Risk Planning and Management in Portuguese Companies—A Statistical Approach

Abstract

The purpose of this article is to study risk management planning and risk management in Portuguese companies. The methodology used is of a quantitative nature, based on a questionnaire survey that analyzes the risk management planning and risk management of 1647 Portuguese companies from different sectors of activity. The results allow us to conclude that the aspects that most manifest themselves in the perceptions of risk management planning are having a management plan that includes the relationship with customers, suppliers, and employees, as well as an updated security plan. This study intends to contribute to academic knowledge and for companies to know and master the concepts of risk management planning and risk management in its different aspects, helping the adoption of strategies to better plan risk management. The results make it possible to understand the differences in planning and risk management between larger and smaller companies, between older and younger companies, and between family and non-family companies. These results can contribute to increasing corporate sustainability and improving performance in planning and managing corporate risks.

1. Introduction

Risk management planning and risk management are inherent to business activity, being a consequence of business demands, the market, changes in companies, and the environment that surrounds them, which is characterized by planning and managing a set of variables or events with business relevance. The importance of the issue of risks has increased, and with globalization, the importance of risk management in supply chains has also increased (Hristov et al. 2022). External risk factors may arise from economic changes, financial market development, policies followed in countries, changes in laws, the technological environment, and demography (Hristov et al. 2022; Kalina et al. 2022). An economic–financial crisis, in general, significantly changes the views of risk management in companies, trying to eliminate the negative impacts of different types of risk on the company’s economic results (Dvorsky et al. 2021). On the other hand, internal risks include human error, fraud, system failure, and production interruptions, among other risks (Hristov et al. 2022; Kalina et al. 2022).

For Alviniussen and Jankensgard (2009), in principle, a company’s capacity to respond to risk increases with (1) an increase in the number of liquid assets (e.g., cash and equivalents), (2) the possibility of increasing indebtedness, and (3) hedging positions. Given this view, the lower the risk capacity of the company, the greater the possibility that the company will incur negative consequences due to its low cash flow. Although there is a perception of risk on the part of the chief executive officers (CEOs) of companies, when there are technological changes, they understand that the perceived utility is greater, as there is a reduction in costs and greater flexibility (Ferri et al. 2021). In particular, technical risks and organizational risks have a greater impact than most other risks.

According to Tavares et al. (2016), in Portugal, there are a large number of companies that believe in risk management and planning, and risk is understood as an intrinsic characteristic of business activity. On the other hand, Zwikael and Ahn (2011) found a higher level of risk management planning in cultures with higher levels of uncertainty avoidance (e.g., New Zealand) and in industries with higher levels of project maturity (e.g., engineering). Tavares et al. (2016) believe that although there is a greater tendency towards the downside of risk, Portuguese small and medium-sized enterprises (SMEs) have a modern view of risk, being able to interpret it as a window of opportunities. Thus, the authors consider that risk management is a process of planning, organizing, directing, and controlling resources to achieve the desired objectives, in a context in which unforeseen events (in a positive or negative sense) may occur. Mikes (2009) notes that in the financial services sector, enterprise risk management (ERM) is thought to comprise a set of risk practices that encompass such a wide range of techniques as the value of risk, economic capital models, and qualitative methods for non-financial risks. For all its potential benefits, Alviniussen and Jankensgard (2009), understand that ERM may not capture some aspects related to the company’s total risk—that is, the risk that the company does not meet important objectives, such as the implementation of its investment plan, the need to take precautions with customer debt clauses, or maintaining high levels of credit granted. Fraser and Simkins (2016) believe that in any organization that has successfully implemented ERM, the management team will consider it essential for the continued smooth functioning of management and security. Dey et al. (2013) observed that the main factors for the implementation of enterprise resource planning (ERP) are the commitment of the company’s management, the selection of adequate systems, and the adequate selection of their integration with the existing information systems. Dittfeld et al. (2020) believe that managers need to know their business environment, to be able to adjust the sales and operations planning (S&OP) for the needs of the organization and keep the focus on their risk. Also, according to the same authors, organizations must customize themselves to work in different ways to manage risk, in addition to analyzing scenarios.

There are multiple studies on business risks and their management; however, there are still gaps in the knowledge. Therefore, the studies are not unanimous regarding the differences in risk management between larger and smaller companies, between older and more recent companies, and even between family and non-family businesses. This work aims to study risk management planning and risk management in Portuguese companies and is structured into five sections. After this introduction, the literature review follows, where the topics of risk management and the impacts of crises and disasters on risk management are reviewed. Subsequently, the methodology section is presented, followed by the presentation of the results and their discussion. Finally, the conclusions are presented.

