The Impact of Foreign Capital on the Level of ERM Implementation in Czech SMEs

Abstract

The COVID-19 pandemic has had a devastating impact on many small and medium-sized businesses around the world. Enterprise risk management (ERM) is a conceptual framework that encompasses the systematic and comprehensive identification, analysis, and management of risks in an enterprise. In the post-communist countries of Central Europe, the level of ERM is still relatively low, especially in small and medium-sized enterprises (SMEs). This study fills a gap in the existing knowledge on ERM by shedding light on the influence of foreign capital on the level of ERM implementation in Czech SMEs. The aim of the study is to assess the influence of the share of foreign capital in Czech SMEs on the level of ERM implementation. A validated self-report of 296 non-financial SMEs in the Czech Republic was analyzed using latent class analysis (LCA) and multiple linear regression. The results of the study contribute to the literature by enriching the empirical analysis of ERM in emerging markets. The originality of the results lies in the identification of three distinct groups of firms according to the combination of implemented ERM elements—“no ERM”, “best practice ERM”, and “pretended ERM”—and the finding that the share of foreign capital, age, and firm size influence the level of ERM implementation. In particular, the positive influence of foreign capital in younger companies makes it possible to overcome the barrier of traditionalist thinking of old-school Czech managers influenced by the period of economic transition in post-communist countries. The paper builds on the existing evidence with new empirical conclusions and argues for a greater inflow of foreign direct investment into emerging markets.

1. Introduction

Pandemic risk has long been considered an important area of risk management, although the COVID-19 pandemic has demonstrated that the overall risk was underestimated. The role of enterprise risk management (ERM) is to assess and define risks that may affect an organization’s success in achieving its strategic objectives (Pagach and Wieczorek-Kosmala 2020).

The importance of the ERM approach increased during the Global Financial Crisis (2007–2015), when the financial sector was severely affected. Financial institutions became even more regulated. For example, Basel regulatory requirements for operational risk monitoring were introduced along with credit and market risks, which are used to determine the capital adequacy of financial institutions (Jabbour and Abdel-Kader 2016). Other external factors influence risk management in an institution—the evolution of the business environment, the development of international risk management standards, the continued competitiveness in the industry (Saeidi et al. 2019). In contrast, SMEs typically have fewer financial resources to implement a comprehensive and formal risk management approach. Moreover, SMEs may not reach the level of ERM implementation where the benefits outweigh the costs invested (Falkner and Hiebl 2015).

Implementing and operating a risk management system also involves many internal changes. The internationally recognized risk management standard ISO 31000 provides the institution with a blueprint for risk management principles, frameworks, and processes (Aven 2017). Such strategic changes are financially and organizationally challenging, and it sometimes takes several years for an institution to meet the standards. This is one of the reasons why small and medium-sized enterprises (SMEs) often do not have international risk management standards or other formal risk management approaches such as ERM.

It is widely accepted that the increasing popularity of ERM was the result of a response to pressure on organizations to manage risk holistically (Lundqvist 2014). ERM raises an organization’s risk awareness and promotes proactive risk management by identifying, analyzing, and responding to risks and centralizing risk management reporting (Sax and Andersen 2019).

ERM continues to be in the spotlight due to the global pandemic situation. The COVID-19 pandemic drastically changed daily life in society (Chakraborty and Maity 2020). SMEs, which have been greatly affected by the pandemic, must respond to these disruptive environmental changes. Globally, SMEs are an indispensable and important part of the economy. They employed nearly 84 million people in the EU in 2021 and contribute significantly to value creation (Statista 2021). However, empirical research on ERM in SMEs is exceptional. SMEs are particularly well placed to manage risk because they have first-hand experience of all aspects of their operations and are aware of their company’s many strengths and weaknesses. At the same time, SMEs are very sensitive to changes in the business environment, which is always reflected in the quantitative characteristics of the sector after a certain period of time (Hudáková and Masár 2018). For this reason, it is crucial to analyze the state of ERM implementation in SMEs, as this is one of the most important tools that can help institutions. Inadequacies in risk identification and poor implementation of risk management can cause problems for SMEs in terms of competitiveness and sustainability (Oláh et al. 2019).

In the EU, there is a special group of so-called post-communist countries (these include, for example, Poland, the former East Germany, the Czech Republic, the Slovak Republic, and Hungary). Since the early 1990s, post-communist European countries have achieved development goals in the areas of democratization, integration into the European Union (EU), development of bilateral and multilateral relations, and economic and political transformation of financial systems, especially banking (Bilenko 2013). Post-communist countries have been in a process of legal, moral, and historical reconciliation with the former regimes, and the remnants of the political regimes are still visible. The post-communist political era has left obvious features in the enterprises, such as the way foreign capital is managed and the proper distribution of labor and capital. Flawed capital allocation is difficult to correct and stands in the way of a typical export-oriented development strategy. One such strategy is to attract foreign capital, which leads to higher productivity and higher wages. The post-communist countries already had capital-intensive economies; however, capital was massively misallocated. This meant that a foreign investor would often buy an existing factory, for example, only to simply dismantle it and sell it for scrap (and lay off most of the workers) (Tarko 2020). For this reason, multigenerational businesses have also disappeared.

