Dynamics of the Approach to Enterprise Risk Management in the Context of Economic Growth and Global Crises

Abstract

The primary objective of this research is to identify, analyse, and compare the development of risk management approaches adopted by Slovak industrial enterprises in two distinct economic periods: during a phase of economic growth (2019) and during a period of global crises and regional crises with significant global implications, which have had substantial global economic, energy, and security impacts, as well as the increasing intensity of cyber threats affecting enterprises in Slovakia (2022–2023). Emphasis is placed on identifying key factors influencing the effectiveness of risk management implementation, as well as on assessing the use of individual stages of the risk management process in business practice. The research has a quantitative character and consists of two empirical surveys conducted through questionnaire-based data collection. The first survey was carried out in 2019 under conditions of economic growth, while the second was conducted in 2022–2023 in the context of multiple global crises and regional crises, particularly the impacts of the COVID-19 pandemic, the global energy crisis, the military conflict in Ukraine, and increasing cyber threats. The first study obtained 450 valid responses, and the second obtained 390 responses from enterprises operating across various sectors of the private economy in Slovakia. The results of the study confirmed the existence of significant differences in companies’ approaches to risk management depending on the economic context. During the period of economic growth, the main reason for insufficient attention to risks was low staff motivation, with enterprises focusing primarily on risk identification, analysis, and assessment, and less on designing specific mitigation measures. In contrast, during the period of global crises and regional crises, companies’ attitudes shifted, with stronger resistance to implemented measures but, at the same time, increased attention to the development of risk-reduction actions. Neglecting systematic preventive steps increases companies’ vulnerability to crises, which may result in operational, financial, and reputational losses, delayed responses, and a decline in competitiveness. The two-phase nature of the research made it possible to capture the dynamics of managerial behaviour under different economic conditions and to formulate practical recommendations for integrating risk management into both strategic and operational levels of management.

1. Introduction

In the current period, the business environment is facing constant and increasingly complex challenges resulting from dynamic changes in the socio-economic context. The COVID-19 pandemic, the global energy crisis, the military conflict in Ukraine, geopolitical conflicts, and climate change, as well as growing cyber threats, have significantly impacted the functioning of the economy and highlighted the critical need for systematic risk management as an integral part of both strategic and operational business management (Alves et al., 2020; Belas et al., 2021; Gray, 2020; Richter & Wilson, 2020). The negative impacts of these crisis situations affected various sectors of the economy with differing intensity, which largely depended on the socio-economic conditions of individual countries, as well as on the preparedness and flexibility of the enterprises themselves to respond to unforeseen threats. (Mikušová & Horváthová, 2023; Mazzanti et al., 2020). In the context of the increasing complexity of the global economic environment, more and more enterprises are realising the necessity of precise monitoring and evaluation of the impacts of external and internal changes on the fulfilment of their strategic and operational objectives (Gerek & Aydin, 2025). Experiences from recent years, accompanied by frequent crisis phenomena, have led to an increase in bankruptcies and economic fluctuations, which have fundamentally influenced the perception of the need for comprehensive application of risk management as an integral part of organisational management (Sidorova et al., 2022). Gavril et al. (2020), in this context, point out the vulnerability of the European area to external shocks and call for the introduction of innovative approaches and risk management tools that would strengthen the ability of organisations to face similar situations in the future. Risk assessment is thus gradually coming to the forefront of managers’ interest not only in large corporations but also in small- and medium-sized enterprises, which are generally more sensitive to external fluctuations and more vulnerable to systemic threats (Dvorsky et al., 2021). According to Tullo (2021), enterprises across industrial sectors have gradually begun to revise and adapt their risk management systems in response to new global conditions, with emphasis placed on predictive approaches, agility, and digital support for decision-making. In connection with the ongoing transformation of business processes based on digitalisation, automation, and the development of intelligent systems (Industry 4.0 and 5.0), including the use of artificial intelligence and machine learning tools, integrated approaches to risk management are being increasingly applied, linking operational, strategic, technological, and environmental aspects. According to the authors Crovini et al. (2021) and Dobrowolski (2020), this development highlights the need for a comprehensive revision of traditional risk management models and simultaneously creates demands for new competencies of managers, who must be able to work with data and make decisions in an environment of increased uncertainty (Bratianu et al., 2020). This development signals a shift towards a holistic approach to risk management, which permeates all key processes—from planning, procurement, and production to marketing, human resources, and finance (Dias et al., 2020; Malik et al., 2020). The acceptance of this trend leads to a more systematic monitoring of changes in the corporate and external environment, thereby increasing the quality of decision-making processes and reducing the enterprise’s exposure to undesirable consequences. According to Zieba et al. (2022) and Logan et al. (2021), risk management thus becomes a tool for prevention and protection, but also a foundation for the development of innovations, performance optimisation, and strategic adaptation to changing conditions. The successful handling of these challenges is, however, conditioned by an active and responsible approach on the part of the enterprise’s management, which should establish a clear risk management policy, set measurable objectives, and ensure effective integration of processes in accordance with internationally recognised frameworks, such as the ISO 31000:2018 Risk management-Guideline standard (Björnsdottir et al., 2022). On the contrary, underestimating the importance of risks, the absence of a strategic framework, or the incorrect application of the risk management process represent serious obstacles that may threaten the continuity, stability, and long-term performance of the enterprise. It follows from the above that enterprises are forced to build a resilient organisational culture that does not perceive risks solely as threats, but also as opportunities for innovation and performance enhancement (Domańska-Szaruga, 2020). As Ciocoiu et al. (2020) add, the effectiveness of risk management depends on the level of implementation of organisational and operational resilience, as well as the ability to effectively integrate risk management tools across all business processes. However, the fundamental prerequisite for the successful application of these tools is the clear definition of the responsibility of top management and business owners for risk management as part of the corporate strategy. Estiri et al. (2022) emphasise that systematic and proactive risk management is becoming an essential prerequisite for the long-term sustainability, financial stability, and competitiveness of modern organisations.

Despite the growing importance of integrated risk management, the scholarly literature still insufficiently examines how its actual application changes depending on the macroeconomic context and whether firms genuinely shift from declarative to operational risk management during periods of crisis. This research addresses this gap through a comparative analysis of two temporally distinct empirical datasets (2019 vs. 2022–2023), enabling an examination of shifts in motivations, barriers, and corporate priorities in implementing risk management principles in accordance with ISO 31000:2018 Risk management-Guideline. The research questions are operationalized into measurable indicators focusing on the reasons for paying attention to risks, the extent of risk mitigation design, and the intensity of risk monitoring and review. The empirical strategy, based on questionnaire-based data collection in industrial enterprises, enables the identification of both behavioural and process-related changes in risk management between periods of economic stability and compounded crises. The findings provide new evidence on how external shocks transform the practical functioning of risk management, which factors enhance its effectiveness, and where discrepancies persist between formally declared systems and their actual implementation in organisational practice.

