Despite the emergence and strategic importance of project risk management (PRM), its diffusion is limited mainly to large companies, leaving a lack of empirical evidence addressing SMEs. Given the socio-economic importance of SMEs and their need to manage risks to ensure the success of their strategic and innovative projects, this research aims to investigate how to adopt PRM in SMEs with a positive cost–benefit ratio.
This study presents an exploratory and explanatory research conducted through multiple-case studies involving 10 projects performed in Spanish and Italian small and medium-sized enterprises (SMEs).
The results obtained highlight how project features (commitment type, innovativeness, strategic relevance and managerial complexity) and firms' characteristics (sector of activity, production system and access to public incentives) influence PRM adoption, leading to different levels and types of benefits.
The paper offers practical indications about PRM phases, activities, tools and organizational aspects to be considered in different contexts to ensure the project's success and, ultimately, the company's growth and sustainability. Such indications could not be found in the literature.
Ferreira de Araújo Lima, P., Marcelino-Sadaba, S. and Verbano, C. (2021), "Successful implementation of project risk management in small and medium enterprises: a cross-case analysis", International Journal of Managing Projects in Business, Vol. 14 No. 4, pp. 1023-1045. https://doi.org/10.1108/IJMPB-06-2020-0203
Emerald Publishing Limited
Copyright © 2020, Priscila Ferreira de Araújo Lima, Sara Marcelino-Sadaba and Chiara Verbano
Published by Emerald Publishing Limited. This article is published under the Creative Commons Attribution (CC BY 4.0) licence. Anyone may reproduce, distribute, translate and create derivative works of this article (for both commercial and non-commercial purposes), subject to full attribution to the original publication and authors. The full terms of this licence may be seen at http://creativecommons.org/licences/by/4.0/legalcode
Risk Management (RM) is a very relevant process that can be related to many companies' survival. The strategic plan of the enterprises is frequently implemented by tackling projects, so project risk management (PRM) has arisen as a very important approach. Taking into account that SMEs make a very relevant contribution to the economy (Turner et al., 2010); the analysis and the understanding of the key processes of PRM in SMEs is a relevant and pressing question, and the guidelines and tools used by large firms are usually too expensive or too complex to be suitable for SMEs (Pereira et al., 2015).
Although the relationship between the utilization of a project management (PM) methodology and project success has been well established (Joslin and Müller, 2015), a review of the literature shows that there is not enough deep case analysis about how SMEs have implemented an RM methodology and how the project and the company benefit from it. Therefore, this study aims to understand how PRM can be adopted by SMEs with a positive cost–benefits ratio, considering the managerial and organizational aspects.
Experiences of empirical investigations about RM in other areas, such as portfolio management, project control, multicultural environments, stakeholders management or value creation, have been analysed, but they have not taken into account the RM and the specific characteristics of SMEs (Teller and Kock, 2013; Lin et al., 2019; Liu et al., 2015; Xia et al., 2018; Willumsen et al., 2019). Rodney et al. (2015) have developed an integrated model that simultaneously represents RM and all the PM processes, including the environmental factors, but requires the project manager's effort in establishing different scenarios and identifying and analysing different risks. Nevertheless, the resources that are needed to support the application of this model, in terms of time, costs and knowledge, are usually beyond the capability and affordability of SMEs. These resource-related constraints increase the SMEs’ vulnerability and lead them to an additional need of PRM adoption (Blanc Alquier and Lagasse Tignol, 2006; Dallago and Guglielmetti, 2012).
However, the literature on RM has focused mainly on large companies, leaving a gap of empirical evidence addressing small companies (Kim and Vonortas, 2014). A recent literature review conducted on the development paths of RM in SMEs identified the PRM stream as an emerging and relevant field of application only slightly studied (de Araújo Lima et al., 2020).
Given this gap of knowledge, the current study aims at contributing meaningfully to understand how PRM processes have been implemented in SMEs. Based on the analysis of 10 cases, the benefits of efficiently conducting PRM along the project lifecycle have been identified. Moreover, this paper depicts the enabling and hindering factors for SMEs to successfully adopt PRM with a positive cost–benefit ratio, to projects with different features and in different types of industries.
Additionally, these findings have allowed the researchers to obtain different clusters with specific procedures to follow in order to obtain different levels of benefits in the project. They also provide SME's project managers indications about RM-specific tools that are appropriate for particular innovation levels or specific economic sectors.
In the following section, the result of an in-depth search for previous publications related to PRM and, more specifically, related to PRM in SMEs, has been conducted. As it is described in Section 3, the main aim of this paper is to identify how to implement a PRM in SMEs reaching high benefits without many resources. This research has been performed through a deep multiple-case study involving 10 projects conducted in Spanish and Italian SMEs. The objectives and methodology applied in the investigation are also detailed in the referred Section. The results obtained are included in Section 4, organized in within-case analysis and cross-cases analysis. The implications of these results are discussed in the following section, where the different clusters that have been identified – according to the level of benefits obtained through the implementation of PRM – are explained.
2. Literature review
2.1 Project risk management
The specific characteristics of the projects, such as novelty, uniqueness, high number of stakeholders and temporality, indicate that RM is useful to successfully achieve the project's objectives (PMI, 2017). PRM is an integral part of PM, a process in which methods, knowledge, tools and techniques are applied to a project, integrating the various phases of a project's lifecycle in order to achieve its goal (ISO 21500, 2012; PMI, 2017).
According to the Project Management Book of Knowledge (PMBoK), all projects involve associated risks, the positive side of which facilitates achieving certain benefits (PMI, 2017). Some of the overall qualitative definitions of risk are the possibility of an unfortunate occurrence, the consequences of the activity and associated uncertainties and the deviation from a reference value (Aven, 2016). A common definition of risk related to PM is an uncertain event or condition that, if takes place, has both negative and positive effects on the project's objectives (PMI, 2017; ISO 31000, 2018; Pritchard and PMP, 2014; A Project risk management in SMEs PM, 2004; TSO, 2009). Therefore, organizations must achieve, through PRM, a balance between the risk assumed and the expected benefit.
RM is considered one of the most relevant areas in the training of project managers (Nguyen et al., 2017); even the project stakeholders expect them to analyse the different risks that can affect projects.