2. Literature Review

2.1. Risk Management

Risk can be understood as uncertainty, either regarding the probability of the occurrence of certain facts that may directly or indirectly affect the company, or regarding the moment when such facts may manifest themselves (Verbano and Venturini 2013). Zwikael and Ahn (2011) found that risk management practices moderate the effect of project risk, and this has an impact on project success and multiple possible project scenarios. Although risk levels reduce project performance, planning management moderates this relationship. However, risk can also mean challenge, and it is in this sense that risk can be understood more as a choice than a fatality, a fate, or a destiny. SMEs need fewer bureaucratic project management models and different versions of project risk management, in order to facilitate their implementation (Lima et al. 2021).

For Tavares et al. (2021), strategic planning is essential for the company. The company must present a competitive strategic formulation, combining the company’s efficiency with the exploitation of the environment in which it operates. In this way, by exploiting competitive advantages, companies succeed, and it is necessary to have a clear vision of the changes at an economic, social, and political level, which are taking place in the ecosystem where they are inserted.

Bhuiyan et al. (2021) concluded that an autonomous risk management body in companies not only reduces the taking of corporate risks but also increases the value of the company.

Mehrjerdi (2010) stated that the best management of a system is related to the full knowledge of the technologies implemented in the system under consideration, providing sufficient resources for the company’s resource planning. Enterprise risk management (ERM) provides the methods and processes that are used by companies to manage all risks to take advantage of opportunities to achieve their goals (Hristov et al. 2022).

According to Zwikael and Ahn (2011), sometimes there are high-risk projects that are completed more successfully than projects with a low level of perceived risk. Zwikael and Ahn (2011) also found that the environmental context determines the project’s perceived risk level. Thus, Zwikael and Ahn (2011) concluded that the level of perceived risk and, therefore, risk management planning, is lower in countries characterized by low levels of uncertainty (e.g., Japan), low levels of cultural diversity, and in industries with immature project management practices.

The study by Dey et al. (2013) showed that process management in ERP, together with information technology management and organizational transformation management, makes the implementation of ERP projects more successful. For Dey et al. (2013), the success of ERP implementation is partially related to the fact that stakeholders understand and effectively carry out their ongoing responsibilities in the project.

Van Wyk et al. (2004) understand that risk management requires the identification of specific risks and their adverse impacts on different businesses. For Van Wyk et al. (2004), the uncertainties of many sectors challenge managers to control the specific risks of industries and companies more effectively.

Alviniussen and Jankensgard (2009) are of the opinion that, in enterprise risk management (ERM), the company undertakes to carry out a comprehensive mapping of its risk exposures and aggregate them into a corporate-level risk portfolio. In the authors’ opinion, this breaks with the closed and traditional forms of risk management, in which each risk category is managed in a departmental way—that is, independently of other risks in the company. Fraser and Simkins (2016) concluded that numerous works show that the successful implementation of ERM is achieved with committed company management and following the advice of regulators. According to Alviniussen and Jankensgard (2009), for the company to frame the total risk, the company needs to frame and define the concepts and quantify its risk capacity—that is, define a level that allows the company to survive in case there are worst-case events and scenarios.

Wu et al. (2014) concluded that business intelligence models are being applied in risk management contexts around the world and have proven to be effective for more than half a century. Historically, risk management was viewed very narrowly and treated separately (Fraser and Simkins 2016). Risk management in companies should be seen in an integrated way, and owners must improve the management of strategic risk in their businesses (Krüger and Meyer 2021).

Baz and Ruel (2021) concluded that companies need to develop good practices of supply chain risk management (SCRM) to improve their robustness and the level of the supply chain (SC) and its resiliency. However, in the understanding of Baz and Ruel (2021), looking at the impacts of COVID-19 on the performance of companies and their financial capacities, not all may have the resources and capacities to do so. Norrman and Wieland (2020) noted that Ericsson has developed its own SCRM practices, first formulating and improving its processes and tools for the function (knowledge-based techniques and capabilities) within the sourcing, supply, and security functions, but also matching inter-functionality. For Norris et al. (2021), the adoption of a rational view changes the origin of a company’s value creation, emphasizing supply chains. Norrman and Wieland (2020) noted that processes were formalized over time and reinforced by corporate governance, in which projects are aligned with existing ones, which allows the development of SCRM.

