Production Planning & Control

The Management of Operations

ISSN: (Print) (Online) Journal homepage: https://www.tandfonline.com/loi/tppc20

Fostering project risk management in SMEs: an

emergent framework from a literature review

Raffaele Testorelli , Priscila Ferreira de Araújo Lima & Chiara Verbano

To cite this article: Raffaele Testorelli , Priscila Ferreira de Araújo Lima & Chiara Verbano (2020):
Fostering project risk management in SMEs: an emergent framework from a literature review,
Production Planning & Control, DOI: 10.1080/09537287.2020.1859633

To link to this article: https://doi.org/10.1080/09537287.2020.1859633

Published online: 16 Dec 2020.

Submit your article to this journal

Article views: 24

View related articles

View Crossmark data

Full Terms & Conditions of access and use can be found at

https://www.tandfonline.com/action/journalInformation?journalCode=tppc20
PRODUCTION PLANNING & CONTROL
https://doi.org/10.1080/09537287.2020.1859633

Fostering project risk management in SMEs: an emergent framework from a

literature review

jo Lima and Chiara Verbano
Raffaele Testorelli, Priscila Ferreira de Arau
Department of Management and Engineering, University of Padova, Vicenza, Italy

ABSTRACT ARTICLE HISTORY

Given the relevance of project risk management (PRM) for small and medium-sized enterprises (SMEs), Received 23 December 2019
which need to adopt an efficient and effective methodology coherent with their peculiarities to sup- Accepted 1 December 2020
port their innovation and growth, this research provides a framework derived from systematic litera-
KEYWORDS
ture that could foster the adoption of PRM in SMEs. It offers an extended and iterative PRM process
Project risk management;
that includes the strategic selection and evaluation of projects, a flexible a dynamic approach accord- SMEs; systematic
ing to the characteristic of the SME and the project, the inclusion of the stakeholders’ perspective, the literature review
mitigation of potential bias on risks evaluation, the use of risk clustering to improve project organiza-
tion, the adoption of systematic and transparent communication to increase awareness on risk expos-
ure, and the integration of Risk Knowledge Management into the PRM process, in order to obtain an
enterprise learning process.

1. Introduction enterprises, since few people have authority in the company

The interest in Risk Management (RM) has been increasing in
the past years given the need for managing risks inside the
companies in order to support their value creation and suc-
cess. RM is categorized into different streams and, according
to Lima, Crema, and Verbano (2020), Project Risk
Management (PRM) is one of the emerging streams as it is a
topic of increasing interest but still not well developed.
PRM is one of the major approaches taken by companies
to achieve success in their projects (Elkington and Smallman
2002). It is an integral part of the Project Management (PM)
framework and aims at identifying, analyzing, treating, and
monitoring & controlling risks, which are intrinsic to any pro-
ject (ISO21500 2012; PMI 2017b). Risks can affect the organi-
zation’s performance, economy, and continuity, so effective
management of them can support enterprises in reaching
their objectives, reducing potential losses, and enabling
them to explore new opportunities (Radner and Shepp 1996;
ISO31000 2018). Despite the importance of PRM and the sig-
nificant presence of small and medium-sized enterprises
(SMEs) in Europe, few studies of PRM in SMEs have been
conducted (Lima, Crema, and Verbano 2020), as stated
before. The literature on PRM has focussed mainly on large
companies, leaving a gap in the empirical evidence address-
ing small companies. SMEs are more vulnerable to risks than
large companies and need specific activities and procedures
in order to succeed in their projects.
According to Scherer (1988), the bureaucracy of the activ-
ities and the formalization of the procedures in SMEs are
non-existent or, at least, less complicated than in large
and decisions are usually taken only by a small group of
people, if not just one person. Cenciarini (1998) believes that
a possible reason why an SME may not grow is related to
the lack of delegation of activities by the CEO or owner to
more competent people due to his or her fear of losing
power. Improving SMEs
managerial knowledge and compe-
tencies are crucial to leveraging the development of the
whole economy (Hussain et al. 2006). SMEs grow and innov-
ate through projects, and PRM is critical for efficiently man-
aging the time, cost, and quality of a project (Dey 2012).
Nevertheless, SMEs still need a proactive approach to risks.
Given the importance of PRM for SMEs and the frag-
mented studies on the topic, this research intends to collect
and analyze the existing literature through a systematic lit-
erature review in order to provide an integrated framework
with the relevant managerial and academic contributions on
the topic, to identify opportunities, and to propose future
research directions.
The paper is organized as follows: In Section 2, the theor-
etical background of PRM in SMEs is presented; objectives
and research methodology are described in Section 3; results
are reported in Section 4; relevant findings that lead to an
emergent PRM framework for SMEs are discussed in Section
5, and conclusions are reported in Section 6.
2. Theoretical background
The concept of risk varies depending on the context in
which it is inserted. In this paper, the definition of risk as an