The way risk is understood and described strongly influences the way risk is analysed, and hence it may have serious implications for RM and decision-making (Aven, 2016). It is also important to consider risk as systemic as it allows the investigation of the interactions between risks and encourages the management of the causality of relationships between them, thus forcing a more holistic appreciation of the project risks (Ackermann et al., 2007).
Technical-operative risks: technology selection, risks related to materials and equipment, risks related to change requests and its implementation, design risks
Organizational risks related to human factors (organizational, individual, project team): risks derived from regulations, policies, behaviour (lack of coordination/integration, human mistakes related to lack of knowledge)
Contract risks: risks of the contract related to the project
Financial/economic risks: inflation, interest rates fluctuation, exchange rate fluctuation
Political risk: environmental authorizations, governmental authorizations
The RM process defined in ISO 31000:2018 is composed of the following phases: initiate (context analysis); identify (risk identification); analyse (qualification and quantification); treatment (plan and implement) and risk monitor and control (monitoring and re-evaluation). The process must be continuous throughout the project lifecycle to increase the chances of the project's success (Raz and Michael, 2001).
Within these processes, communication acquires great importance within RM and is a key element in its success, but only Portman (2009) specifically analyses it. Communication is the basis that allows the entire project team (including the main stakeholders) to understand the context of the project to develop the PRM approach. It is also necessary to define the support structure to address the risks that materialize and to monitor them by periodically communicating the status of defined indicators.
RM helps to achieve project objectives in a much more efficient way as it facilitates the proactive management of problems and the maximization of benefits if opportunities materialize (Elkington and Smallman, 2002; Borge, 2002). Teams work with greater confidence and a lower level of stress, which increases their effectiveness (APM, 2004). However, it is clear that a large number of project managers still believe that RM involves a great deal of work, for which they do not have time, and this is particularly common in projects addressed by SMEs (Marcelino-Sádaba et al., 2014).
One of the biggest issues in performing RM is the lack of systematic risk identification methods that provide characteristic taxonomies for specific project types based on lessons learned from similar projects (Pellerin and Perrier, 2019).
2.2 Project risk management in SMES
The importance of PRM carried out in SMEs has been analysed and highlighted in the literature (Blanc Alquier and Lagasse Tignol, 2006; Naude and Chiweshe, 2017). For SMEs, PRM should be carried out at an early stage in the strategic selection of projects to be implemented because their success has a great influence on its survival. However, as Vacik et al. (2018) indicate in their study, only 4% of the companies studied in their research have used risk measurement methodologies in their decision-making, carrying out the process in a qualitative way.
Some studies are available to assist SMEs in identifying and managing risks in specific business sectors; for example in ICT, where software projects are characterized by a high level of uncertainty in the definition of requirements, RM acquires great importance for SMEs project management (Neves et al., 2014). There are other studies about risk identification and their management in this area, including the one of Sharif et al. (2013), Lam et al. (2017), and Taherdoost et al. (2016).
Despite the fact that different web tools have been developed for SMEs to solve their biggest difficulties in RM (Sharif and Rozan, 2010; Pereira et al., 2015), RM is generally carried out in person by the project manager due to the high cost of a tool and the need for qualified staff to use it.
Many sectors, such as IT, construction and design, usually work by projects and therefore have information on the specific risks associated to them. In the construction sector, for instance, different analyses, methodologies and tools for RM could be identified (Tang et al., 2009; Rostami et al., 2015; Oduoza et al., 2017; Hwang et al., 2014). The main problems – lack of time and budget – arise when implementing RM among SMEs in this sector.
Tupa et al. (2017) and Moeuf et al. (2020) have analysed the risks and opportunities inherent to SMEs in the new paradigm brought by the Industry 4.0, in which relationships between people and systems are characterized by high connectivity and a significant quantity of data and information to manage. As a result, a new information security risk has emerged. In addition, due to the new connection systems, it will be possible to establish new information flows that update the indicators established for RM. Due to the great importance of decision-making in project success, the training of project managers in these disciplines is one of the key factors that will affect the PRM in the future.
Sanchez-Cazorla et al. (2016) concluded in their study of PRM, “Risk Identification in Megaprojects”, that further empirical studies are required to provide process information over the project lifecycle. The literature review also shows that there are not enough studies on how PRM could be adapted to SMEs.
Although Marcelino et al. (2014) established a methodology related to the project lifecycle and Lima and Verbano (2019) analysed how to implement a PRM methodology with a positive cost–benefit ratio, more studies are needed about the real practice RM in SMEs, best practices in this area and how to adapt them to different economic sectors, company sizes or types of projects addressed.
From the literature review, it could be concluded that specific methodologies are needed for SMEs in order to tackle PRM in an effective way. Nevertheless, not many methodologies in the literature are suitable for SMEs and their specific characteristics since these methodologies require a great amount of resources or the availability of specific tools and software that SMEs usually do not have.
This paper presents a more detailed analysis of the process developed to obtain good practice patterns according to the different economic sectors and types of projects.
3. Objective and methodology
Based on the motivation presented in the previous sections, the main research objective is to understand how to adopt PRM in SMEs with a positive cost–benefit ratio considering RM phases, activities, tools and organizational aspects that enable the effective implementation of PRM in SMEs. In order to reach this goal, the following specific research questions were formulated:
What are the main RM phases, activities, tools and organizational aspects adopted by SMEs in the PRM process?
What are the evidences and outcomes of PRM adoption in SMEs?
What are the enabling and hindering factors to perform PRM in SMEs?
To achieve the research objective and answer the research questions, an exploratory and explanatory research through multiple case studies was conducted as it is the most suitable methodology for this type of research (Voss et al., 2002; Eisenhardt and Graebner, 2007; Yin, 2009).
To this extent, a specific empirical framework proposed by Lima and Verbano (2019) for analysing multiple cases of PRM adoption in SMEs was used since it is the only one available in literature in order to analyse cases with objectives similar to the ones in this study. In Figure 1 the process followed to build the framework and the main constructs and variables investigated with the questionnaire can be observed.
The final questionnaire is structured in nine sections reflecting the framework:
Company and respondents profile;
Project overview (i.e. objectives, type of commitment, innovativeness, strategic relevance and managerial complexity of the project);
PRM organization (people involved, training, procedures)
PRM plan, risks and opportunities considered;
(5-8)regarding each PRM phases (risk identification, analysis, treatment, monitoring and control), activities, tools and difficulties faced; finally, PRM hindering and enabling factors were analysed for the whole process;
Evidences and outcomes of the PRM adoption (i.e. the benefits, time and costs of PRM implementation).