For Bogodistov and Wohlgemuth (2017), the inclusion of risk management at both the strategic and operational levels makes the concept more dynamic and more precise. According to Mikes (2009), innovations in ERM techniques (in the financial sector) are increasingly grouped into four themes: risk quantification, risk aggregation, performance based on risk measurement, and non-quantifiable risk management.

According to Bogodistov and Wohlgemuth (2017), the concept of dynamic ERM capability, in addition to incorporating dozens of years of experience with a very recent holistic perspective, adds insights based on resources, providing professionals with a clear view of properties for the implementation of the ERM. Mikes (2009), in his work on the financial sector, found that in relation to the two banks studied, each one had a specific risk management mix for itself. For Bogodistov and Wohlgemuth (2017), managers should keep in mind that not all risks can be predicted or managed.

2.2. Impacts of Crises and Disasters on Risk Management

For Louw and Wyk (2011), it is generally accepted that disasters are having an increasing impact on our lives, whether of a pandemic nature, on people’s assets, or on the environment, infrastructure, and economic and social activities. The literature on management in times of crisis is general in nature and lacks a specific perspective on international business (Santos et al. 2020; Tavares et al. 2020). Louw and Wyk (2011) understand that, after a disaster, it is difficult to quickly determine the exact nature of the impacts and what will be needed to restore the situation or, preferably, to improve the situation, reducing the vulnerability to possible future impacts. It is still important to intervene proactively, before disasters occur, to influence the process by which disaster and operational risks develop due to increased vulnerability, resulting in a diminished capacity to face new challenges (Santos et al. 2022). Xia et al. (2018) therefore suggested that researchers and professionals should be aware of and find approaches so that there is an integrated connection of stakeholder risk management, rather than just isolated management of one of the parties. For Dvorsky et al. (2021), in times of crisis and post-crisis, there are changes in the prioritization of business risks by entrepreneurs, losing some meaning in the way of resolving past risks.

The results of disasters, according to Louw and Wyk (2011), include human suffering and damage to infrastructure resources, on which human survival depends, as well as their quality of life. Dvorsky et al. (2021) identified a positive effect of corporate risk management and entrepreneurs’ attitudes concerning the threat of business failure on the company’s perception of future business. Grondys et al. (2021) noted that, due to the pandemic, the SME sector was hit by increased business risk—especially the risk of default and the inability to pay bondholders. According to the authors, larger entities deal better with risk management, although the size of the entity does not affect the assessment of individual risk intensity. According to Dvorsky et al. (2021), companies are aware of the need for better risk management in the extreme conditions of the crisis and post-crisis period. Corporate governance affects financial performance, as investment efficiency is higher in companies with higher quality of corporate governance. On the other hand, companies with higher risk of financial information disclosure have a lower quality of corporate governance (Tavares et al. 2021). Small and medium-sized enterprises lack planning and risk management standards (Syrová and Špička 2022). While they recognize the importance of risk identification, these companies fail to systematize risk planning and management. The level of risk management implementation increases with the size of the company (Syrová and Špička 2022). Krüger and Meyer (2021) stated that small and medium-sized enterprises tend to plan their risk management only in the short term and neglect the long term.

For Grondys et al. (2021), companies should take steps to plan and prevent or eliminate risks in the event of an economic downturn. According to the explained literature review, the following research hypotheses were formulated:

H1. 

Larger companies present risk management planning, while smaller companies do not.

H2. 

Larger companies have a greater perception of risk management than smaller companies.

2.3. Risk Management Planning

Traditional efforts to improve stakeholder risk management are often undertaken in silos (Xia et al. 2018). Despite this, Xia et al. (2018) proposed integrated risk management planning, intending to create and analyze different alternatives and new ideas to improve the risk management effectiveness of stakeholders. Using a construction industry database, Xia et al. (2018) found four modes of stakeholder engagement: (1) risk management based on stakeholder identification, (2) stakeholder responsibility and skill in the risk management process, (3) management of stakeholder differences in relation to risk and, (4) interrelationship between risk management and its effect on project performance.

Dittfeld et al. (2020) concluded that organizations proactively design their sales and operations planning (S&OP) based on their primary focus of the risk arising from the overall planning environment. So, Dittfeld et al. (2020) understand that the S&OP project allows organizations to proactively carry out risk identification, assessment, treatment, and execution of S&OP; as such, there is a predominant view that planning carried out through scenarios is the only treatment strategy of risk taken into account during the execution of the S&OP.

Kraus et al. (2006) analyzed the impact on the performance of various aspects of strategic planning in SMEs and found that a greater degree of formalization is related to a greater degree of performance and, therefore, the creation of a business. Thus, planning helps to identify risks and opportunities in the market and to take action promptly. Younger companies are more flexible and are led by managers with theoretical knowledge of modern management practices at the risk management level. On the other hand, older companies emphasize traditional management methods, where the concern for risk management is low (Syrová and Špička 2022).