A study conducted in Slovakia found that ERM issues are not formally regulated, which is reflected in the fact that there is no position for risk management in the organizational structure outside banking institutions and insurance companies and in the vast majority of SMEs. Given the circumstances of the changing post-socialist economy, Slovak managers have had to incorporate risk into their management decisions. As the research shows, risk management was done rather intuitively, without data support and without appropriate methods, know-how, and trained staff to provide input for management decisions (Klučka and Grünbichler 2020). These findings are supported by a study (Virglerova 2019) that suggests that there is a lack of financial risk management experts (professionals in this field) and company owners are forced to take responsibility for risk management themselves. In Visegrad Four (hereafter V4) countries, knowledge of risk management is low among SME entrepreneurs, regardless of the size of the company or its financial situation (Iwona 2016). Managers responsible for risk management rely primarily on knowledge of past data (Hudáková et al. 2017).

The above studies show the interconnectedness and similarity of V4 countries in the field of risk management and point out the main problems and limitations of risk management, which are mainly the lack of expertise and competence. Our study follows the increasing need to investigate the level of ERM implementation in SMEs. The authors of the study focus on the analysis of ERM in SMEs in the Czech Republic. The Czech Republic is part of the so-called V4, a group of four countries that form an important part of the European economic system. SMEs are key economic drivers in the V4 countries (Kotaskova et al. 2020). As in other countries, SMEs in the Czech Republic play an important role in the national economy (more than 99% of active enterprises).

The aim of the study is to assess the impact of the share of foreign capital in the Czech SME companies on the level of ERM implementation. This study fills a gap in the current state of knowledge, as previous studies have focused on the effects of ERM rather than its determinants. The study works with fourteen validated elements of ERM implementation and thus provides a sufficiently detailed, reliable spectrum of different levels of ERM, from companies without ERM to companies with a fully developed ERM system. The study examines three external structural determinants of ERM implementation, of which the share of foreign capital in the firm seems to be the most important. Thus, the originality of the study lies in the identification of foreign direct investment as a positive incentive for increased ERM implementation. The results are discussed in the context of the historical economic legacy of post-communist countries, which has influenced the quality of management of Czech companies transformed in the 1990s. The relevance of the study gains importance in the period of the ongoing COVID-19 pandemic, which has often fatally affected small and medium enterprises without any risk management system. After a literature review, data from the questionnaire survey are analyzed using latent class analysis and descriptive multiple linear regression.

The uniqueness of the empirical study lies in the analysis of the ERM approach across the Czech Republic in SMEs. The study focuses directly on the use of ERM in contrast to other studies that considered the general risk management approach (Hudáková and Masár 2018; Kotaskova et al. 2020). Another contribution is the employment of the latent class analysis method to evaluate the ERM index. This method has not been used in previous empirical studies.

2. Literature Review

ERM is a method of risk management that aims to minimize risk and increase business value and performance (Meulbroek 2002; Lundqvist 2015). Based on a comprehensive and systematic way of managing and monitoring the risk portfolio, ERM provides the opportunity to absorb a higher level of risk than traditional risk management with a silo approach (Meulbroek 2002). At the same time, it raises awareness of risk management throughout the organization and promotes proactive risk management (Sax and Andersen 2019). The importance of ERM is increasing due to the dynamic and turbulent nature of economic developments that occur when periods of rapid economic growth alternate with periods of economic recession. The current crisis was triggered by the COVID-19 pandemic, which has impacted every economy in the world and could be fatal for many companies in all industries. ERM is an improvement of traditional risk management, which mainly focuses on financial risks, and also addresses operational and strategic risks in non-financial organizations (Manab et al. 2010).

Most empirical studies conducted in the field of ERM are based on a number of publicly traded companies. These are mostly large and capital-intensive companies. ERM requires strong leadership, significant resources and time, timely reporting, and insightful real-time data. The absence or lack of these requirements can lead to implementation problems that affect ERM success (Arnaboldi and Lapsley 2014).

In recent years, there has been an increase in the effort and need for empirical studies in SMEs (Ferreira de Araújo Lima et al. 2020). One of the major limitations of empirical research in SMEs is the lack of currently available data. SMEs are not required to disclose information about their risk management system (unlike large and regulated companies). The difficulty in obtaining data is reflected in the number of empirical studies. The availability of information (internal or external) needed for risk assessment and management is identified as one of the major obstacles preventing companies from effectively managing market risks (Hudáková et al. 2017).

The importance of ERM in SMEs is also demonstrated by a recent study conducted in Bosnia and Herzegovina and Serbia, where 34 companies surveyed found that SMEs are in crisis and it is essential to apply crisis management knowledge and skills (Medakovic and Maric 2019). ERM is a dynamic capability that can facilitate SMEs’ survival in the face of competitive threads. An ERM culture in SMEs fosters the growth and development of awareness, grasping, and reconfiguration capabilities that are essential for managing competitive crises (Venkatesh et al. 2021).

The responsible person is usually considered to be the chief risk officer (CRO), who manages and aggregates risk data into a comprehensive enterprise-level risk profile and then reports to senior management and the board of directors (Sax and Andersen 2019). The presence of a CRO role in an organization can be considered an indicator of ERM implementation. Early empirical studies (Liebenberg and Hoyt 2003) have used a binary method to measure ERM (1 = company uses ERM if CRO exists, 0 = does not).