The questionnaire included close-ended questions (i.e. number of employees, total cost of the project, etc.), perception questions on a 5-point Likert scale (regarding for example the level of technology innovativeness of the project and the benefits obtained from PRM) and open-ended questions (concerning, for example, the activities and tools adopted and the difficulties faced in each PRM phase, the enabling and hindering factors for PRM adoption). The choice of the type of questions depends on:
the qualitative or quantitative nature of the specific object investigated,
its degree of novelty (i.e. there is a gap in the literature regarding the measurement of PRM benefits; therefore they have been investigated mostly with perception questions),
the interrelation among the specific object with other variables, leading to more significant comprehension with an open-ended question.
The semi-structured interviews, using this questionnaire, were the primary source of data collection, supplemented with documents related to the project.
A pilot case belonging to service industry in the ICT has been selected in order to test the questionnaire. In particular, this project has been chosen considering the large experience of the project manager and his willingness to collaborate to the study; therefore, this pilot case was very useful to verify comprehensibility and validity of the questionnaire and to improve it. Notwithstanding, this study was then excluded from the cases analysed because the company was expanding beyond the limits set for SMEs. Once verified the questionnaire, the sampling of the cases has started.
The project was the unit of analysis of the research, and three characteristics were necessary to fit the selection criteria: a project with PRM implementation; a cost–benefit ratio of PRM adoption higher than 1 and a project developed in an SME.
In order to obtain a broad sample and gain a deeper understanding of the topic of interest in different scenarios, heterogeneity among the cases was necessary. Therefore, in addition to the requested project's features, the researchers selected projects from different industrial sectors and with different end users (external or internal), in order to guarantee the external validity of the research (Yin, 2009). An overview of the 10 selected cases with the main characteristics of the project is displayed in Table 1.
All interviews were conducted on-site and, to avoid bias and ensure the construct's validity (Voss et al., 2002), at least two people who were highly involved in the project (project manager, technical leader, project management consultant) responded to the questions individually. The interviews were about 90 min in length and were conducted in the respondents' native languages, which incentivized them to give more information about the project since they felt more comfortable during the process; for this reason, the questionnaire was translated in Italian and in Spanish. After a preliminary analysis of the collected data, integrative information was often requested by phone or email, and a final verification with the respondents of the resulting project report was conducted. The last column of Table 1 displays the number of interviews and the number of interviewees respectively. The researchers have also analysed documents related to the project in order to increase data reliability and to ensure the project's internal validity through triangulation (Voss et al., 2002).
The interviews were recorded and transcribed for the data analysis. To analyse the collected data, the directed approach to content analysis, the goal of which is to validate or extend conceptually a theoretical framework or theory (Hsieh and Shannon, 2005), was initially used. This approach consists of coding data before and during its analysis. After the initial coding through the semi-structured questionnaires, in order to refine the results, especially those that emerged from the open-ended questions, it was necessary to complete the coding process through a careful analysis of the interviews. As was indicated by Hsieh and Shannon (2005), since the goal of the research was to identify and categorize all instances of a particular phenomenon, the recorded interviews were transcribed and inductively coded with descriptive coding (using a word or a specific phrase to aggregate the basic topics of the interview transcript) and in vivo coding methods (i.e. assigning a label corresponding to word or short phrase taken from the interview transcript). For example, one interviewee said that they “did not know well the risks”, while another one, in another case, said they needed “to understand well the risk”. Both these expressions were labelled as “lack of knowledge” regarding the possible impact of the risk. The resulting categories were important variables in the inter-cases comparisons.
The entirety of the coding process was done manually. Segments of data were initially summarized, and then pattern coding was applied independently by two research team members; any coding disagreements were discussed until agreement was reached on all coded portions of the interview, in order to overcome the reliability tests (Tong et al., 2007). Once this process was done, the within-case analysis was conducted. The aforementioned directed approach analysis and the coding process are part of the within-case data analysis. The main goal of a within-case analysis is to describe, understand and explain what has happened in the single case (Miles et al., 1994). After understanding each case individually, the cross-case analysis was performed, and, as supported by Myers (2000), partial generalizations to similar populations were made.
The following cross-case analysis allows the researcher to strengthen a theory, built through examination of similarities and differences across cases. Eisenhardt (1989) states that analysing similarities and differences between pairs of cases is a powerful method to better understand the cases and obtain meaningful findings (Eisenhardt, 1989; Voss et al., 2002).
Replication strategy has been used during the cross-case analysis. In this strategy, a theoretical framework is applied to study one case in depth, and the successive cases are examined to see whether the identified pattern matches the pattern in previous cases (creating a cluster) (Yin, 2009). Therefore, both within-case and cross-case analysis of the data were conducted as they are suitable for multiple-case studies (Eisenhardt, 1989; Voss et al., 2002; Yin, 2009).
4.1 Results from within-case analysis
The within-case analyses allowed the researchers to answer the research questions proposed in Section 3. For each case, the results obtained from the questionnaire were carefully analysed. All information collected was organized into tables for the next phase of the data analysis. In addition, a figure with the PRM phases, the activities conducted, the tools used, the difficulties faced in each phase, the gaps in the process and the PRM results was created. Through these analyses, the enabling and hindering factors were identified and the PRM benefits were evaluated and graphically displayed. As an example of the information collected and the analyses conducted, Figure 2 displays the results of the within-case analysis for the first case study.
The same process was conducted in every case. Based on the analysis of the outcomes of all the within-case analyses and following the same structure of phases, the main activities performed and the main tools used in each phase of the PRM process were individuated as it follows:
Phase 1 (risk identification): the main activities are context analysis, risk identification (both activities were conducted in 9 of the 10 cases), stakeholder analysis and opportunity identification; and the main tools are brainstorming (80%), checklist (70%), risk register (50%). It has been emerged that in only 40% of cases interviews with experts were conducted and in 20% of the projects SWOT analysis, FMEA, 5 Whys and root-cause analysis tools were used.
Phase 2 (risk analysis): the main activities are meetings (both formal and informal). Design-related activities and tests have been found in 40% of cases. The main tools are risk matrix, risk register, risk ranking. Nevertheless, 5 Why and expected money value (EMV).