The originality of the project lies in the systematic comparison of the application of ERM principles according to ISO 31000:2018 Risk management-Guideline across two qualitatively different macroeconomic regimes—namely, a period of stability and economic growth and a period characterised by multiple external shocks. Existing research has largely focused either on the normative implementation of ERM frameworks or on one-time evaluations of selected risk management elements without temporal or contextual comparison, while lacking empirically grounded explanations of how actual managerial behaviour and organisational decision-making change when transitioning from a predictive environment to one of high uncertainty. The project therefore quantifies shifts in the allocation of managerial attention between risk identification and the implementation of mitigation measures across different phases of the economic cycle, compares the transition from formally declared ERM to operational, crisis-oriented risk management, measures behavioural factors in management—particularly motivation, resistance to measures, and decision-making approaches—and analyses their influence on the effectiveness of risk responses. At the same time, these findings are embedded in the industrial context of Slovakia, where longitudinal empirical data on ISO 31000:2018 Risk management - Guideline implementation in corporate practice have so far been lacking, and the differentiated impacts of health-related, geopolitical, energy, and cyber shocks on the configuration of ERM processes are examined. The project thus does not merely describe the implementation of the standard but explains its functional adaptation under changing conditions and identifies the gap between declared and operationally executed risk management, thereby creating an empirical bridge between the theoretical ERM framework and its actual application in industrial enterprises within the Central European region.

The main objective of the research is to identify, analyse, and compare the development and changes in the approaches of Slovak industrial enterprises to the application of risk management in two distinct economic periods—during economic growth (2019) and in times of global crises and regional crises with significant global implications (2022–2023)—with an emphasis on identifying key factors influencing the effective application of risk management, as well as the utilisation of the risk management process according to ISO 31000:2018 Risk management-Guideline (ISO 31000:2018, 2018) The aim of the research was to determine how these conditions influenced the perception, implementation, and effectiveness of the risk management process in private sector enterprises.

The study deals with the analysis of business entities’ approaches to risk management in the context of a changing economic environment and growing global uncertainty. In order to provide a comprehensive view of this issue, the presented article is structured into chapters that cover the initial background and highlight the importance of addressing the given issue. The following sections present the theoretical background on managerial behaviour during different phases of the economic cycle, the methodology and aim of the research, and the methods used. The core chapter presents the results from two original empirical studies. The Discussion links the obtained data with the current literature, and the Conclusion summarises the main findings and highlights the need for further research in the field of managerial behaviour in times of economic uncertainty.

2. Literature Review

Over the past two decades, corporate practice has shifted from a separate and reactive view to a comprehensive and integrated approach to risk management, which is currently known as enterprise risk management (ERM) (Horvey, 2025). Enterprise risk management (ERM) is a process and practice that enables organisations to strategically manage risks through a systemic perspective. ERM helps organisations structure their systems to be strengthened by information systems-enabled strategic enterprise management (IS-SEM) and strategic momentum (SM) with the aim of supporting strategic flexibility (SF), which subsequently leads to improved firm performance (FP) (Yoshikuni et al., 2024). The process of enterprise risk management has developed unevenly across the world, although it represents a leading approach that helps organisations identify, evaluate, and manage risks at the enterprise level. The most frequently studied consequence of ERM is its impact on firm performance (Anton & Afloarei Nucu, 2020). Crawford and Jabbour (2023) define enterprise risk management as a promise to improve decision-making and help organisations avoid complex, difficult-to-solve problems. In their study, they found that risk quantification, which uses quantitative and qualitative data and social interpretations of risks and uncertainties, is more likely to be useful in managerial decision-making, especially when attempting to address serious problems. They also found that human cognition significantly influences the design, implementation, and use of ERM, as well as how these systems change over time (Crawford & Jabbour, 2023). Nguyen Hong states in his study that good enterprise risk management helps enterprises reduce the risk of bankruptcy and that enterprises can improve their business performance (Hong, 2023). Resende et al. (2024) point out that comprehensive enterprise risk management has a significant impact on enterprise performance, both directly and indirectly, through an effective corporate social responsibility (CSR) strategy (Resende et al., 2024). The business continuity plan has proven to be the most common risk management practice. Activities such as the establishment of a risk management team and the development of risk appetite and/or risk tolerance statements within the organisation are associated with the likelihood of adopting or considering the application of enterprise risk management (ERM) approaches (Tan & Lee, 2022).

The findings of the study showed that factors related to enterprise risk management significantly influence enterprise resilience and supply chain performance. Enterprise resilience helps improve supply chain performance through risk management strategies and adaptive capabilities (Jidda Jidda et al., 2025). Oreshile et al. (2025), in their research, emphasise the need to intensify pressure from shareholders and regulatory authorities in order to increase enterprises’ investment in high-quality risk management systems (ERM), which significantly contribute to enhancing their resilience (Oreshile et al., 2025). In this context, Rahmawati et al. (2024) point to a positive correlation between the level of ERM implementation and enterprise financing activities, where effective risk management supports better access to financial resources and enterprise stability (Rahmawati et al., 2024). Decisions regarding enterprise growth are influenced by external expectations, internal motivation, organisational characteristics, and external factors such as the risk of unexpected events. The findings confirm that, especially in the environment of small- and medium-sized enterprises (SMEs), it is essential for managers to respond to external threats in an agile and proactive manner, which increases the ability of enterprises to manage uncertainty and adapt to changes in the surrounding environment (Ekinci et al., 2025). In this context, the implementation of comprehensive enterprise risk management (ERM), which enables holistic identification, assessment, and management of risks within the organisation, significantly contributes to organisational resilience. The effective adoption of ERM is also supported by factors such as industrial diversification, cooperation with reputable auditing firms from the Big Four, or ownership structure, all of which have a consistently positive impact on the level of ERM implementation across different types of enterprises (Horvey, 2025). A key role is also played by the promotion of a safety culture, risk mitigation, and the application of sustainable business practices, which have a demonstrably positive impact on organisational performance. Employee engagement acts as a strong mediating factor that amplifies the positive effects of these measures on enterprise performance (Ma & Allaqtta, 2025). Research also confirms that macroeconomic factors, such as the size of the economy, influence countries’ ability to manage risks effectively. In larger economies, the importance of risk pricing associated with production growth, especially in non-market sectors, is amplified, which requires more extensive interconnection through international trade (Tǒ & Tran, 2024). From a global risk environment perspective, cyberattacks are among the most significant threats to organisations (Vrhovec & Markelj, 2024). These findings are supported by Nguyen (2025), who, based on quantitative analytical methods, including OLS (ordinary least squares), FEM (fixed effects model), REM (random effects model), and the panel ARDL model, demonstrated that a higher degree of economic integration positively influences economic growth (Nguyen, 2025). This trend is also evident in the field of maritime transport, where the growing volume of international trade contributes to financial development and the economic growth of countries, but at the same time also brings negative consequences for environmental quality, which need to be taken into account when setting sustainable trade strategies (Bekteshi et al., 2024). The results reveal that effective and proactive risk management has a significant impact on the future financial performance and resilience of countries. The findings highlight that a well-designed risk management strategy is crucial for preventing financial crises and supporting long-term economic growth and sustainability of states (Rim & Mahfuzul, 2025). Suder (2024), in his research, interprets several findings that led to the conclusion that enterprises significantly change their level of entrepreneurial orientation (EO) when market conditions change. In particular, the studied enterprises experienced a decrease in EO during the outbreak of the COVID-19 pandemic, which was mainly caused by a significant decline in willingness to take risks. The level of enterprise orientation (EO) increased with the return of more favourable conditions, mainly due to the growth of innovativeness and proactiveness (Suder, 2024). In this context, de Araújo Lima et al. (2020) points out that some areas of risk management, such as financial risk management and comprehensive enterprise risk management (ERM), are among the most studied in the literature; however, a holistic approach to risk management has not yet become widespread or sufficiently developed among SMEs, even though the number of identified risk types is increasing. In recent times, new areas of risk management are emerging. In particular, the importance of project risk management, strategic risk management, and supply chain risk management is growing (de Araújo Lima et al., 2020). Given the ongoing diversity of supply chains and the increasing risks associated with their functioning, small- and medium-sized enterprises (SMEs) are particularly concerned with risk management issues, as these enterprises usually lack the capacity to absorb larger shocks. The findings from the analysis of empirical data confirmed that supply chain risk management has a significant impact on product innovation performance and sustainability in small- and medium-sized enterprises (Ba Awain et al., 2025).