Mihaylov and Zurbruegg (2021) studied succession planning in Australian agribusiness companies, and the results suggest that the use of succession planning is positive and is associated with the use of business plans (i.e., risk management, practices risk management), but that this is true for family businesses with written succession processes. Shen (2018) concluded that when family businesses face succession, diversification can be the solution to lessen family conflicts and preserve the family’s socio-emotional health in the long term. For Mihaylov and Zurbruegg (2021), the adoption of risk management practices is not only sensitive to the type of succession plan, but also, in combination with a formal written plan, associated with superior performance. Gómez-Mejía et al. (2007) concluded that family firms can be both risk-seeking and risk-averse, depending on the context. The authors, using behavioral theory, observed that family firms are willing to take risks to protect their socio-emotional wealth but avoid risky decisions that could exacerbate this risk.

For Norris et al. (2021), in order to add value to the customer, the company must act as a mediator to overcome asymmetric information and different perceptions of value between itself, its suppliers, and its customers. Accordingly, to capture the financial value of the offer, stakeholders in the value chain must create and engage in different profit-sharing mechanisms based on the relative contribution of each to value creation, leading to the creation of profit. The results of the study by Gottardo and Moisello (2017) confirm that family firms have a higher survival probability than non-family firms, due to their greater emphasis on achieving both financial and non-financial goals. Naldi et al. (2007) observed that family firms take risks when engaging in entrepreneurial activities, but they do so to a lesser extent than non-family firms. According to Cressy (2006), risk management planning is more commonly implemented in older companies, primarily due to their possession of more talented human capital.

Mihaylov and Zurbruegg (2021) advised that family SMEs develop formal and written succession plans, as companies with greater acceptance of professional risk management techniques seem less likely to take risks when using succession plans. On the other hand, companies with informal or non-existent succession arrangements may lose some of the benefits of professional performance, even before going through the succession process.

Taking into account what was exposed in the literature review throughout this section, and according to the objectives under study, the following hypotheses were formulated:

H3. 

Older companies attach greater importance to risk management planning than younger companies.

H4. 

Older companies attribute greater importance to risk management than younger companies.

H5. 

There are differences in risk management planning between family and non-family businesses in Portugal.

H6. 

There are differences in risk management between family and non-family businesses in Portugal.

3. Materials and Methods

3.1. Population and Sample

In the present research work, a quantitative methodology was used, based on the application of a questionnaire survey, with the target population being Portuguese companies from different sectors of activity. After eliminating some questionnaires that were not fully completed, the sample was made up of 1647 individual companies.

In data collection, the non-probabilistic method of convenience sampling was used, since the companies were selected for having characteristics that are integrated with the research objectives, for their immediate availability.

The ages of the respondents were between 20 and 82 years old, with an average of approximately 47 years old (SD = 10.52) and a median of 46 years old, which means that 50% of the respondents were 46 years old or younger.

Table 1. Sample characterization.

Variable	Category	n	%
Gender	Men	925	56.2
	Women	722	43.8
Function	Administrator/manager	910	55.3
	Director	271	16.5
	Administrative	466	28.3
Number of employees	Less than 10 employees	545	33.1
	10 to 49 employees	837	50.8
	50 to 249 employees	207	12.6
	More than 250 employees	58	3.5
Sector or area of activity	Commerce	443	26.9
	Services	404	24.5
	Construction	320	19.4
	Industrial	306	18.6
	Tourism	87	5.3
	Transport	52	3.2
	Agricultural	35	2.1
Year of foundation of the company	Less than 15 years	588	35.7
	15 to 25 years	502	30.5
	More than 25 years	557	33.8

shows that for 56.2% (n = 925) of the surveyed companies, men answered the questionnaire. Most responses were obtained from the companies’ administrators or managers (55.3%, n = 910). Concerning the size of the organization in terms of the number of employees, 33.1% (n = 545) had less than 10 employees, 50.8% (n = 837) had 10 to 49, 12.6% (n = 207) had 50 to 249, and 3.5% (n = 58) had 250 or more employees. Regarding the sector or area of activity, 26.9% (n = 443) were from the commerce sector, 24.5% (n = 404) from the services sector, 19.4% (n = 320) from the construction sector, 18.6% (n = 306) from the industrial sector, 5.3% (n = 87) from the tourism sector, 3.2% (n = 52) from the transport sector, and 2.1% (n = 35) from the agricultural sector. From the year the companies were founded, a new variable was obtained, consisting of 35.7% (n = 588) companies with less than 15 years in the market, 30.5% (n = 502) companies with 15 to 25 years in the market, and 33.8% (n = 557) with more than 25 years in the market.