CONTACT Chiara Verbano chiara.verbano@unipd.it Department of Management and Engineering, University of Padova, Strll.a S.Nicola, Vicenza
36100, Italy
ß 2020 Informa UK Limited, trading as Taylor & Francis Group
2 R. TESTORELLI ET AL.
effect (positive or negative) of uncertainty was adopted as
this effect impacts the achievement of a compan
ys objec-
tives (Islam, Tedford, and Haemmerle 2008; Aven 2012;
ISO31000 2018; Purdy, 2010). It can affect organizations in
terms of performance, economy, business continuity, reputa-
tion and environment. Given the negative consequences that
can be brought into a company through an unmanaged risk,
it is necessary to track them through an RM process in order
to support the organizations which have been taking a
greater interest in RM and the benefits that can be obtained
through its implementation (ISO31000 2018). Therefore, this
managerial approach guides enterprises to overcome uncer-
tainties and reach their goals.
The RM was introduced in the late 60s in the USA with
the objective of reducing insurance costs (Mehr and Hedges
1963). Over time, RM spread to the financial, strategic, opera-
tive and other fields of applications, covering finally the
entire company in an integrated view named Enterprise RM
(De Loach 2000; Verbano and Venturini 2011).
Since the development of RM took place in large compa-
nies, the guidelines for its adoption are mainly based on evi-
dence gathered in these firms, which are not suitable for
SMEs (Lima, Crema, and Verbano 2020); though they are par-
ticularly important for the European Union
s economic
growth and employment rate (WTO 2016). Specific character-
istics of SMEs, their business and the limits deriving from
activities not developed for less structured companies were
not taking into consideration in the formalization of RM
(Crovini, Santoro, and Ossola 2020). SMEs are more vulner-
able to risks and more exposed to changes in the surround-
ing environment, therefore the need of a specific framework
for managing risks in SMEs is necessary (Crovini, Santoro,
and Ossola 2020).
Regardless of its relevance and the growing interest in
the topics, not many studies about RM in SMEs have been
published. Lima, Crema, and Verbano (2020) revised the lit-
erature published over time about RM in SMEs and analyzed
the evolution of different RM streams in detail. Depending
on its field of application, the RM approach had different
perspectives and paths of evolution, hence the need of con-
ducting specific studies for each stream in SMEs. This study
reveals that Financial RM and Enterprise RM are among the
most studied streams in the literature, while Project RM,
Strategic RM and Supply Chain RM are new emerging ones
in SMEs context.
Therefore, project risk management (PRM), an integral
part of the PM process in order to ensure a project
s success,
is a topic of increasing interest but still not well developed.
A project is a series of activities and tasks with a specific
objective to be completed within certain specifications in
order to deliver a unique product or service (Kerzner 2009;
PMI 2017). To execute a project successfully, PM applies
knowledge, skills, tools, and techniques to the project activ-
ities to meet the project requirements (PMI 2017). It was
developed initially in the heavy engineering industries
(Morris 1994) and subsequently evolved to address smaller