The results of several studies show that the ability of small- and medium-sized enterprises (SMEs) to effectively implement innovations during crises largely depends on their cooperation with business partners and on their ability to utilise and transform internal and external knowledge (Bivona & Cruz, 2021). The COVID-19 pandemic fundamentally changed the business environment, with smaller enterprises being more significantly negatively affected. The analysis also demonstrated that economic activity during the crisis shifted towards enterprises with higher pre-crisis labour productivity, with this trend being stronger in countries with a highly competitive environment. In contrast, in countries with weaker competition, the shift in economic activity was less pronounced (Bruhn et al., 2023). At the same time, there is evidence that government support measures introduced during the crisis may have partially weakened competition and productivity growth, as the support was primarily directed towards larger and less productive enterprises, regardless of their previous level of innovativeness during the period of enterprise growth (Bruhn et al., 2023). Observations from the SME environment also confirmed that during the pandemic, enterprises faced similar types of risks, most commonly threats related to strong industry competition, rising energy prices, and insufficient profitability (Grondys et al., 2021). These factors also revealed the vulnerability of global supply chains, which needed to be rebuilt to be resilient to systemic disruptions. The COVID-19 pandemic represented a systemic disruption with extensive impact, which exposed shortcomings in enterprises’ ability to respond to such crisis situations (Browning et al., 2023). In this context, the systemic and systematic elimination of all risks and threats that endanger knowledge, processes, and the continuity of operations in the organisation is gaining importance (Blašková et al., 2024). Blašková et al. (2024) claim that the systemic and systematic elimination of risks and threats is crucial for the organisation (Blašková et al., 2024). Daňová and Širá (2023), in their study, describe that the COVID-19 pandemic significantly affected the functioning of economies at both global and national levels (Daňová & Širá, 2023).

A significant economic decline did not spare Slovakia either, where in 2020, the Slovak economy contracted by 9.3% (Petrikovičová et al., 2023). According to Petrikovičová et al. (2023), the decline was caused not only by domestic measures to prevent the spread of the coronavirus but also by reduced foreign demand, while the growth of the Slovak economy had already been slowing down since 2019, i.e., even before the outbreak of the pandemic (Petrikovičová et al., 2023). The World Bank Group (2020) described the recession caused by COVID-19 as the deepest global recession in decades, despite extraordinary efforts by governments to mitigate the economic downturn through fiscal and monetary policies. It is expected that the recessions triggered by the pandemic will leave lasting effects in many areas of the economy (World Bank Group, 2020). Today’s enterprises around the world are facing unprecedented challenges, with cybersecurity considered the most significant risk, followed by compliance risks, operational threats, and risks related to organisational resilience. In addition, aligning risk management priorities with business strategy has emerged as a critical challenge faced by enterprises due to the changing global environment (Metricstream, 2025). According to the results of a 2025 survey involving more than 1200 board members and senior executives from around the world, enterprises will face several key risks over the next two to three years that will significantly influence their strategic decision-making and competitiveness. Among the most significant threats are the deteriorating economic situation, including inflationary pressures, increasing cyber threats, and challenges in attracting, developing, and retaining qualified employees. Enterprises will also face labour shortages, rising wage costs, more frequent changes in regulations, and increased government oversight. Significant risks also include third-party dependencies, the rapid pace of new technologies entering and transforming the market environment, and the implementation of artificial intelligence, which brings not only a shortage of necessary skills but also the emergence of new, previously unknown threats (Protiviti, 2025).

Similar trends are confirmed by a global survey on the most current threats, which involved 1000 senior executives worldwide working in risk management, regulation, and law (AlixPartners, 2025). AlixPartners’ (2025, CEO Sean Dowd’s comment) expects a relaxation of regulations, which may lead to an increase in financial crime. He also points out that technologies offer a way to mitigate risks and reduce exposure to threats; however, these technologies are not yet sufficiently verified and are still under development, creating potential vulnerabilities for organisations (AlixPartners, 2025, Sean Dowd’s comment). Director Meaghan Schmidt in (AlixPartners, 2025), within the survey, states that organisations combining human expertise with advanced technologies will be better prepared to handle the challenges of this new era (AlixPartners, 2025, Meaghan Schmidt’s comment). Responding to the need for a systematic approach to technologies, Director Vineet Sehgal in (AlixPartners, 2025) recommends that enterprises create a dedicated AI leadership position or a team to oversee implementation, risk management, and other related areas. He also recommends that enterprises invest in cybersecurity and data protection frameworks (AlixPartners, 2025, Vineet Sehgal’s comment).

The severity and speed of risk growth are also confirmed by the results of the “Future of Risk” survey by KPMG (2024), according to which more than 61% of executives expect a significant increase in the level of risk over the next three to five years. A key prerequisite for addressing these challenges will be effective leadership that supports a risk-aware culture and risk management. Around 67% of respondents also confirmed that the use of risk data increases awareness and understanding of potential risks for organisations. Among the technologies that will dominate risk management in the coming years are artificial intelligence and generative AI (KPMG, 2024). In Slovakia, this need is also emphasised by Pavol Adamec, Executive Director of Risk Management at KPMG in Slovakia (Adamec, 2025), who states that executives will have to face a significant increase in risks in the coming years. Adamec (2025) points out that effective leadership ensuring the integration of risk management at all levels of the enterprise will represent the key to successful transformation (Adamec, 2025). The Global Risk Manager Survey Report 2024 by FERMA, which included 1041 respondents from 77 countries in the industry, financial services, services, and public sectors, points to the growing importance of comprehensive risk management. Among the sample of respondents, 46% are exclusively engaged in enterprise risk management activities, 23% are specifically involved in insurance management, and 31% of respondents are engaged in both risk management and insurance management activities. Countries from Europe, North America, Africa, South America, Asia, and Oceania participated in the survey. The results of the survey highlight the importance of risk management across different time horizons. The five most serious risks over the 12-month period of 2024 are considered to be: cyberattacks, geopolitical uncertainty, uncertain economic growth, talent management, and data breaches. In the three-year horizon, the most prominent threats are: regulation, geopolitical uncertainty, and the speed of technological change. In the long term, i.e., over a period of 10 years, the dominant risks are: adaptation to climate change, transition to carbon neutrality, and natural disasters (FERMA, 2024).