A similar method for analyzing the presence of ERM is so-called content analysis, which consists of a manual or semi-automatic keyword search in publicly available corporate reports. Desender (2007) first applied this method in the financial sector, using the following keywords: enterprise risk management, chief risk officer, risk committee, strategic risk management, consolidated risk management, holistic risk management, and integrated risk management. The methodology has been modified and applied to the non-financial sector over the years (Otero González et al. 2020). Authors of empirical research who have used content analysis have mostly selected a core set of listed companies, financial institutions, or insurance companies (Tahir and Razali 2011; Lin et al. 2012; Khan et al. 2016; Kommunuri et al. 2016; Abdullah et al. 2018; Iswajuni et al. 2018; Lechner and Gatzert 2018; Zou et al. 2018; Ali et al. 2019; Jonek-Kowalska 2019; Silva et al. 2019; Otero González et al. 2020). These companies are required to disclose information about their risk management practices. The above empirical studies do not aim to map the use of ERM in different sectors or countries. They do not provide information on the status of ERM adoption in a company, but only on a specific sample. Another limitation of the method is that it is only applicable in sectors where disclosure is mandatory, which is not the case for SMEs.

Content analysis, on the other hand, is based on purely objective information, which can be advantageous compared to a questionnaire survey. The questionnaire survey is largely inspired by the COSO methodology (2004, 2017), in which there is an operationalization of the eight components of the methodology into questions and statements, and respondents indicate their agreement on different scales. Empirical research has used binary scales (Lundqvist 2015; Mafrolla et al. 2016) and Likert scales (Al-Amri and Davydov 2016; Togok et al. 2016; Husaini et al. 2019; Pérez-Cornejo et al. 2019). Most studies were conducted on publicly traded companies and top-rated companies in the country or used publicly available databases (Farrell and Gallagher 2019). The authors of the empirical studies gradually moved from the binary scale to a multilevel self-reporting scale of individual elements of ERM according to COSO or ISO 31000 to assess the level of risk management in SMEs.

Studies conducted in SMEs are relatively rare, mainly due to the difficulty in obtaining data from companies that do not publish annual reports (Sax and Torp 2015; Yap Kiew Heong and Yap Saw 2016; Jenya and Sandada 2017; Hanggraeni et al. 2019; Rehman and Anwar 2019; Suttipun et al. 2019; Yakob et al. 2019; Glowka et al. 2020; Kulathunga et al. 2020). Most of the 47 studies in the systematic literature review assessed large, publicly traded companies. Studies examining ERM maturity in specific countries or sectors are even rarer. A study conducted to understand and map what types of risks are most prevalent in SMEs found that micro and small businesses lacked an internal control system or internal audit, and more than half of respondents had no knowledge of risk management (Klamut and Jung 2018).

Based on the abovementioned studies that examined the level of implementation in SMEs in the form of case studies, it was found that the appropriate method for demonstrating ERM level is a questionnaire survey that assesses the individual implemented ERM elements in the form of self-assessment statements. Overall, it is quite methodologically appropriate and accurate to determine the degree of ERM implementation in a company using a multi-level scale according to the degree of fulfillment of risk management standards. Unlike objective measures, which are not influenced by personal preferences and are represented by facts, subjective self-reporting could be subject to biases that negatively affect validity and reliability. Nevertheless, self-reporting has been a standard method in the social sciences (May 2021).

3. Materials and Methods

The article is based on a questionnaire survey of small and medium-sized enterprises in the Czech Republic. The survey was conducted in October and November 2021. The target sample of respondents consisted of 300 SMEs. Quota sampling was used to ensure the possibility of generalization of the results and to maintain the representativeness of the sample. Respondents were members of top management, i.e., owners, CEO (chief executive officer), CFO (chief financial officer), CSO (chief sales officer), or CIO (chief information officer) of SMEs.

Based on the structure of SMEs in the country, the quotas were set according to the size of the company and the planned structure as follows: 4–49 employees = 150–160 questionnaires, 50–99 employees = 80–90 questionnaires, 100–249 employees = 50–60 questionnaires. At the same time, the specification was that each category should be represented as much as possible according to CZ-NACE. The Statistical Classification of Economic Activities in the European Community, commonly referred to as NACE (for the French term “nomenclature statistique des activités économiques dans la Communauté européenne”), is the industry standard classification system used in the European Union.

The primary data collected included 300 fully completed questionnaires, but the dataset was adjusted using calculations of variability. The degree of variability indicates how close or far the response values are for each question/statement in the survey. The degree of variability was analyzed using the coefficient of variation, which is used to assess the relative degree of dispersion of the data relative to the mean. Respondents with a coefficient of variation of 0 were excluded from further analysis. The final number of companies was 296.

Due to the relatively low frequency of observations in some sections of the classification of economic activities under CZ-NACE, the sections were grouped into sectors whose structure corresponds to the structure of the Czech national economy.

-

The primary sector provides raw materials and unprocessed food—agriculture, forestry, fishing, hunting, and mining (NACE sections A and B; 4.4% of the sample).

-

The secondary sector processes raw materials from the primary sector into goods—industry, construction, handicrafts, and other nonindustrial manufacturing (NACE sections C, D, E, F; 29.7% of the sample).

-

The tertiary sector provides services, trade, and transportation (NACE sections H, I, J, K, L, O, Q, R, S, T; 58.4% of the sample).