Phase 3 (risk treatment): all the activities identified have the same relevance (between 20 and 40%) being communication/meetings, design/specification changes the most important ones. Other activities are outsourcing decisions, prototype testing, team monitoring and analysis on the job. In all the cases, the main tools were risk mitigation. risk transfer, risk avoidance and risk retention.
Phase 4 (monitor and control): the main activities are risk revaluation and periodic monitoring meeting. Action monitoring plan, meetings and problem replication have been executed in a less relevant way. A main tool does not arise in this phase, being change request monitoring, risk trigger monitoring and risk audit are the ones used.
These results are summarized in Figure 3.
As for the organizational aspects related to PRM adoption, the following descriptive variables were analysed:
Responsible for PRM implementation (who)
People involved in the PRM process (which roles)
Roles in PRM clearly assigned (yes/no)
Internal PRM procedures adopted in the project (yes/no)
PRM training plan for the people involved in the project (yes/no)
In all cases, the project manager was responsible for the PRM implementation process. In some of the cases, members of the team or a PM consultant or function manager was involved. In eight cases, the roles in the PRM process were clearly assigned, and in seven cases, the internal PRM procedures were followed, while PRM training was conducted in only two cases.
The innovation, complexity and relevance of the projects were also assessed. Using a 5-point Likert scale, the interviewees were questioned about the project's technologic innovativeness, innovativeness for the market, project management complexity and strategic relevance. On average, the innovativeness for the market and the PM complexity were medium-high, while the project technologic innovativeness was high and the strategic relevance of the projects was even higher.
In the final section of the interview, the main outcomes and evidence of the PRM process were discussed. A list of benefits than can be obtained through the implementation of PRM was created by the researchers. Using a 5-point Likert scale once again, the interviewees were asked about their perception regarding the achievement of these seven benefits (eight in the cases with an external end-user) through PRM adoption, which was very satisfactory.
In addition to the benefits obtained through PRM, other important evidence emerged from the results. In all cases, PRM was considered useful, and the time/cost spent on its implementation was justified by the benefits, as required by the selection criteria. The interviewees of six projects believe that PRM should be adopted in all of the company's projects. In another two interviews, the respondents stated that PRM should be implemented in all innovative projects, while in the other two cases, the interviewees affirmed that the PRM process should be carried on in the strategic projects.
The last research question concerned the enabling and hindering factors for companies to adopt PRM. The respondents have pointed out the following as the enabling factors: previous PRM experience; support of a PM consultant with PRM experience; having a strategic/innovative project (which stimulates PRM adoption); a PRM report requested by the government/project financer and stakeholder support. In terms of the hindering factors, it has emerged that difficulties in the communication with the external client, lack of support from CEO/stakeholders (i.e. no recognition of PRM importance for the project's success) and PRM being seen as a “waste of time” by some of the people involved in the project are the most significant issues. The proof of the benefits obtained through PRM can be used by project managers to convince the CEO, the external clients and all the stakeholders to adopt PRM in the future projects; moreover, they could explain that those benefits could be achieved only with the cooperation of all actors involved in the projects.
Table 2 summarizes the findings obtained: the PRM organizational aspects in the projects, the level of innovativeness and complexity of the projects, the main evidences and the main benefits obtained through PRM implementation.
4.2 Results from cross-case analysis: pattern identification
After performing the within-case analysis for each of the selected cases, the cross-case analysis was conducted. Considering the level of benefits that the projects have achieved through the PRM implementation and the project characteristics, the projects were clustered into three different groups identifying different patterns:
Group 1: very high level of benefits (cases 4, 7 and 10)
Group 2a: high level of benefits – manufacturing (cases 1, 2 and 9)
Group 2b: high level of benefits – services (cases 5, 6 and 8)
Case 3 had a medium-high innovativeness level and lacked of PRM organization (Table 2). Moreover, some of the PRM phases were poorly implemented, indicating that in this case the lack of structure in the PRM process had a negative impact on the benefits, which were all rated as medium. Given its specific characteristics and the poor results obtained, case 3 was excluded from the clusters.
In group 1 (very high benefits achieved), similarities in the project context (all Spanish manufacturing companies implementing projects with very high strategic relevance) and in the PRM organization (PRM roles assigned, internal procedures adopted and identification of the risk owner) were acknowledged. All companies have identified the same project risk types (i.e. technical-operative risks) and have used two specific tools and performed the same activities to manage these risks. The risks were constantly measured during the projects, and the project manager was responsible for PRM. A consultant with PRM experience in the micro and small company and a project manager with significant PRM experience were crucial for achieving very high benefits.
Six other cases have reached a high level of benefits and, based on the project context characteristics, were split into two groups: manufacturing (group 2a) and services (group 2b).
In the first group, composed of the manufacturing cases, projects have a very high level of innovation and complexity, and the contexts in which they exist are extremely similar. The roles involved in the projects were the same (project manager and project manager consultant), and the same project risks were identified. Several common activities were conducted, and common tools were used in the first three PRM phases.
The project manager's knowledge and experience in implementing PRM enabled the team to adopt process, notwithstanding the fact that in all cases difficulties were faced due to the lack of knowledge and competences about some technical project details (such as material's specific characteristics, client's ERP system that could generate problems in the project). Interesting evidence has emerged in these cases, with opportunities considered and pursued and the risk register being constantly updated as the most significant pieces of evidence.
The third group is formed by three services companies with a very high standard of PRM organization. In contrast to the previous groups, more project risk types were considered in these cases (three in total), which led to the individuation of specific risks in all projects. Similarities are identified in the PRM process, which was slightly adapted in each of the cases. Their strategic relevance has triggered the project managers to adopt PRM, regardless of their lack of knowledge about the difficulties to be faced. While identifying the risks, the opportunities were also considered in all cases.
The project studied in case 3 reached a mid-range level of benefits. Regardless of the project's high level of innovativeness and medium-high level of project management complexity, no PRM roles were assigned, no internal procedures were followed and no PRM training was conducted, indicating a poor level of organization in both cases. The risk analysis was performed sketchily, and there were issues during the “go-live” phase of the project. According to the project manager, “PRM has to be well implemented, otherwise the time dedicated to it will be a waste”. Therefore, in this case, PRM was adopted, and the results were positive, but it is likely that with a better PRM approach, the project would have obtained higher benefits. Given the specific characteristics of the case and the impossibility of replicating the results, this project was not clustered.
Figure 4 summarizes the characteristics of the clusters obtained.