The results of the Government Enterprise Risk Management 2024 Survey in the United States confirm the persistent challenges of systematically integrating enterprise risk management (ERM) into key public sector processes, with the most significant shortcomings observed in connection with implementation, control, and budgetary mechanisms (AFERM, 2024).

A global perspective on the state of risk management is also presented in the report Global State of Enterprise Risk Oversight by Beasley and Branson (2024), in which 623 senior executives from four geographic regions participated: Europe and the United Kingdom, Asia and Australasia, Africa and the Middle East, and the United States. The survey highlights the volume and complexity of emerging risks. The most significant factors include: geopolitical events, economic conditions, cyber threats, new technologies and innovations, extreme weather events, terrorism, wars, demographic changes, and new competitors. Managing this risk environment is becoming increasingly challenging and complex; more than 66% of global respondents indicated that over the past five years, there has been a significant increase in the volume and complexity of risks, which increases the difficulty of managing them effectively (Beasley & Branson, 2024).

The reviewed literature consistently indicates that the effectiveness and implementation of enterprise risk management are influenced not only by external environmental conditions but also by internal organisational factors, including employee motivation, availability of resources, clarity of roles and responsibilities, and organisational culture (Crawford & Jabbour, 2023; Ma & Allaqtta, 2025; de Araújo Lima et al., 2020). During periods of economic stability, enterprises may perceive risks as less urgent, which can result in lower prioritisation of risk management activities and the persistence of internal organisational barriers. In contrast, crisis conditions increase environmental uncertainty and expose organisational vulnerabilities, which may lead to changes in managerial priorities, increased implementation of risk mitigation measures, and shifts in perceived barriers to risk management (Browning et al., 2023; Suder, 2024; Rahmawati et al., 2024). In particular, enterprise risk management frameworks such as ISO 31000:2018 Risk management - Guideline emphasise continuous risk identification, assessment, mitigation, and monitoring, whose importance increases during periods of heightened uncertainty. Therefore, it can be expected that both the perceived barriers to risk management and the level of implementation of risk management activities differ between periods of economic growth and crisis conditions (ISO 31000:2018, 2018).

3. Research Methodology

To achieve the study objective, a repeated cross-sectional research design was employed, based on two independent questionnaire surveys administered in two distinct macroeconomic periods in Slovakia. The first data collection wave was conducted in 2019 (Period 1; relative economic stability and growth), while the second wave was conducted in 2022–2023 (Period 2; compounded crisis conditions). The crisis context comprised the aftermath of the COVID-19 pandemic, the energy crisis, the military conflict in Ukraine, and the increasing prominence of cyber threats, which jointly created a markedly turbulent business environment.

Data collection and sample. Data were collected using a structured questionnaire (Appendix A) targeting managerial and specialist respondents with relevant insight into enterprise risk management practices (e.g., top management and functional managers). In the first wave (2019), 450 completed questionnaires were obtained; in the second wave (2022–2023), 390 completed questionnaires were obtainedRespondents represented enterprises of different sizes and sectors within the Slovak business environment. The sampling approach aimed to capture heterogeneity across organisational characteristics (e.g., size categories and sectoral representation) to support the analytical relevance of the findings within the Slovak industrial and business context.

Research instrument and measured constructs. The questionnaire was designed to capture enterprise risk management (ERM) practices aligned with the ISO 31000:2018 Risk management-Guideline. Specifically, the instrument covered key ISO 31000:2018 process dimensions (e.g., risk identification and assessment, planning and implementation of mitigation measures, monitoring, and review), as well as perceived reasons, barriers, and organisational/behavioural factors influencing risk management attention and execution. Items were operationalised into measurable indicators to enable comparison across the two periods, including (i) reasons for paying attention to risk management, (ii) perceived barriers and behavioural constraints, and (iii) the intensity of enterprise activities related to risk mitigation, monitoring, and review.

Analytical strategy. A comparative analytical strategy was applied to examine differences between the two survey periods. Quantitative statistical techniques were used to summarise distributions and test for between-period differences in key indicators. The results were interpreted as evidence of period-level differences in risk management perceptions and practices under distinct macroeconomic conditions (stability vs. crisis). In addition to statistical testing, descriptive comparisons were used to support substantive interpretation and to identify patterns relevant for managerial practice and organisational decision-making.

Outputs and practical implications. Based on the empirical findings, the study derives practical recommendations tailored to enterprises of different sizes, focusing on strengthening the integration of risk management processes into both strategic and operational management. Particular attention is given to the shift from formally declared risk management to operational implementation of mitigation measures, as well as the role of organisational and behavioural factors in enabling effective responses during crisis conditions.

Future research directions. Future research is proposed to extend the comparative perspective beyond Slovakia by examining ERM/ ISO 31000:2018 Risk management - Guideline implementation across Central and Eastern European countries, where enterprises face similar geopolitical and economic pressures. Methodologically, future work may benefit from mixed-method designs and, where feasible, longitudinal (paired) enterprise-level follow-ups to further refine causal interpretation of changes over time.

3.1. Data

In research No. 1 conducted in 2019, data were collected using an electronic questionnaire—Google Questionnaire. Based on the data collection, a representative sample size was created (margin of error of 4%, and confidence level of 95%), reflecting the attitude of entrepreneurs towards risk management as a whole. A total of 2292 respondents were contacted in the survey, with a response rate of 19.63%, amounting to 450 enterprises.

In the second research conducted in 2022–2023, data were also collected using an electronic questionnaire—Google Questionnaire. The research was carried out with the support of the National Business Centre (NPC) in Slovakia, which is overseen by the Ministry of Economy of the Slovak Republic. Taking into account the statistical representative sample size created (margin of error of 5.5%, and confidence level of 95%), the survey can be considered representative despite the smaller sample. A total of 2460 respondents were contacted, with a response rate of 15.85%, amounting to 390 enterprises.

In both studies, the sectors represented included trade, industry, construction, transport and information, agriculture, accommodation, catering, business services, and other services. The surveys involved a broad spectrum of small, medium-sized, and large enterprises conducting their activities in Slovakia. In both surveys, the target group of respondents was deliberately focused on individuals in managerial and decision-making positions within industrial enterprises. Specifically, these were top management (CEO), risk manager (RM), chief financial officer (CFO), chief operating officer (COO), quality manager (QMS), IT manager (CISO), and human resources manager (HR). This selection strategy was chosen to ensure the relevance and professional qualification of the responses, as these positions have a direct impact on risk management within the strategic and operational processes of enterprises. The principle of representativeness was taken into account when selecting respondents, and all major respondent groups were included in the research in line with the demographic characteristics of enterprises (size, legal form, sector, and region), in proportions corresponding to the structure of the business environment at the national level of the Slovak Republic. Such an approach made it possible to capture differences in approaches to risk management among different types of enterprises and to create space for their comparison.