-

The quaternary sector includes research and development, consulting, and education (NACE sections M, P; 7.4% of the sample).

The level of ERM implementation was measured by fourteen validated statements adopted from the authors of another study (Sprčić et al. 2017). All questions were binary (1 = Yes/0 = No). The resulting ERM index score takes values from 0 to 14.

• Is there a chief risk officer in your company, responsible for risk management?
• Is there a special department in your company dedicated to risk management?
• Does your company have a written statement of the firm’s risk appetite?
• Are there official risk management policy and procedures in your company?
• Do you apply COSO Integrated Framework for ERM in your company?
• Do you apply the ISO 31000 risk management standard in your company?
• Is risk managed with an integrated analysis and management of all identified corporate risks (e.g., financial, strategic, operational, compliance, and reporting risks)?
• Do you determine correlations and portfolio risk effects of combined risks?
• Do you determine quantitative impacts risks may have on key performance indicators?
• Do you organize workshops in your company where managers discuss exposures to different types of risks and risk management?
• Does your company create a risk map indicating the position of risks the company is exposed to, considering probability of occurrence and significance of identified risk to the business activity?
• Do you have a risk response plan for all significant events?
• Do you submit a formal report on risk and risk management to the management board at least annually?
• Do you monitor key risk indicators aimed at emerging risks (not past performance)?

The first step was to segment the SMEs according to the level of ERM implementation. The segmentation created a typology of companies according to specific ERM characteristics (Sprčić et al. 2017). Due to the binary nature of the responses, latent class analysis (LCA) was used. LCA is a statistical technique used to identify qualitatively distinct subgroups (latent classes) within populations that share certain external characteristics. To identify latent groups, LCA uses study participants’ responses to categorical indicator variables (McCutcheon 1987). Unlike cluster analysis, LCA measures probabilities of class membership, not explicit assignment (Weller et al. 2020).

LCA is a categorical parallel to the factor analysis model, which uses binary variables. It is a multivariate method for determining a categorical latent variable from a set of categorical manifest variables. The basic idea of LCA was described by Paul Lazarsfeld (Lazarsfeld and Henry 1968), which was later developed into a statistically correct algorithm by other authors (Goodman 1974; McCutcheon 1987). Latent class models are based on the principle of local independence, where the algorithm divides the population into subgroups so that dependencies between variables disappear (Weller et al. 2020). The probability of a particular answer to a particular question depends only on class membership and not on other variables (questions). Latent classes eliminate (explain) dependence between variables; i.e., the particular structure of observed responses is determined solely by the unobserved variable. The LCA is robust and is not burdened by assumptions about normality of data, linear correlation, or homogeneity of variances (McCutcheon 1987).

Our research is based on the poLCA algorithm from the R package (Linzer and Lewis 2011), which is linked to the software IBM SPSS 27. The poLCA algorithm estimates the latent class model by maximizing the log-likelihood function.

$$\ln L={\displaystyle \sum }_{i=1}^N\ln {\displaystyle \sum }_{r=1}^R{p}_r{\displaystyle \prod }_{j=1}^J{\displaystyle \prod }_{k=1}^{K_j}{\left({\pi }_{jrk}\right)}^{Y_{ijk}}$$

where we observe J polytomous categorical variables (manifest variables), each of which contains K_j possible outcomes, for individuals i = 1, …, N. The manifest variables may have different numbers of outcomes, hence the indexing by j. Denoted as Y_ijk, the observed values of the J manifest variables such that Y_ijk = 1 if respondent i gives the k-th response to the j-th variable, and Y_ijk = 0 otherwise, where j = 1, …, J and k = 1, …, K_j.

The latent class model approximates the observed joint distribution of the manifest variables as the weighted sum of a finite number, R, of constituent cross-classification tables. Let ${\pi }_{jrk}$ denote the class-conditional probability that an observation in class r = 1, …, R produces the k-th outcome on the j-th variable. Within each class, for each manifest variable, therefore, ${\sum }_{k=1}^{K_j}{\pi }_{jrk}=1$. Further denote as $p_r$ the R mixing proportions that provide the weights in the weighted sum of the component tables, with ${\sum }_r{p}_r=1$. The values of $p_r$ are also referred to as the prior probabilities of latent class membership (Linzer and Lewis 2011).

The algorithm processed the 14 input variables sequentially and iteratively, manually changing the number of latent classes. Eighty iterations provided stable results. The calculation started with one latent class and continued up to five latent classes. The association of the manifest variables, and thus the significance of LCA, was tested by comparing the likelihood ratio chi-squared (LR/Deviance) with the twofold residual degrees of freedom (residual D.F.). All tested variants showed interdependence of the manifest variables. The criteria for determining the optimal number of classes were the Bayesian information criterion (BIC) and the interpretation logic (Weller et al. 2020).

Once the latent classes were identified and described, a descriptive linear regression model was constructed. The purpose of the model is to test hypotheses about the dependence of the ERM index on selected external structural characteristics of SMEs.

A.

ForCap_Share of foreign direct investments in the equity (%).

Hypothesis 1 (H1).

A higher share of direct investments in the equity increases the level of ERM implementation.