3.2. Measuring Instruments

The instrument used in the present investigation consisted of four parts: characterization of the representatives of the companies that answered the questionnaire (age, gender, and function they perform in the company), characterization of the responding companies (number of employees, sector of activity, and year of foundation of the company), perception of risk management planning, and risk management.

To assess the perception of risk management planning, seven items were used, which are described in detail in Table 1. The items used were adapted from the works of Mehrjerdi (2010), Zwikael and Ahn (2011), and Tavares et al. (2021). In order to study the perception of risk management, five items were used, which are described in detail in

Table 2. Factor loadings matrix of the perception of risk management planning.

	Loadings	M	SD	Sk	Ku	Cronbach’s Alpha If Item Deleted
RMP1. Having a 5-year strategic plan	0.58	3.75	0.91	−0.60	0.26	0.81
RMP2. Having a 1-year operational plan	0.61	4.10	0.78	−1.04	1.89	0.80
RMP3. Having an updated security plan	0.76	4.26	0.62	−0.69	2.02	0.78
RMP4. Having a management plan for the relationship with clients	0.85	4.18	0.61	−0.53	1.64	0.77
RMP5. Having a management plan for the relationship with suppliers	0.85	4.14	0.63	−0.58	1.76	0.77
RMP6. Having a management plan for the short-term relationship with the workers	0.57	3.88	0.88	−0.95	1.05	0.82
RMP7. Having a management plan for the medium- and long-term relationship with the workers	0.72	4.03	0.72	−0.69	1.25	0.79

Source: Own elaboration.

, from the works of Van Wyk et al. (2004) and Fraser and Simkins (2016). To measure the items of the perception of risk management planning and perception of risk management, a 5-point Likert agreement scale was used, where 1 = “I totally disagree” and 5 = “I totally agree”.

3.3. Data Collection and Ethical Procedures

From the literature review carried out, a questionnaire was constructed and subjected to a pre-test, to understand whether all of the questions were perceptible. Five individuals who work in a business context in the area of risk management responded to this pre-test. After this phase, the suggestions proposed by the individuals belonging to the pre-test sample were considered. For the construction of the questionnaire, the Google Forms tool was used, which generated a link that was sent to 44,867 Portuguese companies, through their emails, which were obtained from the SABI (System of Analysis of Iberian Balance Sheets) database. Each email sent began by requesting the company’s participation. Then, it contained a short text defining the objectives of the study and guaranteeing the anonymity and confidentiality of the information provided. Finally, the link was presented, allowing access to the questionnaire, and thanks were given in advance for participating in the study. This data collection process took place between October and December 2020.

3.4. Data Analysis Procedures

After obtaining the answers from the representatives of the companies, a database was built, and in the statistical treatment of the data, the software IBM SPSS Statistics 28 was used. In the initial analysis, the existence of missing cases and outliers was verified. After this analysis, descriptive statistics techniques were used to characterize the respondents and their companies.

The sensitivity of the items was assessed using the coefficients of asymmetry (|Sk| ≤ 3) and flatness (|Ku| ≤ 7), according to indications by Kline (2016). To verify the adequacy of the application of exploratory factor analysis (EFA) to the sample under study, the KMO (Kaiser–Meyer–Olkin) sample adequacy index and Bartlett’s test (p < 0.05) of sphericity (Pestana and Gageiro 2014) were used, with KMO values greater than 0.7 revealing reasonable adequacy of the sample. In the EFA, to extract the factors, the principal components method was used (factor loads with values above 0.50 were considered satisfactory), and to check the minimum number of factors to retain, the Kaiser criterion was used (eigenvalues greater than 1). The reliabilities of the factors were evaluated using the calculation of Cronbach‘s alpha, where values greater than 0.7 were considered acceptable (Hair et al. 2014).

Student’s and Welch’s t-tests were used. In the event that two independent samples were to be compared, Student’s t-test was used, and in the event that more than two independent samples were to be compared, ANOVA or Welch’s test was used in case of violation of the assumption of homogeneity of variances (Marôco 2018).