Comparing the benefits graphs in Figure 4, it could be concluded that the main difference between group 1 (very high level of benefits) and groups 2a and 2b (high level of benefits) is a better decision-making process in the first group. This feature, together with the PRM knowledge of the people involved in the project, led to a better project control (budget, project performance and lower risk impact). On the other hand, the evaluation of budget reserve does not seem to be significantly impacted by PRM, being the lowest perceived benefit in all the groups. A deeper analysis of these differences is discussed in the next section.
From the analysis of the cases, it can be noted that some common features of PRM adoption are aligned with the results of previous literature. Firstly, in the study of Vacík et al. (2018), 96% of the analysed companies carried out the RM process in a qualitative way, which indicates that usually no quantitative methods are used. This tendency was confirmed in this research since in all the studied cases the risk analysis was only qualitative. Secondly, many studies about PRM in SMEs, as the ones of Sharif and Rozan (2010) and of Pereira et al. (2015), state that RM is generally carried out in person by the project manager due to the high cost of the tool and the need for qualified staff to operate it. Also, this statement was confirmed, as in all 10 cases, the project manager was responsible for the PRM implementation and simple tools were used. Moreover, according to Pellerin and Perrier (2019), one of the biggest issues in performing PRM is the lack of systematic risk identification methods for specific project types based on lessons learned from similar projects. In most of the cases considered in this study, no meetings to discuss the lessons learned were held, and therefore no methods for systematic risk analysis were created. Nevertheless, it is expected that the indications that emerged from this study – about tools and activities to be performed during the risk identification phase and the following PRM phases – can be relevant to developing structured and efficient PRM adoption in SMEs.
Besides the findings confirmed by literature, other common characteristics emerged from the analysis of the 10 cases:
only technical-operative risks were considered and identified in all projects;
all PRM phases were followed, but in two cases the risk analysis phase was not fully implemented;
the risk matrix and risk mitigation tools were used in the risk analysis and in the risk treatment phases, respectively, and the risk revaluation activity was performed during the risk monitor and control phase and
when analysing the context in which the projects were developed, it has emerged that all of them had either a very high strategic relevance or a high level of innovation.
As for the PRM organization, the combination of assigning roles in the PRM process, adopting internal procedures and identifying the risk owner is a distinctive feature of the first cluster, in which all projects have achieved very high benefits. In cluster 2a, the roles were not assigned, and no internal procedures were adopted, but there was a consultant with PRM experience, which led these projects to obtain a high level of benefits. Therefore, the identification of the risk owner and the identification of internal PRM procedures, or the involvement of a PM consultant with PRM experience, seem to be necessary aspects to ensuring PRM adoption. In the cases in which there was not a minimum level of knowledge about PRM, the project managers have asked for external support. However, the best option is still to have the knowledge inside the company: in cluster 1, the PRM knowledge was internal; in cluster 2a, it was external and in cluster 2b, it was internal but less consolidated that in the cases of the first cluster.
Regarding the project risks, in cluster 2b, the collaboration of other functional areas with the PRM team led to the consideration of more project risk types. In particular, three types of risk were considered in these projects, indicating a more comprehensive approach of the project context since more functional areas were involved in the PRM team in these cases. It can also be assumed that the service industry, in which all projects of this cluster exist, is more aware of the context of the project than the manufacturing industries, due to the higher involvement of the project stakeholders.
In manufacturing projects in which the strategic relevance was not very high (cluster 2a), only technical-operative risks were considered, while in cluster 1 (manufacturing cases with very high strategic relevance), the organizational risk types, which include lack of competence of the people involved in the process, were also taken into consideration. Therefore, in manufacturing projects, technical operative risks are the primary risks, but if they are strategically relevant, organizational risks must also be considered.
Another positive result from the PRM process is that in clusters 2a and 2b, the opportunities are also being considered, indicating a more comprehensive approach towards risks.
Several differences were identified among the clusters also when analysing the PRM process phases. The studied literature indicates that PRM must be continuous throughout the project's lifecycle in order to be successful, which is confirmed in the cases.
During the risk identification phase of the Spanish projects' implementation (clusters 1 and 2a), many meetings were held, and the risks were constantly measured. In most of these cases, PRM was stimulated by the government, which has facilitated its adoption since the project managers had to deliver to the government a report about the project evolution every six months. During this phase, cluster 2a was the one in which the projects had more activities in common among them (context analysis, risk identification and stakeholder analysis).
Meetings and measurement of risk probability of occurrence, as well as effects based on feelings, were adopted by the manufacturing clusters (1 and 2a) during the risk analysis phase. Risk prioritization and the constant measurement of risks were important to achieving the highest level of benefits (cluster 1). The risk matrix was used in this phase in all cases and served as a basis for risk prioritization in cluster 1.
During the risk treatment phase, two tools were used in the manufacturing clusters: risk mitigation and risk avoidance. In some cases, instead of risk avoidance, the risk retention tool was used. In cluster 2b, only the risk mitigation tool was adopted. Except for the risk revaluation activity in the risk monitor and control phase, in the projects of clusters 2a and 2b, additional activities common to all projects inside the cluster were followed.
The interviewees reported they intend to adopt PRM in the future projects of the company; in cluster 2a in particular, project innovativeness will be the trigger for PRM adoption in future projects.
Regarding the hindering and enabling factors for PRM adoption, the support inside the company to conduct the PRM process and the client cooperation – when needed – are considered crucial factors for successful PRM implementation. In the projects of cluster 1, the company's higher-level management did not interfere in the project managers' decisions about PRM, so the interviewees have not felt any hindering factors during the PRM adoption. Significant hindering factors include the lack of information about the service to be provided or about the technical specifications of the process that are needed to develop a product.
The indications about activities, tools and organizational aspects that enable the effective implementation of PRM in SMEs in different industries represent a significant contribution to the literature of PRM in SMEs since none of the previously published papers have provided this result.
This paper also contributes to informing SMEs that by adopting PRM, they can achieve a positive balance between the risks assumed and the expected benefits, as demonstrated by the 10 cases analysed. As is stated in the PMI (2017), all projects involve associated risks, the positive side of which allows them to achieve specific benefits. The adoption of PRM has always contributed to the project success of the cases considered, confirming that PRM is positively related to PM performance, as is indicated by Fernando et al. (2018).
Figure 5 displays a comparison among the clusters according to the variables related to PRM and the benefits obtained.