Many Czech managers have previously shown a strong sense of Czech identity and some distrust of foreign companies. In addition, many top managers want to retain control of their companies and careers under the unique historical conditions of the Czech Republic (Soulsby and Clark 1996). The inflow of foreign capital is associated not only with financial flows, but also with know-how and new practices in corporate management (Žilinskė 2010). Therefore, it is justified to assume that foreign capital has a positive impact on the level of ERM implementation in companies.

B.

Age_Age of the company (in years).

Hypothesis 2 (H2).

Older companies have a more developed ERM system than established companies.

The authors argue for the assumption of long-term development of management practices in established companies. Historically, older companies have had more time to adopt more elements of ERM and a more sophisticated risk management system. On the other hand, in the Czech context, the historical burden of management practices from the socialist period until the late 1980s and the economic transformation in the 1990s might play a role, when the role of managers was often taken over by people who had just a little knowledge of the new management practices and had not yet experienced the financial crisis. This specific characteristic of post-communist countries may affect the results of the hypothesis tests.

C.

Size_Company size by the interval of the number of employees: 4 to 15, 16 to 49, 50 to 99, 100 to 249 (the last category is a reference).

Hypothesis 3 (H3).

Micro and smaller medium-sized companies have a less developed ERM system (three groups of companies from 4 to 99 employees) than larger medium-sized companies (100 to 249 employees).

Note: Size categories correspond to the legal form of the company, with sole proprietorships in the smallest size category and joint stock companies in the largest category.

Consistent with previous research (Beasley et al. 2015), company size is an important factor associated with higher ERM maturity. As the size of the company increases, the nature, timing, and magnitude of threats change. In addition, larger companies may also be better able to implement ERM due to greater resources (Golshan and Rasid 2012).

D.

Sector: primary (reference category), secondary, tertiary, quaternary.

Hypothesis 4 (H4).

The level of ERM implementation does not differ by sector of the economy.

There is no theoretically justifiable difference why there should be different levels of ERM implementation in different sectors. Unless strong sectoral regulation influences the level of threats and the need to implement ERM, the level of ERM should not differ across sectors. Higher levels of regulation are typical for the financial sector and for listed companies, but this study focuses on non-financial SMEs.

Cronbach’s alpha (Bland and Altman 1997) was used to test the reliability of the ERM index according to Sprčić et al. (2017). The final model was tested for the presence of collinearity (variance inflation factor, VIF) and heteroscedasticity (Breusch–Pagan/Cook–Weisberg test) (Osborne et al. 2008).

4. Results

Table 1. Comparison of five variants of the number of latent classes (poLCA optimization).

	1 Latent Class	2 Latent Classes	3 Latent Classes (Optim.)	4 Latent Classes	5 Latent Classes
Number of Cases	296	296	296	296	296
Number of Complete Cases	296	296	296	296	296
Number of Parameters Estimated	14	29	44	59	74
Residual D.F.	282	267	252	237	222
Maximum Log-Likelihood	−2671.0	−2131.7	−2001.3	−1983.9	−1968.1
AIC (1)	5369.9	4321.4	4090.5	4085.7	4084.1
BIC (1)	5421.6	4428.4	4252.9	4303.4	4357.2
LR/Deviance (1)	2568.5	1490.0	1229.1	1194.3	1162.8
Chi-squared (1)	230,797.0	23,656.9	18,989.9	20,714.0	19,885.3
Number of Repetitions	80	80	80	80	80
Diagnostics
2 * Residual D.F.	564	534	504	474	444
LR/Deviance (1)	2568.5	1490.0	1229.1	1194.3	1162.8
BIC Difference	x	−993.16	−175.53	50.55	53.80
AIC Difference	x	−1048.51	−230.89	−4.81	−1.55

Notes: The association of the manifest variables and thus the significance of LCA was tested by comparing the likelihood ratio chi-square (LR/deviance) with the residual degrees of freedom (residual D.F.). All tested variants showed interdependence of the manifest variables. The criteria for determining the optimal number of classes were the Bayesian information criterion (BIC) and the Akaike information criterion (AIC), as well as the interpretation logic. Source: own processing in IBM SPSS Statistics 27 software, poLCA extension.

presents the results of iteratively testing the optimal number of latent classes using the poLCA algorithm. Based on the BIC differences, three latent classes appear to be optimal. In addition, the model appears to be more interpretable with three latent classes.

Three latent classes seem to be optimal. The difference in BIC between the model with two and three latent classes is negative, while the difference in BIC between the model with three and four latent classes is positive.

The probability of agreeing or disagreeing with the evaluation criteria for each component of the ERM index is shown in

Table 2. Probability of agreeing or disagreeing with the criteria for scoring the ERM components (N = 296).