4. Results and Discussion

4.1. Exploratory Factor Analysis

In Table 2, it can be seen that the seven items related to the perception of risk management planning do not show severe violations of normality (|Sk| ≤ 3 and |Ku| ≤ 7 according to Kline (2016)). For these items, Bartlett’s sphericity test and the KMO index (χ²(21) = 4792.05, p < 0.001, KMO = 0.829) showed good suitability of the sample for the application of EFA (Pestana and Gageiro 2014). The one-dimensional variable relating to the perception of risk management planning explains 51.05% of the total variance and has a Cronbach‘s alpha value of 0.82, which is an indicator of good reliability (Hair et al. 2014). Through the analysis of Cronbach’s alphas, if the item is eliminated, it is verified that all items are important for the perception of risk management planning, since if we delete any of the items it does not improve the reliability classification. Having a management plan that includes the relationship with customers, suppliers, and employees (medium and long term), along with an updated safety plan, are the aspects that most manifest themselves in the perception of risk management planning (higher values of loadings). Still, on the items of the perception of risk management planning, in general terms, it can be stated that, on a scale of 1 to 5, the average levels are above 3.5 points, which allows us to observe that Portuguese companies present a very positive perception of risk management planning. It should be noted that companies consider it very important to have an updated security plan (M = 4.26, SD = 0.62) and to have a customer relationship management plan (M = 4.18, SD = 0.61). These results are in line with the findings of Mehrjerdi (2010), Zwikael and Ahn (2011), Tavares et al. (2021).

Table 3. Factor loadings matrix of the perception of risk management.

	Loadings	M	SD	Sk	Ku	Cronbach’s Alpha If Item Deleted
RM1. Risk management contributes to achieving goals and keeping the normal business functioning	0.77	4.12	0.65	−0.76	2.16	0.73
RM2. Risk management should consider risks as events with a potential negative impact	0.72	4.08	0.71	−0.95	2.25	0.75
RM3. Risk management should consider risks as events with a potential positive impact	0.67	3.91	0.82	−0.98	1.68	0.77
RM4. All of the company’s workers and other interested people should be involved in risk management	0.71	3.90	0.87	−0.94	1.16	0.76
RM5. Risk management should consider all of the company’s activities, areas, and departments.	0.82	4.16	0.71	−0.94	2.14	0.71

Source: Own elaboration.

shows that the items related to the perception of risk management do not show severe violations of normality (|Sk| ≤ 3 and |Ku| ≤ 7 according to Kline (2016)). Given the analysis carried out using Bartlett’s sphericity test and the KMO index (χ² (10) = 2350.02, p < 0.001, KMO = 0.784), the adequacy of the application of the EFA was verified (Pestana and Gageiro 2014). The variable perception of risk management is unidimensional; it explains 54.62% of the total variance, and the Cronbach’s alpha value relative to its five items is 0.78, which is an indicator of adequate reliability (Hair et al. 2014). Cronbach’s alphas, if the item is deleted, show that all items are important for the variable perception of risk management, because if we delete any of the items it does not improve the reliability rating. The risk management perception items, in general terms, show that, on a scale of 1 to 5, the average levels are above 3.5 points, which allows us to observe that Portuguese companies have a very positive perception of risk management. It should be noted that the item “all activities, areas and departments of the company must be considered in risk management” not only registers the highest average level but also manifests itself more (i.e., higher loading value) in risk management. These results are in agreement with the findings of Van Wyk et al. (2004) and Fraser and Simkins (2016).

4.2. Test Hypothesis

In

Table 4. Comparative analysis of the risk management planning between companies with different sizes.

Items	Less than 10 Workers		From 10 to 49 Workers		From 50 to 249 Workers		More than 250 Workers		Welch’s Test
	(n = 545)		(n = 837)		(n = 207)		(n = 58)
	M	SD	M	SD	M	SD	M	SD
RMP1	3.69	0.92	3.69	0.89	4.02	0.89	4.05	0.94	10.44 ***
RMP2	4.06	0.84	4.06	0.74	4.30	0.68	4.29	0.90	8.32 ***
RMP3	4.18	0.64	4.24	0.6	4.50	0.54	4.50	0.66	19.15 ***
RMP4	4.12	0.64	4.16	0.59	4.35	0.57	4.36	0.64	9.79 ***
RMP5	4.09	0.65	4.11	0.61	4.29	0.59	4.36	0.67	8.60 ***
RMP6	3.81	0.92	3.89	0.84	3.98	0.92	4.12	0.90	3.26 *
RMP7	3.96	0.77	4.02	0.70	4.18	0.63	4.24	0.71	7.48 ***

Note: *** p < 0.001 and * p < 0.05. Source: own elaboration.

, we can observe the existence of statistically significant differences in all risk management planning items, and the larger the company, the greater the perception of risk management planning.

