standard risk management process in that it includes the categories of risks and also includes the responsible person and a severity and probability rating to score each risk.