Question			Probabilities
			No (0)	Yes (1)
1	Is there a chief risk officer in your company, responsible for risk management?	1	1.000	0.000
		2	0.224	0.776
		3	0.899	0.101
2	Is there a special department in your company dedicated to risk management?	1	0.990	0.010
		2	0.275	0.725
		3	0.921	0.079
3	Does your company have a written statement of the firm’s risk appetite?	1	0.993	0.007
		2	0.196	0.804
		3	0.683	0.317
4	Are there official risk management policies and procedures in your company?	1	0.876	0.124
		2	0.146	0.854
		3	0.338	0.662
5	Do you apply the COSO integrated framework for ERM in your company?	1	1.000	0.000
		2	0.348	0.652
		3	0.928	0.072
6	Do you apply the ISO 31000 risk management standard in your company?	1	1.000	0.000
		2	0.264	0.736
		3	0.852	0.148
7	Is risk managed with an integrated analysis and management of all identified corporate risks (e.g., financial, strategic, operational, compliance, and reporting risks)?	1	0.969	0.031
		2	0.154	0.846
		3	0.403	0.597
8	Do you determine correlations and portfolio risk effects of combined risks?	1	0.975	0.025
		2	0.245	0.755
		3	0.521	0.479
9	Do you determine quantitative impacts risks may have on key performance indicators?	1	0.986	0.014
		2	0.196	0.804
		3	0.680	0.320
10	Do you organize workshops in your company where managers discuss exposures to different types of risks and risk management?	1	0.915	0.085
		2	0.163	0.837
		3	0.615	0.385
11	Does your company create a risk map indicating position of risks the company is exposed to, considering probability of occurrence and significance of identified risk to the business activity?	1	1.000	0.000
		2	0.280	0.720
		3	0.605	0.395
12	Do you have a risk response plan for all significant events?	1	0.946	0.054
		2	0.166	0.834
		3	0.561	0.439
13	Do you submit a formal report on risk and risk management to the management board at least annually?	1	0.880	0.120
		2	0.199	0.801
		3	0.390	0.610
14	Do you monitor key risk indicators aimed at emerging risks (not past performance)?	1	0.867	0.133
		2	0.117	0.883
		3	0.342	0.658

Note: Class 1 = “no ERM”, Class 2 = “best practice ERM”, Class 3 = “pretended ERM”. Source: own processing in IBM SPSS Statistics 27 software, poLCA extension.

.

Class 1 “No ERM” (31.8% of the sample, mean ERM index = 0.633, standard deviation = 0.792). These companies have neither a dedicated risk manager nor a dedicated department dealing with risk management. The firms do not have written limits on the maximum loss they are willing to accept. The companies also do not have formally defined risk management guidelines/policies/guidelines or procedures. It is therefore clear that this group of companies does not have formal risk management frameworks in place such as COSO or ISO 31000. Risks in the company are not managed in an integrated manner and across all categories and levels of enterprise risk. The impact of the interdependency of individual risks on the overall portfolio is not identified or quantitatively assessed against key performance indicators. The companies do not hold workshops on the company’s risk exposure or risk management strategy. Companies do not have risk management maps or contingency plans to respond to significant risks. Risk management is not formally conducted in Class 1 companies, and neither the owners nor the board of directors require a report on risks and risk management. Therefore, the implementation of ERM in Class 1 is at a very low level.

Class 2 “Best Practice ERM” (29.4% of the sample, average ERM index = 11.1, standard deviation = 1.63). These companies have their own risk manager or department/department for risk management. The companies have a written risk appetite and formal risk management policies/guidelines and procedures. Most companies in this class have a formal risk management framework in place in the form of a COSO framework or ISO 31000 certification. Risks are managed in an integrated manner and across all categories and levels of enterprise risk. Companies identify the impact of interdependencies of individual risks on the overall risk portfolio, have risk maps and response plans for all key risks, quantitatively assess the impact of risks on the company’s key performance indicators, and hold risk management strategy workshops. The companies track key risk indicators and information on emerging risks. A formal report on risks and risk management is presented to the owners or board of directors at least annually. Overall, Class 2 companies can be considered the counterpart of Class 1 companies, as ERM is implemented at a high level in Class 2.

Class 3 “Pretended ERM” (38.8% of the sample, mean ERM index = 5.34, standard deviation = 1.63). Class 3 companies have neither a dedicated risk manager nor a dedicated department dealing with risk management. They do not have a formalized risk management framework (COSO, ISO 31000) or a written risk appetite. However, these firms generally have formal policies, guidelines, and procedures to manage risk in an integrated manner across all categories and levels of enterprise risk. Firms do not calculate the impact of risks on the firm’s key performance indicators and typically do not determine the impact of interdependencies between individual risks on the overall asset portfolio or create risk maps. These firms do not hold risk management strategy workshops, and most firms do not have a plan to respond to significant risks. However, formal risk and risk management reports are submitted to the owners or board of directors on a regular basis, at least once a year, to record important information about emerging risks. Risk management systems present in these companies lack the strategic and operational component of ERM systems and are focused only on the reporting aspect, which can be seen as a “facade without the substance”. These companies just claim that they are managing corporate risks in the integrated way, but this is not the case because their ERM system does not contribute to better planning and decision-making (Dvorski Lacković et al. 2021).

The fourteen questions of the ERM index are reliable (Cronbach’s alpha = 0.897) and therefore can be used as a set representing the level of ERM. The ERM index score, in the form of the sum of respondents’ answers, is used as the dependent variable in the following model. Two models were created:

-

Model 1: Model with all independent variables.

-

Model 2: Model with statistically significant independent variables.

The results of the regression model (

Table 3. Regression model results.