By analyzing

Table 5. Comparative analysis of risk management between companies with different sizes.

Items	Less than 10 Workers		From 10 to 49 Workers		From 50 to 249 Workers		More than 250 Workers		Welch’s Test
	(n = 545)		(n = 837)		(n = 207)		(n = 58)
	M	SD	M	SD	M	SD	M	SD
RM1	4.13	0.67	4.08	0.64	4.18	0.67	4.22	0.62	2.04
RM2	4.08	0.70	4.06	0.71	4.14	0.73	4.24	0.76	1.70
RM3	3.90	0.81	3.88	0.81	4.02	0.88	4.03	0.94	1.79
RM4	3.91	0.86	3.90	0.87	3.90	0.89	3.69	0.94	1.01
RM5	4.13	0.74	4.15	0.69	4.28	0.72	4.17	0.65	2.26

Source: own elaboration.

, it appears that there are no statistically significant differences (p > 0.05) in any of the risk management items. Item RM4, which refers to the involvement of all company employees in risk management, shows higher average levels of risk management in smaller companies. In the remaining items, the perception of risk management is greater in larger companies.

In short, through the application of Welch’s test, it can be concluded that there are statistically significant differences in risk management planning (F = 16.75, p < 0.001), which empirically supports Hypothesis 1. Through the application of the Games–Howell multiple comparisons test, we found significant differences in risk management planning between the following groups: less than 10 employees and from 50 to 249 employees (p = 0.000 < 0.001), less than 10 employees and more than 250 employees (p = 0.006 < 0.01), from 10 to 49 employees and from 50 to 249 employees (p = 0.000 < 0.001), and from 10 to 49 employees and more than 250 employees (p = 0.019 < 0.05). As can be seen in the graph in Figure 1, the larger the organization, the greater the importance given to risk management planning. Regarding risk management, there is no statistical evidence to affirm the existence of significant differences between the different dimensions of the organization (F = 1.52, p > 0.05), so Hypothesis 2 is not empirically supported. This observation is in line with the findings of Mihaylov and Zurbruegg (2021).

In

Table 6. Comparative analysis of the risk management planning between the companies’ ages.

Items	Less than 15 Years Old		Between 15 and 25 Years Old		More than 25 Years Old		Welch’s Test
	(n = 588)		(n = 502)		(n = 557)
	M	SD	M	SD	M	SD
RMP1	3.77	0.94	3.69	0.88	3.77	0.90	1.25
RMP2	4.09	0.78	4.06	0.80	4.14	0.77	1.41
RMP3	4.26	0.63	4.21	0.64	4.31	0.58	3.81 *
RMP4	4.18	0.65	4.13	0.60	4.22	0.59	2.52
RMP5	4.13	0.66	4.08	0.63	4.18	0.59	3.54 *
RMP6	3.86	0.91	3.86	0.86	3.93	0.87	1.25
RMP7	4.05	0.74	3.97	0.73	4.06	0.70	2.50

Note: * p < 0.05. Source: own elaboration.

, in relation to risk management planning, we can observe the existence of statistically significant differences only in items RMP3 (F = 3.81, p < 0.05) and RMP5 (F = 3.54, p < 0.05). Thus, younger companies (less than 15 years old) and older companies (over 25 years old) show a greater interest in having an up-to-date security plan and in having a supplier relationship management plan compared to middle-aged companies (from 15 to 25 years old).

Regarding risk management, in

Table 7. Comparative analysis of risk management between the companies’ ages.

Items	Less than 15 Years Old		Between 15 and 25 Years Old		More than 25 Years Old		Welch’s Test
	(n = 588)		(n = 502)		(n = 557)
	M	SD	M	SD	M	SD
RM1	4.13	0.66	4.11	0.66	4.11	0.64	0.17
RM2	4.07	0.76	4.08	0.70	4.10	0.67	0.27
RM3	3.99	0.78	3.83	0.88	3.91	0.81	4.89 **
RM4	3.89	0.87	3.91	0.88	3.90	0.86	0.08
RM5	4.18	0.71	4.14	0.73	4.16	0.70	0.26

Note: ** p < 0.01. Source: own elaboration.

, it can be observed that there are only statistically significant differences in item RM3 (F = 4.89, p < 0.05). Younger companies (less than 15 years old) and older companies (over 25 years old) attach greater importance to considering risks as events with a potential positive impact compared to middle-aged companies (from 15 to 25 years old).