projects and medium-sized projects in large firms (Turner,
Ledwith, and Kelly 2009). So far, little has been published on
the management of projects in SMEs. Notwithstanding, SMEs
need PM to introduce innovativeness in the business in a
focussed manner, to achieve growth, and to satisfy their stra-
tegic objectives in a way that minimises their high inherent
risk (Turner, Ledwith, and Kelly 2009).
RM must be handled together with other PM activities to
guarantee the achievement of the project
s objectives (Raz
and Michael 2001). The PM processes can be articulated into
ten knowledge areas, with PRM being the area that deals
with project risks (PMI 2017).
Several classifications of project risks were found in the lit-
erature. de Camprieu, Desbiens, and Feixue (2007) indicated
three types of project risks: technological, market and envir-
onmental. Dey (2012) classified the main project risks into
five categories: financial, economic & political, technical,
organizational, and natural & statutory clearance risks. Qazi
et al. (2016) identified three categories of project risks: tech-
nical, operational and environmental. In order to have an
unambiguous classification of project risks, the following five
categories were used in this research: technical-operative
(technology, selection of materials and equipment, change
requests design and implementation), organizational (human
factors), contract (bankruptcy), financial/economic (inflation,
interest rate fluctuation, exchange rate fluctuation), and pol-
itical risks (environmental and governmental authorizations).
PRM is a systematic process that aims to identify and
manage these risks in order to act on their appearance by
implementing systems and procedures to address the project
risks (Raz and Michael 2001; Conroy and Soltan 1998). For
effective management, a complete PRM process needs to be
adopted. The process consists of a preliminary phase (con-
text analysis and planning) and four main phases: risk identi-
fication, risk analysis, risk treatment, and risk monitoring &
control (PMI 2017). Different tools and techniques are
applied to each phase in order to perform effective PRM as
part of a complete PM implementation.
PM has evolved to address smaller projects in large firms
and nowadays it has also being applied to SMEs (Turner and
Ledwith 2018).
SMEs are considered the backbone of European Union
countries
growth as they represent almost 99% of the com-
panies in Europe and 67% of all employment in the private
sector (OECD 2012). Therefore, improving SMEs’ managerial
knowledge and competencies is crucial to leverage the
development of the whole economy (Hussain et al. 2006;
Porter and Kramer 2006).
SMEs are more vulnerable to exposure to and effects of
risk than large multinational companies which can rely on
greater resources in terms of knowledge and capital (Toulov
a,
Tuzov
a, and Vesel
a 2016). Besides, SMEs are expected to have
different attitudes towards risks and RM (Risk Management),
since they have a completely different view of risks in com-
parison to very large firms (Henschel and Durst 2016). For
instance, they have a higher potential to become insolvent,
and the most frequent causes of insolvency are management
errors and weaknesses in the company structure (Henschel
and Durst 2016). Due to their specific needs and peculiarities,
they require RM tools and methodologies specifically