	Dependent Variable
	ERM Index
Variable	Model 1	Model 2—Final
Constant	7.3638 ***	7.5389 ***
	−1.41732	−0.77104
ForCap	0.0464 ***	0.0460 ***
	−0.00933	−0.00928
Age	−0.0675 **	−0.0706 **
	−0.02391	−0.02364
Size: 4 to 15–100 to 249	−2.5448 **	−2.2638 **
	−0.80024	−0.77488
16 to 49–100 to 249	−2.5257 ***	−2.3800 **
	−0.75302	−0.7451
50 to 99–100 to 249	−1.3424	−1.3555
	−0.71104	−0.70974
Sector: Quarternary–Primary	−0.5225	−
	−1.49905
Tertiary–Primary	0.5647	−
	−1.25464
Secondary–Primary	−0.228	−
	−1.27568
Observations	296	296
R2	0.228	0.22
Adjusted R2	0.204	0.205
Overall Model Test (F test)	9.54 ***	14.74 ***
Breusch−Pagan/Cook−Weisberg test for heteroskedasticity		chi2(1) = 2.83
		Prob > chi2 = 0.0927
VIF		ForCap = 1.12
		Age = 1.01
		Size = 1.04

Note: * p < 0.05, ** p < 0.01, *** p < 0.001. Values in the brackets are standard errors. Neither collinearity nor heteroskedasticity was demonstrated. Source: own processing in IBM SPSS Statistics 27 software.

) show that the sector has no influence on the level of ERM implementation (H4). Thus, there is no difference between sectors in the level of ERM. This is confirmed by one-way ANOVA (F = 0.799, p-value = 0.495). An effect of the share of foreign capital (H1), age (H2), and company size (H3) on the level of ERM was found. These three independent variables explain 20% of the variability of the ERM index.

5. Discussion

A 2017 study by consulting firm Aon, prepared separately for the Czech Republic, showed that companies are aware of the importance of risk identification, but only a small percentage of Czech companies currently address risk management systematically. The level of risk management in the Czech Republic is relatively low compared to Western countries (AON 2018).

Our research shows that company size determines the level of ERM implementation (H3). There is a significant difference between larger medium-sized companies (100 to 249 employees) and the two categories of small companies (4 to 15 employees, 16 to 49 employees). The regression analysis showed no difference between smaller medium-sized companies (50 to 99) and larger medium-sized companies (100 to 249 employees). As company size increases, the level of ERM implementation increases, as evidenced by higher ERM scores for medium-sized companies than for small companies (

Table 4. ERM index by company size.

Company Size by Number of Employees	N	Mean and Significant Differences (α = 0.05, Tukey HSD Test)	SD	SE
a. 4 to 15	72	4.58 d	4.03	0.475
b. 16 to 49	87	4.06 c,d	3.74	0.401
c. 50 to 99	77	6.22 b	4.47	0.510
d. 100 to 249	60	7.63 a,b	4.50	0.581

Note: N = number of observations, SD = standard deviation, SE = standard error. Source: own processing in IBM SPSS Statistics 27 software.

) and the results of previous empirical studies (such as those by Beasley et al. 2015; Lechner and Gatzert 2018; Mardessi and Ben Arab 2018).

Small businesses lack resources and reliable mechanisms to support their risk management activities (Brustbauer 2014). In addition, it may be unnecessary for small companies that are not under regulatory pressure to fully implement ERM because the costs associated with ERM are not outweighed by the benefits of ERM. Larger companies are more formalized, have a greater need for more effective ERM techniques, and therefore may be more able to implement ERM due to greater resources. This finding supports the economies of scale argument that larger companies have a more developed risk management process due to their greater exposure to risk and the high cost of implementation. Accordingly, most studies demonstrate that larger companies are more likely to implement ERM activities (Sprčić et al. 2017). However, this finding may not hold for large publicly traded companies, where there is no significant difference in the extent of ERM implementation by size (Hernández-Madrigal et al. 2020).

The regression analysis also revealed an inversely proportional relationship between firm age and the level of ERM implementation (H2). Younger companies generally have higher levels of ERM implementation, which is contrary to the expectations of the authors and other studies (Glowka et al. 2020; Nguyen and Vo 2020). Segmentation of companies based on LCA shows that there are significant differences in the ERM index between the low ERM group (no ERM) and the high ERM group (best practice ERM). The average age of the “no ERM” companies (20.4 years) is higher than the average age of the “best practice ERM” companies (15.6 years). A possible explanation could be a certain rigidity of management of older companies in post-communist countries and a lower willingness to adopt new management methods.

Older companies were often founded in the 1990s by entrepreneurs with no management training and minimal theoretical management knowledge. Risk management in such companies is tacit or intuitive. During the period of transformation of the Czech economy in the 1990s, the development of post-communist entrepreneurship was influenced primarily by the improvement of ideas and practices inherited from pre-1989 socialism. In the case of foreign direct investment, the physical presence of Western managers representing foreign capital can exert direct pressure on domestic managers to adopt new practices (Soulsby and Clark 1996).

In contrast, younger firms established after the turn of the millennium are unencumbered by the past, are more flexible, their managers have often received management training, and are willing to try new formalized practices, including partial ERM practices. The internationalization of companies also plays an important role. Companies with CEOs who had established strong and diverse international networks exhibited greater knowledge of foreign markets and practices prior to internationalization (Musteen et al. 2014). An explanation for the relationship between firm age and the level of ERM implementation is also found in Greiner’s theoretical model of firm growth (Greiner 1989). Older companies may be suffering from a crisis of bureaucracy, where the company spends more and more time on the internal agenda alone, leaving no time to implement new management practices, including ERM.