Given the socio-economic importance of SMEs and their need to manage risks to assure project success, this research aims to investigate how to adopt PRM in SMEs with a positive cost–benefit ratio, considering RM phases, activities, tools and organizational aspects that enable the effective implementation of PRM in SMEs.
In order to pursue this objective, a multiple-case study was conducted, analysing 10 cases in Italy and Spain. Three clusters were eventually identified, revealing information about how to implement PRM in SMEs to achieve a high or very high level of benefits, considering different project characteristics and contexts.
The average complexity and innovation of the cases adopting PRM were high since higher project complexity implies higher risks, regardless of the type of industry.
The results obtained through the case studies confirm the literature indicating that SMEs need PM models that are less bureaucratic, with different versions of PRM depending on the characteristics of the project to facilitate its implementation.
From a managerial point of view, the findings offer practical information about PRM phases, activities, tools and organizational aspects to be considered in different types of industries and project complexities for its successful implementation.
Additionally, national and local governments can benefit from this research, taking advantage of the experience of the Spanish government that holds a prominent role in the adoption of PRM in SME projects, requiring periodical reports to financially support the projects.
Thanks to these results, it is possible to increase the diffusion of PRM in SMEs since they can be useful in other projects, thereby promoting the knowledge about and adoption of PRM.
From an academic point of view, this research confirmed the validity of an empirical framework specifically developed by Lima and Verbano (2019) to analyse PRM in SMEs and offers ten new cases to the scant literature devoted to SMEs. In addition, the findings obtained from the cases studied allow to outline the framework displayed in Figure 6, highlighting the relations among the main constructs. In particular, project features (technology and market innovativeness, strategic relevance, managerial complexity and commitment type) and firm characteristics (sector, production system and public incentives available) have an influence on the adoption of PRM, referring to the following main components (organization, risks and opportunities considered, planning, activities, tools, enabling and hindering factors).
Furthermore, PRM adopted led to different type and level of outcomes and benefits, as emerged in the three clusters analysed. Project dimension and firm dimension, on the contrary, seem not to influence PRM adoption and its benefits.
Finally, as reported in Figure 7, experience, PM and RM knowledge emerged as enabling factors for a successful PRM implementation; on the other side short time for PRM, lack of technical knowledge and information are the hindering factors.
These findings could support further research in PRM in SMEs, confirming and exploiting the knowledge of this emerging topic and its diffusion. Particularly, this study was not focussed specifically on the relations among the main constructs of the framework that could be examined considering the impact of every single dimension on the others, giving a deeper and specific knowledge on how to implement successfully PRM in SMEs.
Other future studies could be conducted from the starting point of the other limitations of this research: the data collection could be conducted with more than two respondents for each project (if feasible), the sample could be increased to also consider other industrial contexts, other countries and specific project characteristics, so as to expand the validity of this research and the information obtained so far. In addition, a large sample could allow statistical analysis to be performed with a greater possibility of generalization of the obtained results.
Moreover, further research is required to measure the benefits achieved from PRM in a more objective way. It is assumed in the PMBoK that PRM creates value for project outcomes, thereby increasing the probability of project success and strategic benefits (Willumsen et al., 2019). However, at the moment, there is a very scant literature considering the value of PRM, and no objective measures are available, except the ones regarding the costs, time and quality of the projects. This study offers the identification of the dimensions of PRM benefits, but future studies are needed to refine their measurement.
In conclusion, this research offers an academic and managerial contribution to the emerging topic of PRM in SMEs, which influences the development and sustainability of SME projects and, consequently, the economic growth of many countries' economies.
Overview of the selected projects
|Country||Size*||Industrial sector||Production system||Client||Length [months]||Total cost [€]||Team [number]||Total number (number of respondents)|
|1||Italy||Small||IT consultancy||Project||External||7||60.000||7||5 (3)|
|3||Italy||Medium||IT consultancy||Project||External||3||33.500||6||3 (2)|
|4||Spain||Micro||Manufacturing (automotive)||Project||Internal||24||300.000||5||3 (2)|
|5||Spain||Small||Manufacturing (machining)||Process||Internal||18||240.000||5||3 (2)|
|6||Spain||Medium||Manufacturing (truck bodies)||Process||Internal||12||330.000||6||3 (2)|
|7||Spain||Micro||Manufacturing (long boards)||Process||External||12||40.000||5||3 (3)|
|8||Spain||Small||Manufacturing (cellulose insulation)||Process||Internal||11||95.000||4||2 (2)|
|9||Spain||Medium||Management consulting||Project||Internal||24||500.000||3||3 (2)|
|10||Spain||Medium||Manufacturing (tower cranes)||Process||Internal||25||NA||15||4 (3)|
Note(s): *The company's size classification follows the indications of OECD (2012): micro (less than 10 employees), small (10–49 employees) and medium (50–250 employees)
Main findings regarding project innovativeness, PRM organization and evidences
|Case 1||Case 2||Case 3||Case 4||Case 5||Case 6||Case 7||Case 8||Case 9||Case 10|
|Organizational aspects||Responsible for PRM||PM||PM||PM||PM||PM||PM||PM||PM||PM||PM|
|People involved in the PRM process||PM and his assistant in all phases, and the sales rep. in phases 1,2 and 4 also||PM and area managers||PM, project architect and PM consultant||CEO and PM consultant||CEO and PM consultant||technical director and PM consultant||team and PM consultant||CEO and PM consultant||PM and innovation manager||PM|
|Roles in PRM clearly assigned||Yes||Yes||No||Yes||Yes||Yes||Yes||No||Yes||Yes|
|Internal PRM procedures adopted in the project||Yes||No||No||Yes||Yes||Yes||Yes||No||Yes||Yes|
|PRM training plan for the people involved in the project||Yes||No||No||No||No||No||Yes||No||No||No|
|Case 1||Case 2||Case 3||Case 4||Case 5||Case 6||Case 7||Case 8||Case 9||Case 10|
|Innovativeness level||Project technologic innovativeness||5||2||4||5||4||4||5||4||5||3||4.1|
|Innovativeness for the market||2||2||2||5||4||4||5||4||5||3||3.6|
|Project management complexity||3||5||4||4||4||3||3||3||4||2||3.5|
|Perceived benefits||Greater probability of project success||5||5||3||5||4||4||5||5||4||5||4.5|
|Increased external client's trust||5||5||3||–||–||–||5||–||–||–||4.5|
|Better decision-making process||3||4||–||5||3||4||5||4||4||5||4.1|
|Lower risk impact||4||4||3||5||4||4||4||3||5||5||4.1|
|Better project planning||5||3||3||4||4||4||5||4||4||4||4.0|
|Better budget control||2||4||3||5||4||4||4||4||5||–||3.9|
|Better project performance||4||5||3||5||4||4||4||2||3||4||3.8|
|Better evaluation of budget reserve||2||4||–||3||3||3||4||4||–||3.3|
|Case 1||Case 2||Case 3||Case 4||Case 5||Case 6||Case 7||Case 8||Case 9||Case 10|
|PRM evidences||PRM implementation time/cost||€ 3.000||€ 4.000||€ 3.000||€ 10.000||€ 19.000||€ 9.000||€ 2.000||€ 3.000||€ 7.000||25 man-days|
|Time/cost justified by the benefits||Yes||Yes||Yes||Yes||Yes||Yes||Yes||Yes||Yes||Yes|
|PRM useful in the project||Yes||Yes||Yes||Yes||Yes||Yes||Yes||Yes||Yes||Yes|
|Types of projects to adopt PRM||All||All||New client; high visibility projects ; projects with innovative||The ones that may generate strategic risks for the company||All the innovative ones||All that involve a new product design and the ones with a||All||All||All; if not possible, at least the strategic ones||All|
Ackermann, F., Eden, C., Williams, T. and Howick, S. (2007), “Systemic risk assessment: a case study”, Journal of the Operational Research Society, Vol. 58 No. 1, pp. 39-51.