1 2 3 4
Motivation of the Objective and Research
Literature Review Research Questions Strategy
Database, Keywords
and Searching Fields,
Snowballing
Figure 1. Research protocol.
developed for them (Altman, Sabato, and Wilson 2010), so a
specific PRM process is needed by SMEs.
As projects are used for innovation and growth, it is
important that SMEs adopt an efficient and effective PM pro-
cess (Turner and Ledwith 2018) which includes specific PRM
practices, tools, and activities. However, studies regarding the
adoption of PRM in SMEs are scarce (Marcelino-S
adaba et al.
2014; Neves et al. 2014). Most SMEs do not adopt PRM practi-
ces due to their scant resources, but the study of Lima and
Verbano (2019) proposed and tested an empirical framework
to analyze with multiple case studies how to adopt PRM in
SMEs with a positive cost-benefit ratio. PRM phases, activities,
tools and organizational aspects coherent with the SMEs con-
text are presented in the paper, which also highlights that
PRM diffusion is still at low levels in SMEs. This study offers a
useful reference to investigate how to implement PRM in
SMEs, but it has not the purpose to integrate in a comprehen-
sive theoretical framework all the knowledge developed in
the literature about the topic of interest, due to its empirical
nature. Moreover, the application of this empirical framework
to a relevant sample of cases is still lacking.
SMEs’ vulnerability, caused by a combination of resource-
related constraints (human, technical, and financial), low
bargaining power, and sensitiveness to business risk and
competition, leads to an additional need for PRM adoption
with a positive cost–benefit ratio (Blanc Alquier and Lagasse
Tignol 2006; Dallago, Guglielmetti, and Rondinelli 2012).
Regardless of the strategic importance of PRM in SMEs, lit-
tle on the theme can be found in the fragmented literature
(Marcelino-S
adaba et al. 2014).
Given all the afore-mentioned observations, it is possible
to conclude that PRM is neither much-studied nor wide-
spread in SMEs, despite its increasing importance, and there
is a significant gap to be filled with new researches.
3. Objectives and methodology
Based on the identified research gaps and the importance of
the theme, the aim of this study is to understand how PRM
can be implemented in SMEs. Specifically, the research ques-
tions are:
RQ1. Which are the main PRM activities, organizational aspects,
tools and techniques adopted in SMEs? Which are the
benefits achieved?
PRODUCTION PLANNING & CONTROL 3
5 6
Database
Selection Data
Construction and
Criteria Extraction
Analysis
Descriptive Analysis:
Language, Type of Definition of Quality
Variables Definition and
Publication, Content Indexes
Analysis
Content Analysis:
Variables Definition and
Analysis
RQ2. Which are the factors enabling and hindering the adoption
of PRM?
In order to answer the defined research questions, a sys-
tematic literature review was performed and accomplished
based on the guidelines proposed by Macpherson and Holt
(2007) and Tranfield, Denyer, and Smart (2003), adapted to
this specific research and detailed in the review protocol
(Figure 1).
In order to build a database (DB) with the relevant papers
about PRM in SMEs, the two most widespread literature DBs
were used: Elsevier’s Scopus and the Web of Science Core
Collection by Clarivate Analytics. Indeed, they provide better
quality indexing and better bibliographic records in terms of
accuracy, control and granularity of information, when com-
pared with other scientific databases (Cavacini, 2015; Guz
and Rushchitsky 2009).
The details about keywords (strings) used to run the initial
search, steps of the refinement process, criteria adopted to
exclude articles, and the number of papers remaining after
each selection step, are shown in Figure 2.
From the initially resulting papers (step 1), duplicated
articles obtained through the different queries in both DBs
were excluded (step 2), then article abstracts were reviewed
to determine whether each paper is relevant to the research
questions (steps 3 and 4). Finally, after careful full-text ana-
lysis to verify the relevance of the remaining articles, only 13
papers about PRM in SMEs were found (step 5).
In order to consider all the significant literature, the snow-
ball sampling procedure was employed in step 6, using a ref-
erence list and citations of the selected papers, according to
the guidelines for snowballing in systematic literature studies
proposed by Wohlin (Wohlin 2014), and six additional papers
were selected accordingly, raising the total number of