The questionnaire was developed based on theoretical and analytical preparations related to the issue of risk management, as well as outputs from previous research projects conducted at the Faculty of Security Engineering of the University of Žilina in Žilina. The questionnaire was designed as a standardised research tool, and its content structure was divided into three logical parts: The first part of the questionnaire focused on obtaining demographic data about the respondent and the represented enterprise (e.g., position, enterprise size, sector, and number of employees), which enabled subsequent segmentation and statistical analysis of responses. The second part included key research questions oriented towards the examined issue, particularly in the area of assessing the implementation of the risk management process. The third part was dedicated to supplementary questions aimed at revealing attitudes, motivations, and barriers that influence managers’ approach to the application of risk management in practice. The overall structure of the questionnaire made it possible to obtain a comprehensive overview of the current state of practice in the field of risk management in industrial enterprises, as well as to create a basis for comparison of changes in approach between individual time periods. Questionnaires that contained inconsistent or contradictory responses were excluded from the following analysis.

3.2. Variables

In the conducted research, the authors focused on the differences in enterprises’ approaches to the application of the risk management process during economic growth and after overcoming global crises in Slovakia. In order to fulfil the main objective, the research was divided into two units, with each unit assigned a corresponding statement.

In the first research, the authors focused on assessing the reasons (barriers) for the insufficient application of risk management in enterprises during economic growth and after overcoming global crises and regional crises, in the years 2019 and 2022–2023, from the perspective of enterprise size according to the number of employees (small, medium, and large enterprises). To confirm this statement, the following quantitative statistical methods were applied: Sign test, descriptive statistics, central tendency analysis, and hypothesis testing. Qualitative methods, such as analysis, synthesis, comparison, and deduction, were used to interpret the findings, compare results between the observed periods, and formulate practical recommendations.

RQ1. 

To what extent have the reasons and barriers to addressing risks in enterprises changed during the global crises and regional crises with significant global implications (2022–2023) compared to the period of economic growth (2019)?

H1. 

There is a statistically significant difference between the period of economic growth (2019) and the period of global crises (2022–2023) in the reasons and barriers influencing the level of attention paid to risk management in enterprises.

In the second study, the authors focused on assessing the application of individual activities of the risk management process during economic growth and after overcoming global crises and regional crises, in the years 2019 and 2022–2023, from the perspective of enterprise size according to the number of employees (small, medium, and large enterprises). To confirm this statement, the following quantitative statistical methods were applied: Sign test, descriptive statistics, central tendency analysis, hypothesis testing, Grubbs’ test, and Wilcoxon paired test.

RQ2. 

Has the interest of enterprises in the proposal of measures, monitoring, and review of risks increased during the period of global crises and regional crises with significant global implications (2022–2023) compared to 2019?

H2. 

During the period of global crises (2022–2023), there was a statistically significant increase in the intensity of enterprise activities focused on risk mitigation measures, risk monitoring, and risk review compared to the period of economic growth (2019).

4. Results and Discussion

Based on the established statements resulting from the analysis of the current state (Section 1), the results were processed, i.e., in the first part (Section 4.1), the assessment of the reasons (barriers) for the insufficient application of risk management in the enterprise, and in the second part (Section 4.2), the assessment of the change in the application of individual activities of the risk management process during economic growth (in 2019) and during the period of global crises and regional crises with significant global implications (2022–2023). The target criterion is the assessment of the addressed issue during economic growth (in 2019) and global crises and regional crises with significant global implications (2022–2023), and the enterprise size according to the number of employees (E1—Small-sized enterprise, E2—Medium-sized enterprise, and E3—Large-sized enterprise).

4.1. Assessment of the Reasons (Barriers) for the Insufficient Application of Risk Management in the Enterprise During Economic Growth and Global Crises and Regional Crises with Significant Global Implications

In the assessed set, the following variations in statistical characteristics were identified, i.e., the reasons (barriers) that prevent owners and managers from addressing risks in their business activities:

R1—Underestimation of risks.

R2—Staff defiance and resistance to measures and change.

R3—Misunderstanding of roles, responsibilities, and authorities in risk management.

R4—Ignorance of procedures and methods to manage risks.

R5—Poor staff motivation and lack of motivation to deal with risks.

R6—Lack of resources (financial, human, and information).

R7—Lack of sense of necessity of addressing risk.

Table 1. Assessment of reasons for insufficient application of risk management in small, medium, and large enterprises during economic growth in 2019.

Reason	Relative Count	Prioritisation of Reasons for E1	Relative Count	Prioritisation of Reasons for E2	Relative Count	Prioritisation of Reasons for E3
	E1		E2		E3
R1—Underestimation of risks	0.1116	5	0.2101	1	0.2330	1
R2—Staff defiance and resistance to measures and change	0.1256	4	0.1118	6	0.1222	5
R3—Misunderstanding of roles, responsibilities, and authorities in risk management	0.0977	6	0.1869	2	0.2031	3
R4—Ignorance of procedures and methods to manage risks	0.2226	2	0.1699	4	0.1523	4
R5—Poor staff motivation and lack of motivation to deal with risks	0.1814	3	0.1801	3	0.2128	2
R6—Lack of resources (financial, human, and information)	0.2419	1	0.1322	5	0.0671	6
R7—Lack of sense of necessity of addressing risk	0.0192	7	0.0090	7	0.0095	7

Notes: E1—Small-sized enterprise, E2—Medium-sized enterprise, and E3—Large-sized enterprise. (1—the most severe reason–7—the least severe reason).

and

Table 2. Assessment of reasons for the insufficient application of risk management in small, medium, and large enterprises during global crises and regional crises with significant global implications (2022–2023).

Reason	Relative Count	Prioritisation of Reasons for E1	Relative Count	Prioritisation of Reasons for E2	Relative Count	Prioritisation of Reasons for E3
	E1		E2		E3
R1—Underestimation of risks	0.1978	2	0.2114	2	0.1746	3
R2—Staff defiance and resistance to measures and change	0.1868	4	0.2602	1	0.1429	4
R3—Misunderstanding of roles, responsibilities, and authorities in risk management	0.1923	3	0.1870	4	0.2381	1
R4—Ignorance of procedures and methods to manage risks	0.2088	1	0.1951	3	0.1270	5
R5—Poor staff motivation and lack of motivation to deal with risks	0.0769	6	0.0650	6	0.1111	6
R6—Lack of resources (financial, human, and information)	0.1374	5	0.0813	5	0.2063	2

Notes: E1—Small-sized enterprise, E2—Medium-sized enterprise, and E3—Large-sized enterprise. (1—the most severe reason–7—the least severe reason).

present the assessment of reasons (barriers) for the insufficient application of risk management in the enterprise during economic growth (in 2019) and global crises and regional crises with significant global implications (2022–2023), for small, medium, and large enterprises, i.e., the reasons are expressed in relative frequency and numerical prioritisation from the most serious reason to the least serious reason for the insufficient application of risk management in enterprises in Slovakia.