In short, the application of Welch’s test showed that there are statistically significant differences in risk management planning (F = 3.82, p < 0.05), which empirically supports Hypothesis 3. Through the application of the Games–Howell multiple comparison test, we found significant differences in risk management planning between the 15–25 and over 25 age groups (p = 0.016 < 0.05). Concerning risk management, there is no statistical evidence to affirm the existence of significant differences between the various age groups of organizations (F = 0.53, p > 0.05), so Hypothesis 4 is not empirically supported. Analyzing the graph in Figure 2, it can be seen that younger companies (less than 15 years old) and older companies (over 25 years old) have higher average levels of perception of risk management planning and management of risk. The results complement the previous studies of Grondys et al. (2021) and Dvorsky et al. (2021).

In

Table 8. Comparative analysis of risk management planning between family and non-family businesses.

Items	Company Type				t-Test
	Family		Non-Family
	(n = 1090)		(n = 557)
	M	SD	M	SD
RMP1	3.72	0.92	3.79	0.89	1.30
RMP2	4.08	0.79	4.14	0.76	1.57
RMP3	4.24	0.62	4.31	0.61	2.24 *
RMP4	4.16	0.60	4.20	0.64	1.26
RMP5	4.13	0.62	4.15	0.65	0.70
RMP6	3.87	0.87	3.91	0.91	0.98
RMP7	4.01	0.72	4.05	0.73	1.12
PRMP	4.03	0.50	4.08	0.54	1.87

Note: PRMP—perception of risk management planning, * p < 0.05. Source: own elaboration.

, it can be seen that there were no statistically significant differences in risk management planning between family and non-family businesses (t = 1.87, p > 0.05), so Hypothesis 5 is not empirically supported. However, there are significant differences only in items relative to having an up-to-date security plan (t = 2.24, p < 0.05) when comparing family and non-family businesses, with non-family businesses being the ones that attach greater importance to having an up-to-date security plan. In fact, Mihaylov and Zurbruegg (2021) also found that good risk management practices are associated with a combination of a formal and written plan, which together lead to superior performance.

Table 9. Comparative analysis of risk management between family and non-family companies.

Items	Company Type				t-Test
	Family		Non-Family
	(n = 1090)		(n = 557)
	M	SD	M	SD
RM1	4.11	0.66	4.13	0.63	0.46
RM2	4.07	0.71	4.1	0.71	0.83
RM3	3.91	0.84	3.92	0.8	0.13
RM4	3.89	0.9	3.91	0.81	0.29
RM5	4.16	0.72	4.17	0.69	0.34
PRM	4.03	0.57	4.04	0.53	0.54

Note: PRM—perception of risk management. Source: own elaboration.

shows that Hypothesis 6 is not empirically supported, as there is not enough statistical evidence to affirm the existence of significant differences in risk management between family and non-family businesses (p > 0.05). However, when comparing family and non-family businesses, in terms of the sample, non-family businesses attached greater importance to all risk management items. These results complement previous studies by Xia et al. (2018), Dittfeld et al. (2020), Norris et al. (2021).

5. Conclusions

This work aimed to study risk management planning and risk management in Portuguese companies. We concluded that having a management plan that includes the relationship with customers, suppliers, and employees (in both the medium and long term), along with an up-to-date security plan, are the aspects that most manifest themselves in the perception of risk management planning.

The items of the perception of risk management planning and risk management, in general terms, demonstrated high average levels (above 3.5 points on a scale of 1 to 5), which allows us to conclude that Portuguese companies present a very positive perception of risk management planning and risk management.

In risk management, all activities, areas, and departments of the company must be considered. It is a risk management item that registers the highest average level, and this is most manifested in risk management.

In relation to risk management planning, there are statistically significant differences, and the larger the organization, the greater the importance given to risk management planning. Concerning risk management, it was concluded that there were no significant differences between the different dimensions of the organization.

There are statistically significant differences in risk management planning between the various age groups of companies, with younger companies (less than 15 years old) and older companies (over 25 years old) presenting higher average levels of perception of risk management and risk management planning. With regard to risk management, there are no significant differences between the different age groups of the companies. When one intends to compare family businesses with non-family businesses, it can be verified that there are no significant differences in risk management planning and risk management.

This is a pioneering work in Portugal, studying risk management planning and risk management in Portuguese companies. It is believed that this study will be useful for companies to know and master the concepts of risk planning and management and their variables for the state, as a creator of public policies, and for society as a whole, as a way of raising awareness of risks and of adopting possible strategies for better risk management and planning.

In future works, it will be interesting to compare risk management between family and non-family businesses, as well as between the different classifications of companies in terms of size, based on the number of employees.