selected papers to 19 (Table 1).
The quality index of the journal in which each paper was
published (if not a conference paper) was assessed in order
to evaluate the quality of the resulting DB; nevertheless, con-
sidering the limited numbers of journal articles available on
the topic, it was not used as refinement criteria in the selec-
tion process.
Afterwards, a descriptive analysis was conducted, consid-
ering the following variables:
 the first author, to identify the authors who are more
devoted to the theme;
4 R. TESTORELLI ET AL.
Queries
Web of Science
Initial search 1
445
Exclusion of
duplicated papers 2 topic “SME”
386
Abstract reading
testing project 3 topic “Small Business”
risks focus
38
Abstract reading
testing SMEs focus
4
Full text reading
testing coherence with 5 Engineering, Business and
research questions
Snowballing 6
Figure 2. Systematic literature search and refinement process.
 year of publication, to identify whether there is a trend in
the number of studies on the topic;
 journal, to identify whether one or more journals are
dedicated to the topic;
 first author
s Country, to identify whether there is a
Country/Region in which more studies on the theme are
carried out.
After the classification of all the papers according to the
abovementioned descriptive variables, a content analysis was
conducted, based on the main constructs recognized in the
literature and other constructs needed to answer the
research questions (Figure 3), particularly:
 research objectives of the analyzed paper;
 research methodology applied in the study: empirical
(case study, survey), conceptual (model proposal, pro-
gramming), or empirical & conceptual (model proposal &
testing, mathematical modelling & testing) (Wacker 1998;
Voss, Tsikriktsis, and Frohlich 2002; Keupp, Palmi
e, and
Gassmann 2012);
 an industry where the research was conducted;
 type of project on which the research was conducted;
 project risk types considered in the analyzed paper;
 PRM phases adopted and activities conducted;
 tools and techniques adopted for the implementation of
both PRM and Risk Knowledge Management (RKM) in SMEs;
 benefits, results and costs related to PRM;
 factors hindering and enabling the adoption of PRM.
The descriptive analysis and the content analysis based
on the literature allowed the researchers to answer the
research questions, identify the gaps in the literature, and
indicate the potential future directions for research.
Queries
Scopus
1079
RESEARCH QUERIES
• RS01: title “Risk Management” AND
• RS02: topic “Risk Management” AND
719 topic “SME”
• RS03: title “Risk Management” AND
• RS04: title “Risk Management” AND
34 topic “Small Projects”
LIMITATIONS
• Period: till 2018
10 14 • Research Categories: Management,
Economics
• Language: only papers in ENGLISH
13
19
papers
4. State of the art on PRM in SMEs
From the review of the literature, 19 papers were identified
(13 articles and 6 conference papers), published from 2001
to 2017 (Figure 4(a)), with 6 articles among them in top
international journals: Production Planning & Control,
International Journal of Project Management, Journal of
Computing in Civil Engineering (Table 1),
The main geographical area of the first authors of the
analyzed papers is Europe (11 papers), followed by America
(4 papers), Asia (3 papers), and Africa (1 paper), revealing a
global interest in the subject.
With regard to business sectors, it must be noted that the
papers refer both to business sectors where SMEs are pro-
ject-oriented and to those where they are traditionally pro-
cess-oriented (Figure 4(c)); the project types considered in
the analyzed studies are consequently those related to the
corresponding business sectors (Figure 4(d)); moreover, the
Scimago Journal Rank reveals a good quality of the final
database, as shown in Figure 4(b).
4.1. Research motivations, objectives and methods of
the analyzed papers
During the last decades, the world’s economy has undergone
a process of deep re-establishment, moving into a fast-
changing, knowledge-based economy on a global scale
(Pereira et al. 2015; Yun-Hong, Wen-Bo, and Xiu-Ling 2007;
Yang and Man-Li 2010), which dragged SMEs into a daily
struggle to survive in a new, difficult and challenging eco-
nomic environment (Emmenegger, Laurenzini, and Tho €nssen
2012; Pereira et al. 2015). For these reasons, the main
research motivations of the analyzed papers are to protect
the SMEs’ capability to innovate and to improve the overall
performance of their projects. On the basis of these common
 PRODUCTION PLANNING & CONTROL 5