With respect to quantitative nominal statistical characteristics, it is necessary to apply a non-parametric test. The data are part of a relatively large sample of unknown distribution. We assume that the groups for research No. 1 = 7 (statistical set 2019) and research No. 2 = 6 (statistical set 2022) are applied to a similar statistical sample, and the sign test can thus be applied. To examine the hypotheses of No. 1 and No. 2 samples, the following H0 hypothesis was established:

$$F\left(-x\right)=1-F\left(x\right)\mathrm{where}X\in R$$

The H0 hypothesis will be tested at the set significance level (α) = 0.05.

The outliers were removed from the set, i.e., valid N for No. 1 is 403 and for No. 2 is 338, as in

Table 3. Results of sign test—statistical sample No. 1 and statistical sample No. 2.

Statistic sample No. 1	Valid N	T	Z-score	p-lvl
Examined data	403	7	2.3453	0.0349
Statistic sample No. 2	Valid N	T	Z-score	p-lvl
Examined data	338	6	2.1269	0.0452

.

Based on testing the null hypothesis, the differences are symmetric and distributed around the value 0, as well as in Table 3, so the stated Ho can be rejected. It is then possible to examine the statement using central tendency analysis—abs and rel count.

From

Table 4. Central tendency analysis of evaluated data for research No. 1.

Reason	Abs. Count	Rel. Count
R5—Poor staff motivation and lack of motivation to deal with risks	82	0.2001
R4—Ignorance of procedures and methods to manage risks	70	0.1708
R1—Underestimation of risks	71	0.1800
R3—Misunderstanding of roles, responsibilities, and authorities in risk management	67	0.1735
R6—Lack of resources (financial, human, and information)	58	0.1401
R2—Staff defiance and resistance to measures and change	51	0.1208
R7—Lack of sense of necessity of addressing risk	4	0.0100
SUM	403	1.0000

, it follows that the most frequent reason that prevented every fifth enterprise in Slovakia during economic growth from addressing risks and paying greater attention to them in their business activities was exclusively poor staff motivation and a lack of a reason to deal with risks.

From

Table 5. Central tendency analysis of evaluated data No. 2.

Reason	Abs. Count	Rel. Count
R2—Staff defiance and resistance to measures and change	74	0.218935
R1—Underestimation of risks	69	0.204142
R4—Ignorance of procedures and methods to manage risks	68	0.201183
R3—Misunderstanding of roles, responsibilities, and authorities in risk management	64	0.189349
R6—Lack of resources (financial, human, and information)	42	0.12426
R5—Poor staff motivation and lack of motivation to deal with risks	21	0.06213
SUM	338	1.00

, it follows that the most frequent reason that prevented every fifth enterprise in Slovakia during global crises and regional crises from addressing risks and paying greater attention to them in their business activities was exclusively staff defiance and resistance to measures and changes. Based on the above, it is possible to confirm the established hypothesis H1.

4.2. Assessment of the Change in the Application of Individual Activities of the Risk Management Process in the Enterprise During Economic Growth and Global Crises and Regional Crises with Significant Global Implications

The following variations in statistical characteristics were identified in the considered set, i.e., the individual activities of the risk management process application according to the ISO 31000:2018 Risk management - Guideline standards were determined as:

• Risk identification—IR.
• Risk analysis—AN.
• Risk evaluation—RE.
• Risk treatment (Risk treatment)—PO.
• Monitoring and review of risks—MPR.

As the data come from relatively large samples, with an uncertain distribution, it is necessary to use a non-parametric test. It can also be assumed that the data come from two dependent samples, and there is also a high probability that they come from the same statistical sample, so the Wilcoxon paired test and Grubbs’ test for eliminating outliers can be used.

The individual research samples coming from the statistical sets were labelled as:

Statistical set with relevant data from research No. 1 (2019).

Statistical set with relevant data from research No. 2 (2021).

Grubbs’ outlier test was performed at a 0.95 level of significance. For testing, the following alternative test hypotheses of outliers were set.

H0(1). 

Outlier is not present in the No. 1 set.

H1(1). 

There is at least one outlier.

The test criterion, according to the statistical tables, is G = 2.0021, with a significance level of α = 0.05. The critical value for the above test is CV = 2.0863. Since G < CV, it is possible to accept H0(1)—there is no outlier in the set.

H0(2). 

There is no outlier present in the set No. 2.

H1(2). 

There is at least one outlier.

The test criterion, according to the statistical tables, is G = 1.9436, at alpha = 0.05 level of significance. The critical value for the above test is CV = 2.0063. Since G < CV, it is possible to accept H02—there is no outlier present in the set.

Subsequently, it is possible to proceed with the testing of differences using a non-parametric test. The assumption of the created H00 is that the distribution of the individual differences in the two sets under consideration (No. 1 and No. 2) is symmetrically distributed around the value 0, i.e., H00: avgNo. 1 − avgNo. 2 = 0. The null hypothesis (H00), therefore, directly assumes that the median difference in No. 1 and No. 2 is equal to 0. The hypothesis will be tested at a significance level of 0.05.

Based on the value of the parameter v < V given in

Table 6. Results of Wilcoxon paired test.

Statistical Sample	No of Non-Entities	v < V	Z	P-Vlv
No. 1 and No. 2	509	50.1056	2.1112	0.0331

, H00 can be accepted. Similarly, based on the parameter p-lvl, H0 can be accepted with a confidence level of 0.95.

Subsequently, a correlation analysis was performed for set No. 1.

Based on the results from

Table 7. Correlation analysis for set No. 1.

	IR	AN	RE	PO	MPR
IR	1.0000
AN	0.3730	1.0000
RE	0.3180	0.2930	1.0000
PO	0.1334	0.1137	0.1682	1.0000
MPR	0.0801	0.1177	0.0275	0.2260	1.0000

, the dependence between risk identification and analysis activities is moderately strong. From the correlation analysis, it can be concluded that there is a dependence between risk management activities—identification, analysis, and evaluation of risks in the enterprise. It indicates that owners and managers of enterprises in Slovakia were actively engaged in these activities during economic growth. On the contrary, the least number of enterprises paid attention to the following risk management activities: designing risk-reduction measures, monitoring, and reviewing risks.

Subsequently, a correlation analysis was carried out for set No. 2.

There has been a fundamental change in the perception of the risk management process in set No. 2. Based on the results from

Table 8. Correlation analysis for set No. 2.

	IR	AN	RE	PO	MPR
IR	1
AN	0.904468	1
RE	0.90493	0.902081	1
PO	0.949361	0.886965	0.954884	1
MPR	0.865083	0.815312	0.783993	0.827302	1

, enterprises in Slovakia were more concerned with the design of risk-reduction measures based on the resulting risk assessment. Increased interest among managers and business owners can also be observed, where the correlation coefficient takes values of a strong dependence. On the basis of the processed results of the performed analyses, it can be concluded that there is a dependence between the following risk management activities: design of risk-reduction measures, monitoring, and review of risks, i.e., that the owners and managers of enterprises in Slovakia were actively engaged in these activities during global crises and regional crises.

After validation by both tests, it is possible to assess the statement based on central tendency analysis—abs and rel count—according to the selected variability indicators and the level of each activity of the application of the risk management process in the enterprise in the first and second body of research, as shown in

Table 9. Central tendency analysis for No. 1 and No. 2.