APM (2004), Directing Change – A Guide to the Governance of Project Management (GoPM), APM Publishing, London.
Aven, T. (2016), “Risk assessment and risk management: review of recent advances on their foundation”, European Journal of Operational Research, Vol. 253 No. 1, pp. 1-13.
Blanc Alquier, A.M. and Lagasse Tignol, M.H. (2006), “Risk management in small-and medium-sized enterprises”, Production Planning and Control, Vol. 17 No. 3, pp. 273-282.
Borge, D. (2002), The Book of Risk, John Wiley and Sons, New York.
Dallago, B. and Guglielmetti, C. (Eds) (2012), The Consequences of the International Crisis for. European SMEs: Vulnerability and Resilience, Routledge, Abingdon.
de Araújo Lima, P.F., Crema, M. and Verbano, C. (2020), “Risk management in SMEs: a systematic literature review and future directions”, European Management Journal, Vol. 38 No. 1, pp. 78-94.
de Camprieu, R., Desbiens, J. and Feixue, Y. (2007), “‘Cultural’ differences in project risk perception: an empirical comparison of China and Canada”, International Journal of Project Management, Vol. 25 No. 7, pp. 683-693.
Dey, P.K. (2012), “Project risk management using multiple criteria decision-making technique and decision tree analysis: a case study of Indian oil refinery”, Production Planning and Control, Vol. 23 No. 12, pp. 903-921.
Eisenhardt, K.M. (1989), “Building theories from case study research”, Academy of Management Review, Vol. 14 No. 4, pp. 532-550.
Eisenhardt, K.M. and Graebner, M.E. (2007), “Theory building from cases: opportunities and challenges”, Academy of Management Journal, Vol. 50 No. 1, pp. 25-32.
Elkington, P. and Smallman, C. (2002), “Managing project risks: a case study from the utilities sector”, International Journal of Project Management, Vol. 20 No. 1, pp. 49-57.
Fernando, Y., Walters, T., Ismail, M.N., Seo, Y.W. and Kaimasu, M. (2018), “Managing project success using project risk and green supply chain management: a survey of automotive industry”, International Journal of Managing Projects in Business, Vol. 11 No. 2, pp. 332-365.
Hsieh, H.F. and Shannon, S.E. (2005), “Three approaches to qualitative content analysis”, Qualitative Health Research, Vol. 15 No. 9, pp. 1277-1288.
Hwang, B.G., Zhao, X. and Toh, L.P. (2014), “Risk management in small construction projects in Singapore: status, barriers and impact”, International Journal of Project Management, Vol. 32 No. 1, pp. 116-124.
ISO 21500 (2012), Guidance on Project Management, International Organization for Standardization, available at: https://www.iso.org/standard/50003.html.
ISO 31000 (2018), Principles and Generic Guidelines on Risk Management International, International Organisation for Standardisation, available at: https://www.iso.org/standard/65694.html.
Joslin, R. and Müller, R. (2015), “Relationships between a project management methodology and project success in different project governance contexts”, International Journal of Project Management, Vol. 33 No. 6, pp. 1377-1392.
Kim, Y. and Vonortas, N.S. (2014), “Managing risk in the formative years: evidence from young enterprises in Europe”, Technovation, Vol. 34 No. 8, pp. 454-465.
Lam, T.T., Mahdjoubi, L. and Mason, J. (2017), “A framework to assist in the analysis of risks and rewards of adopting BIM for SMEs in the UK”, Journal of Civil Engineering and Management, Vol. 23 No. 6, pp. 740-752.
Lima, P.F.D.A. and Verbano, C. (2019), “Project risk management implementation in SMEs: a case study from Italy”, Journal of Technology Management and Innovation, Vol. 14 No. 1, pp. 3-10.
Lin, L., Müller, R., Zhu, F. and Liu, H. (2019), “Choosing suitable project control modes to improve the knowledge integration under different uncertainties”, International Journal of Project Management, Vol. 37 No. 7, pp. 896-911.
Liu, J., Meng, F. and Fellows, R. (2015), “An exploratory study of understanding project risk management from the perspective of national culture”, International Journal of Project Management, Vol. 33 No. 3, pp. 564-575.
Marcelino-Sádaba, Pérez-Ezcurdia, A., Lazcano, A.M.E. and Villanueva, P. (2014), “Project risk management methodology for small firms”, International Journal of Project Management, Vol. 32 No. 2, pp. 327-340.
Miles, M.B., Huberman, A.M., Huberman, M.A. and Huberman, M. (1994), Qualitative Data Analysis: An Expanded Sourcebook, Sage, Thousand Oaks.
Myers, M. (2000), “Qualitative research and the generalizability question: standing firm with Proteus”, The Qualitative Report, Vol. 4 No. 3, p. 9.