A significant finding is the positive effect of the share of foreign capital on the level of ERM implementation (H1). No ERM SMEs have on average 6.02% foreign capital, pretended ERM firms 13.75%, and best practice ERM firms 35.06%. Notably, the group of best practice ERM firms with the highest ERM implementation rate is statistically significantly different from the other two size categories. According to Dun & Bradstreet, representatives of companies from Western European countries are leading in terms of the volume of foreign capital in Czech companies. For the first time, companies and individuals from Luxembourg became the largest foreign owners of Czech companies in 2021. Between 2007 and 2015 the Dutch were the first, between 2016 and 2019 the Germans, and in 2020 again the Dutch. The total foreign capital of the 20 largest foreign owners increased by 14% from CZK 800 billion to CZK 915 billion in 2021, which is the highest value since 2019 (Dun & Bradstreet 2021). Foreign direct investment has a positive impact on the adoption of modern production methods (Žďárek 2009), the innovation activity of companies (Ramadani et al. 2017), and the productivity of firms (Hampl et al. 2020).

The inflow of foreign capital into firms means not only a strengthening of capital, but also control by foreign investors and the adoption of new management practices. The degree of adoption of international standards in individual countries is not related to how much total FDI host countries receive, but from whom they receive it (Prakash and Potoski 2007). Risk management in the Czech Republic is limited to companies that are required by their parent company abroad to follow formalized procedures, an outcome similar to that in neighboring Slovakia (Klučka and Grünbichler 2020). Foreign direct investment is risky and investors are interested in controlling the risk associated with the investment. Foreign direct investment may be exposed to different risk structures, with risk management activities simply representing the degree of authority that headquarters grants to local management. In practice, the foreign investor’s control and influence over the company is strengthened (Yin et al. 2019). Consequently, the introduction of ERM will improve the quality of investment decisions—the higher the maturity of ERM, the better the company’s ability to identify, manage, and mitigate the potential risks arising from investment decisions (Faisal et al. 2021).

6. Conclusions

This study examines the relationship between the level of ERM implementation and external structural determinants of Czech SMEs. Three levels of ERM implementation were identified using LCA: “no ERM”, “pretended ERM” and “best practice ERM”. The authors find that firm age, company size, and the share of foreign capital directly affect the level of ERM implementation. A higher level of ERM implementation is typical for larger and younger companies with a higher share of foreign capital. This result can be explained in the context of the transformation of Czech companies. Companies with a long history on the market “suffer” from the emphasis on traditional management methods practiced in companies since the 1990s. In contrast, younger companies, mostly established after the Czech Republic’s accession to the EU, are not burdened by history, are more flexible, and are led by managers with theoretical knowledge of modern management practices. The level of risk management in Czech companies is still relatively low, although many SMEs have already introduced some elements of ERM.

At the same time, the introduction of ERM is influenced by the demands of foreign investors. With the opening of the economy, foreign direct investment in the Czech Republic increased dynamically, as did the share of foreign capital in Czech companies. Foreign direct investment is associated with a certain risk, which the foreign investors want to control. Therefore, the investment is often associated with the adoption of new management practices, including systematic and formalized risk management. A previous study found that ERM can increase a company’s knowledge of risk, improve internal communication, and reduce information asymmetries. As a result, the company is able to manage financial and operational risks such as financial risk strategy, capital strategy, investment strategy, pricing policy, and product mix (Faisal et al. 2021). By combining financial and risk analysis and management tools in a process defined by the ERM framework, companies can increase their value.

ERM, whether in the form of COSO, ISO 31000, or other standards, can be beneficial to companies if they can integrate it into strategic business processes. Foreign capital increases the level of ERM in Czech companies. On the one hand, the implementation of ERM strengthens the control over the invested capital, on the other hand, it helps to improve the company’s investment decisions in the future. Thus, there is no need to worry about foreign capital. In addition to the acquisition of an equity stake, foreign direct investment is usually associated with the transfer of know-how, the use of cost effects in the target country for the investor, and also with investments in kind, whether in the upgrading of existing assets of the acquired companies or in new investments. The arguments of Czech owners invoking tradition and “family jewels” are not always beneficial for the company from a long-term strategic point of view and often express rather a hidden fear for their own career and fear of losing control over the company.

The results of the study contribute to the literature by enriching the empirical analysis of ERM in emerging markets. From a theoretical perspective, the study provides evidence of the direct impact of foreign capital on the level of ERM implementation. The authors of the study support the inflow of foreign capital into Czech companies and the gradual generational change in top management by new management with theoretical knowledge of modern ERM methods and experience. In combination with previous studies, follow-up research can be proposed to verify the role of ERM as a mediator between foreign capital and firm value. The study is also useful for policy makers who should further encourage the inflow of foreign investment into the country.

The limitations of this study relate to the generalization of the findings to other countries. The study is fraught with a degree of subjectivity in assessing the level of ERM implementation. The ERM index is based on self-reporting by top managers of SMEs. Other ERM measures could be considered for further analysis. Second, the results of the study may be influenced by the peculiarities of the Czech economy, which was characterized by central planning for more than forty years and underwent a transformation to a market economy in the 1990s, which had a long-term negative impact on the adoption of new management practices, including ERM.