Indicator	ID1	AN1	RE1	PO1	MPR1	ID2	AN2	RE2	PO2	MPR2
Mean	0.3129	0.3032	0.3003	0.3290	0.3014	0.3289	0.3207	0.2519	0.2897	0.4996
Standard Error	0.0094	0.0091	0.0105	0.0133	0.0156	0.0116	0.0139	0.0114	0.0133	0.0236
Median	0.3000	0.3000	0.3000	0.3000	0.3000	0.3000	0.3000	0.2000	0.3000	0.4000
Mode	0.3000	0.3000	0.2000	0.3000	0.2000	0.2000	0.2000	0.2000	0.2000	1.0000
Standard Deviation	0.1351	0.1202	0.1331	0.1718	0.1624	0.1658	0.1977	0.1431	0.1660	0.3554
Sample Variance	0.0183	0.0145	0.0177	0.0295	0.0264	0.0275	0.0391	0.0205	0.0276	0.1263
Kurtosis	0.1057	5.5539	4.8942	3.2231	2.6251	3.3198	3.8475	4.1618	2.7665	−1.3969
Skewness	0.5673	1.2875	1.4623	1.3548	1.2050	1.2665	1.7168	1.5270	1.2017	0.4540
Range	0.6000	0.9500	0.9000	0.9000	0.9000	0.9000	0.9000	0.9000	0.9000	0.9000
Minimum	0.1000	0.0500	0.1000	0.1000	0.1000	0.1000	0.1000	0.1000	0.1000	0.1000
Maximum	0.7000	1.0000	1.0000	1.0000	1.0000	1.0000	1.0000	1.0000	1.0000	1.0000
Sum	64.1500	52.7500	48.3500	54.9500	32.5500	67.1000	65.1000	39.8000	44.9000	113.4000
Count	205.0000	174.0000	161.0000	167.0000	108.0000	204.0000	203.0000	158.0000	155.0000	227.0000
Largest (1)	0.7000	1.0000	1.0000	1.0000	1.0000	1.0000	1.0000	1.0000	1.0000	1.0000
Smallest (1)	0.1000	0.0500	0.1000	0.1000	0.1000	0.1000	0.1000	0.1000	0.1000	0.1000
Confidence Level (95.0%)	0.0186	0.0180	0.0207	0.0263	0.0310	0.0229	0.0274	0.0225	0.0263	0.0465

.

Based on the results of the analyses (especially Table 9), the following hypothesis can be confirmed: During the period of global crises (2022–2023), there was a statistically significant increase in the intensity of enterprise activities focused on risk mitigation measures, risk monitoring, and risk review compared to the period of economic growth (2019).

5. Discussion

The results of the conducted research show that during the period of economic growth (in 2019), the main reason for neglecting risks in medium and large enterprises was their underestimation, while in small enterprises, it was the lack of resources for risk management. Low staff motivation to manage risks was similarly reported across all enterprises. Related findings were also presented by authors such as de Araújo Lima et al. (2020), who points out that in the environment of small- and medium-sized enterprises (SMEs), a sufficiently developed and systematic approach to risk management is still lacking, even though the number of identified risk types is continuously increasing. At the same time, as emphasised by Grondys et al. (2021), during a global crisis, such as the COVID-19 pandemic, enterprises faced similar threats, with the most common being strong competition within their sector, rising energy prices, and reduced profitability, which further exposed the vulnerability of the business environment.

Subsequently, the results of the research show that during global crises and regional crises with significant global implications, the approach of enterprises changed. Small enterprises lacked knowledge of procedures and methods to apply the risk management process, medium-sized enterprises wanted to implement it but mainly faced resistance and defiance from staff towards the measures, and in large enterprises, employees were not clearly assigned risk management tasks, resulting in unclear responsibility for risk management. Similar findings were reported by Grondys et al. (2021), who stated that during the COVID-19 pandemic, the weaknesses of many enterprises became evident as they faced rising energy costs, high competition, and reduced profitability, significantly weakening their ability to manage new types of risks. These findings are also supported by Daňová and Širá (2023), who said that the COVID-19 pandemic significantly affected the functioning of economies at both global and national levels, with Slovakia also experiencing a sharp economic decline. As stated by Petrikovičová et al. (2023), the Slovak economy contracted by 9.3% in 2020 due to a combination of domestic restrictions and decreased foreign demand. These results are in line with the claims of the World Bank Group (2020), which labelled the recession caused by the COVID-19 pandemic as the deepest global recession in decades, with expected long-term negative impacts on many areas of the economy. It follows that the underestimation of risks, lack of resources, or low employee motivation identified in this study are not isolated problems of specific enterprises but are related to broader economic and systemic factors that affected the business environment, especially during the pandemic.

The observed shift in perceived barriers and risk management implementation between periods of economic growth and crisis conditions can be explained by a fundamental transformation in the role of risk management within organisations. During stable economic periods, risk management is often treated as a formal and technical activity focused primarily on risk identification and assessment. However, crisis conditions expose organisational vulnerabilities and require the actual implementation of mitigation measures, which introduces behavioural, organisational, and managerial challenges. As a result, risk management shifts from a primarily technical diagnostic function to a behavioural and implementation-oriented process, where factors such as employee resistance, unclear roles and responsibilities, and organisational readiness become critical determinants of effectiveness.

Strategic foresight represents a critical organisational capability that strengthens anticipatory capacity, supports proactive decision-making, and enables the translation of risk assessment into effective mitigation measures, thereby enhancing organisational resilience under crisis conditions. Furthermore, the integration of strategic foresight into organisational management fosters a culture of responsible, resilient, and future-oriented planning, consolidating its role as a key pillar of the sustainable transformation of organisations (Velez Martell, 2025).

Several authors and studies—Metricstream (2025), Protiviti (2025), Adamec (2025), Vrhovec and Markelj (2024), FERMA (2024), and Beasley and Branson (2024)—state that the current business environment is characterised by unprecedented complexity and an increasing volume of risks that significantly affect strategic decision-making in enterprises. This issue is further addressed by Adamec (2025), who emphasises and agrees that enterprises will face a significant increase in risks and will need to develop appropriate measures and ensure effective integration of risk management into enterprises. The Metricstream (2025) study identifies the most significant risk as cybersecurity, followed by compliance-related risks, operational threats, and risks related to organisational resilience. Protiviti (2025) highlights the most significant threats, which include the deteriorating economic situation, including inflationary pressures, rising cyber threats, and challenges in acquiring, developing, and retaining qualified employees. Enterprises will also face labour shortages, increasing wage costs, more frequent regulatory changes, and increased government scrutiny.