Moeuf, A., Lamouri, S., Pellerin, R., Tamayo-Giraldo, S., Tobon-Valencia, E. and Eburdy, R. (2020), “Identification of critical success factors, risks and opportunities of industry 4.0 in SMEs”, International Journal of Production Research, Vol. 58 No. 5, pp. 1384-1400.
Naude, M.J. and Chiweshe, N. (2017), “A proposed operational risk management framework for small and medium enterprises”, South African Journal of Economic and Management Sciences, Vol. 20 No. 1, pp. 1-10.
Neves, S.M., da Silva, C.E.S., Salomon, V.A.P., da Silva, A.F. and Sotomonte, B.E.P. (2014), “Risk management in software projects through knowledge management techniques: cases in Brazilian incubated technology-based firms”, International Journal of Project Management, Vol. 32 No. 1, pp. 125-138.
Nguyen, L.D., Chih, Y.Y. and García de Soto, B. (2017), “Knowledge areas delivered in project management programs: exploratory study”, Journal of Management in Engineering, Vol. 33 No. 1, 04016025.
Oduoza, C.F., Odimabo, O. and Tamparapoulos, A. (2017), “Framework for risk management software system for SMEs in the engineering construction sector”, Procedia manufacturing, Vol. 11, pp. 1231-1238.
OECD (2012), Financing SMEs and Entrepreneurs 2012, AnOECD Scoreboard, Paris.
Pellerin, R. and Perrier, N. (2019), “A review of methods, techniques and tools for project planning and control”, International Journal of Production Research, Vol. 57 No. 7, pp. 2160-2178.
Pereira, L., Tenera, A., Bispo, J. and Wemans, J. (2015), “A risk diagnosing methodology web-based platform for micro, small and medium businesses: remarks and enhancements”, Communications in Computer and Information Science, Vol. 454, pp. 340-356.
PMI (2017), A Guide to Project Management Body of Knowledge: PMBoK Guide, 6th ed., Project Management Institute, Newtown Square, PA.
Portman, H. (2009), PRINCE2™ in Practice, Van Haren Publishing, s-Hertogenbosch, NL.
Pritchard, C.L. and PMP, P.R. (2014), Risk Management: Concepts and Guidance, Auerbach Publications, Boca Raton, FL.
Qazi, A., Quigley, J., Dickson, A. and Kirytopoulos, K. (2016), “Project complexity and risk management (ProCRiM): towards modelling project complexity driven risk paths in construction projects”, International Journal of Project Management, Vol. 34 No. 7, pp. 1183-1198.
Raz, T. and Michael, E. (2001), “Use and benefits of tools for project risk management”, International Journal of Project mMnagement, Vol. 19 No. 1, pp. 9-17.
Rodney, E., Ducq, Y., Breysse, D. and Ledoux, Y. (2015), “An integrated management approach of the project and project risks”, IFAC-PapersOnLine, Vol. 48 No. 3, pp. 535-540.
Rostami, A., Sommerville, J., Wong, I.L. and Lee, C. (2015), “Risk management implementation in small and medium enterprises in the UK construction industry”, Engineering, Construction and Architectural Management, Vol. 22 No. 1, pp. 91-107.
Sanchez-Cazorla, A., Alfalla-Luque, R. and Irimia-Dieguez, A.I. (2016), “Risk identification in megaprojects as a crucial phase of risk management: a literature review”, Project Management Journal, Vol. 47 No. 6, pp. 75-93.
Sharif, A.M., Basri, S. and Ali, H.O. (2013), “A study on SME software development background and risk assessment implementation in Malaysia”, World Applied Sciences Journal, Vol. 26 No. 12, pp. 1637-1642.
Sharif, A.M. and Rozan, M.Z.A. (2010), “Design and implementation of project time management risk assessment tool for SME projects using oracle application express”, World Academy of Science, Engineering, and Technology (WASET), Vol. 65, pp. 1221-1226.
Taherdoost, H., Keshavarzsaleh, A. and Wang, C. (2016), “A retrospective critic re-debate on stakeholders' resistance checklist in software project management within multi-cultural, multi-ethnical and cosmopolitan society context: the Malaysian experience”, Cogent Business and Management, Vol. 3 No. 1, 1151116.
Tang, L.C.M., Leung, A.Y.T. and Wong, C.W.Y. (2009), “Entropic risk analysis by a high level decision support system for construction SMEs”, Journal of Computing in Civil Engineering, Vol. 24 No. 1, pp. 81-94.
Teller, J. and Kock, A. (2013), “An empirical investigation on how portfolio risk management influences project portfolio success”, International Journal of Project Management, Vol. 31 No. 6, pp. 817-829.
Tong, A., Sainsbury, P. and Craig, J. (2007), “Consolidated criteria for reporting qualitative research (COREQ): a 32-item checklist for interviews and focus groups”, International Journal for Quality in Health Care, Vol. 19 No. 6, pp. 349-357.
TSO (2009), Directing Successful Projects with Prince 2, The Stationery Office, Norwick.
Tupa, J., Simota, J. and Steiner, F. (2017), “Aspects of risk management implementation for industry 4.0”, Procedia Manufacturing, Vol. 11, pp. 1223-1230.
Turner, R., Ledwith, A. and Kelly, J. (2010), “Project management in small to medium-sized enterprises: matching processes to the nature of the firm”, International Journal of Project Management, Vol. 28 No. 8, pp. 744-755.
Vacík, E., Špaček, M., Fotr, J. and Kracík, L. (2018), “Project portfolio optimization as a part of strategy implementation process in small and medium-sized enterprises”, Economics and Management, Vol. 21 No. 3, pp. 107-123.
Voss, C., Tsikriktsis, N. and Frohlich, M. (2002), “Case research in operations management”, International Journal of Operations and Production Management, Vol. 22 No. 2, pp. 195-219.
Willumsen, P., Oehmen, J., Stingl, V. and Geraldi, J. (2019), “Value creation through project risk management”, International Journal of Project Management, Vol. 37 No. 5, pp. 731-749.
Xia, N., Zou, P., Griffin, M.A., Wang, X. and Zhong, R. (2018), “Towards integrating construction risk management and stakeholder management: a systematic literature review and future research agendas”, International Journal of Project Management, Vol. 36 No. 5, pp. 701-715.
Yin (2009), Case Study Research: Design and Methods, 4th ed., Sage, Thousand Oaks, California.
This work was supported by the University of Padova under Grant VERB_SID19_01.