AlixPartners (2025) and several authors working within enterprises explain the findings of the study. Dowd, Schmidt, and Sehgal in (AlixPartners, 2025) agree that the use of technology and human expertise, and the creation of a dedicated AI position, will represent a major benefit for the adaptation and sustainability of today’s dynamic society and for the approach to risk management in enterprises. The KPMG “Future of risk” (KPMG, 2024) survey indicates that effective leadership supporting a risk-aware culture and risk management will be a key prerequisite for tackling these challenges. An important finding from the KPMG (2024) survey is the direct correlation between the use of risk data and increased awareness and understanding of potential risks. Adamec (2025) recommends ensuring effective leadership, which represents the key to successful transformation and the integration of risk management in enterprises. As confirmed by Ba Awain et al. (2025), systematic mapping of weaknesses, potential risks, and threats is an essential prerequisite for ensuring the long-term competitiveness of these enterprises (Ba Awain et al., 2025). Many authors, such as Nguyen Hong (Hong, 2023), Oreshile et al. (2025), Jidda Jidda et al. (2025), and Rahmawati et al. (2024), confirm the importance of effective risk management in enterprises, highlighting its direct impact on improving enterprise performance, reducing the risk of bankruptcy, increasing business resilience, and enhancing the functioning of supply chains. They also emphasise that high-quality implementation of enterprise risk management (ERM) contributes to strengthening financial stability and facilitates access to external financial resources. Research also shows that investments in high-quality risk management systems play a key role in enhancing the competitiveness of enterprises and their ability to effectively cope with unexpected external shocks. The study by Suder (2024) shows that entrepreneurial orientation is a dynamic concept that flexibly adapts to the external environment. A significant weakening of the willingness to take risks during crises such as the COVID-19 pandemic is a natural response to increased uncertainty and market vulnerability. On the other hand, with the gradual stabilisation of conditions and the restoration of confidence in the market environment, there is a revival of innovative and proactive business behaviour, with enterprises once again ready to invest in new solutions and identify opportunities. These connections point to the need for continuous monitoring of not only external market factors but also internal factors that affect the ability of enterprises to respond to environmental changes, thereby effectively building their competitiveness (Suder, 2024).

The results indicate that every enterprise—whether small, medium, or large—should focus on increasing prevention and preparedness for managing adverse events in the current business environment. These findings are consistent with the insights of several authors who highlight the complexity of today’s unstable environment and the need for the integration of modern technologies, expert knowledge, and a systematic approach to risk management as an essential factor for ensuring competitiveness, sustainability, and the ability of enterprises to adapt to the dynamic challenges of the present era. Based on this, a simple procedure for the application of risk management in an enterprise is recommended, consisting of the following steps.

Implement an integrated risk management system—i.e., the enterprise should incorporate risk management as part of enterprise-wide governance, covering strategic, operational, financial, technological, and environmental areas, in accordance with ISO 31000:2018 Risk management - Guideline.

Apply a proactive and predictive approach—i.e., risks should be identified and analysed before they occur, using tools such as scenario analysis, predictive modelling, and preventive planning in order to minimise their impact on operations.

Include ESG risks and support sustainability—i.e., enterprises should expand risk management to include Environmental, Social, and Governance (ESG) factors, which are increasingly important for investors, regulators, and the reputation and long-term stability of the organisation.

Apply an agile approach—i.e., in a rapidly changing environment, it is essential that the enterprise responds quickly and adaptively, particularly in projects and innovations where risk management should be conducted in short cycles with continuous updates. Risk management should become part of iterative planning and decision-making.

Use data and digital technologies—i.e., effective risk management should be supported by technologies such as data analytics, artificial intelligence, GRC (Governance, Risk and Compliance) software, e.g. IBM OpenPages, and BI tools, which enable real-time risk monitoring and support decision-making.

Foster a risk awareness culture—i.e., risk management should be supported through employee education, open communication, and motivation to actively engage in risk identification and mitigation at all levels of the organisation.

6. Conclusions

In the context of increasing economic uncertainty and systemic disruptions, effective risk management has become a critical determinant of enterprise resilience, stability, and long-term sustainability. This study provides empirical evidence on the evolution of risk management practices in Slovak industrial enterprises by comparing two distinct periods: economic growth and a period characterised by global crises and regional crises with global implications.

The empirical findings of this study demonstrate measurable differences in the perception and implementation of risk management between the analysed periods of economic growth and crisis. Specifically, during the period of economic growth, the insufficient application of risk management was primarily associated with the underestimation of risks, lack of resources, and low employee motivation. In contrast, during the crisis period, enterprises showed a higher level of engagement in risk management activities, while the main barriers shifted towards organisational and behavioural factors, including resistance to implemented measures, unclear allocation of responsibilities, and insufficient knowledge of risk management procedures. These empirically supported findings reflect observable changes in enterprise behaviour under different external conditions. In a broader context, these results suggest that external systemic disruptions may increase managerial awareness of risks and contribute to the transition from a formal and reactive approach to a more proactive and integrated risk management framework.

These results further confirm a significant shift in enterprise risk management approaches between the analysed periods. While risk management during economic growth was predominantly formal and focused mainly on risk identification and assessment, the crisis period was characterised by a higher level of implementation of concrete mitigation measures and more proactive risk management practices. Furthermore, the study identified changes in the perceived barriers to risk management implementation, highlighting the importance of organisational, behavioural, and cultural factors in determining the effectiveness of risk management systems. These findings provide empirical support for the assumption that external disruptions influence not only the perception of risks but also the practical implementation of risk management activities within enterprises.

From a methodological perspective, this study contributes to the existing literature by providing a comparative empirical analysis based on data collected during two fundamentally different economic conditions and across enterprises of different sizes. The applied research design enabled the identification of statistically and practically significant differences in risk perception, barriers, and implementation of risk management activities, thereby extending current knowledge on how external economic and systemic disruptions influence internal enterprise management practices.

The practical implications of this study are particularly relevant for enterprise managers and decision-makers, including CEOs, risk managers, CFOs, COOs, CISOs, quality managers, and HR managers. The findings highlight the importance of implementing formalised, integrated, and proactive risk management systems aligned with international standards such as ISO 31000:2018 Risk management - Guideline. Enterprises that systematically integrate risk management into their strategic and operational processes are better prepared to anticipate potential threats, reduce organisational vulnerability, and strengthen their adaptive capacity in unstable and uncertain environments.

Despite its contributions, this study has several limitations that should be considered when interpreting the results. First, the research is based on self-assessment questionnaire data, which may introduce subjective bias and influence the accuracy of the reported level of risk management implementation. Second, the research samples from the analysed periods were not paired at the level of individual enterprises, and therefore, the findings reflect general trends rather than direct longitudinal changes within the same enterprises. Third, the focus on Slovak industrial enterprises may limit the generalisability of the findings to other countries or economic sectors. These limitations suggest that the results should be interpreted as indicative of broader trends rather than precise measurements of changes at the level of individual enterprises.

Future research should address these limitations by incorporating longitudinal designs with paired enterprise samples, expanding the geographical scope to include international comparisons, and combining quantitative and qualitative research approaches. Further research should also focus on evaluating the effectiveness of implemented risk management measures, their economic impact, and their integration with digital technologies, ESG factors, and enterprise sustainability strategies.

Overall, this study provides empirical evidence that external economic and systemic disruptions significantly influence the perception, implementation, and strategic importance of risk management in enterprises. The findings confirm that risk management represents a critical managerial capability that enhances enterprise resilience, adaptability, and long-term competitiveness in conditions of increasing uncertainty.