Table 1. Final database.

Document First Publication
# Database type Authors author’s country Title year Journal/Conference
1 Scopus Article Naude M.J., Chiweshe, N. (Naude South Africa A proposed operational risk 2017 South African Journal of
and Chiweshe 2017) management framework for Economic and
small and medium enterprises Management Sciences
2 Scopus Article Goncalves R.Q., Kuhlkamp E.D., Brazil Enhancing dotProject to support 2015 International Journal of
von Wangenheim C.G. Risk Management aligned Information Technology
(Goncalves, Kuhlkamp, and with PMBOK in the context Project Management
Von Wangenheim 2015) of SMEs
3 WoS Article Pereira L., Tenera A., Bispo J., Portugal A risk diagnosing methodology 2015 Communications in Computer
Wemans J. (Pereira web-based platform for micro, and Information Science
et al. 2015) small and medium businesses:
Remarks and enhancements
4 WoS Article Neves S. M., da Silva C.E.S., Brazil Risk management in software 2014 International Journal of
Salomon V. A. P., da Silva A. projects through Knowledge Project Management
F., Sotomonte, B. E. P. (Neves Management techniques:
et al. 2014) Cases in Brazilian Incubated
Technology-Based Firms
5 WoS Article Hwang B.G., Zhao X., Toh L.P. Singapore Risk management in small 2013 International Journal of
(Hwang, Zhao, and Toh 2014) construction projects in Project Management
Singapore: Status, barriers
and impact
6 Scopus Conference Pereira L., Tenera A., Wemans, J. Portugal Insights on individual’s risk 2013 Procedia Technol. 9
(Pereira, Tenera, and perception for risk assessment
Wemans 2013) in web-based risk
management tools
7 WoS Article Marcelino-Sadaba S., Perez- Spain Project risk management 2013 International Journal of
Ezcurdia A., Lazcano A.M.E., methodology for small firms Project Management
Villanueva, P. (Marcelino-
S
adaba et al. 2014)
8 Scopus Article Sharif A.M., Basri S., Hassan Malaysia A study on SME software 2013 World Applied
Osman A. (Sharif, Basri, and development background and Sciences Journal
Ali 2013) risk assessment
implementation in Malaysia
9 Scopus Conference Hajjaji M., Denton P.D. (Hajjaji UK The integration of risk 2011 21st International Conference
and Denton 2011) management into on Production Research:
maintenance project Innovation in Product
approaches for and Production
manufacturing SMEs
10 Scopus Article Marcelino-Sadaba S., Perez- Spain Risk management in SME’s 2010 DYNA
Ezcurdia A. (Marcelino-S
adaba tackled projects
and P
erez-Ezcurdia 2010)
11 Scopus Article Sharif A.M., Rozan M.Z.A. (Sharif Malaysia Design and implementation of 2010 World Academy of Science,
and Rozan 2010) project time management risk Engineering
assessment tool for SME and Technology
projects using oracle
application express
12 WoS Article Tang L.C.M., Leung A.Y.T., Wong UK Entropic risk analysis by a high 2010 Journal of Computing in Civil
C.W.Y. (Tang, Leung, and level decision support system Engineering
Wong 2010) for construction SMEs
13 Scopus Article Iskanius P. (Iskanius 2009) Finland Risk management in ERP project 2009 Engineering Letters
in the context of SMEs
14 Scopus Conference Rowe S.F. (Rowe 2007) USA Project Management for 2007 Project Management Institute
Small Projects
15 WoS Article Blanc Alquier A.M., Lagasse France Risk management in small- and 2006 Production Planning & Control
Tignol M.H. (Blanc Alquier and medium-sized enterprises
Lagasse Tignol 2006)
16 Scopus Conference Ojala M., Vilpola I., Kouri I. Finland Risks and risk management in 2006 9th International Conference
(Ojala 2006) ERP Project - Cases in on Business Information
SME Context Systems, BIS
2006; Klagenfurt
17 WoS Article Leopoulos V.N., Kirytopoulos K.A., Greece Risk management for SMEs: Tools 2006 Production Planning & Control
Malandrakis C. (Leopoulos, to use and how
Kirytopoulos, and
Malandrakis 2006)
18 Scopus Conference Delisle S., St-Pierre J. (Delisle and Canada SME projects: a software for the 2003 48th World Conference of the
St-Pierre 2003) identification, assessment and International Council for
management of risks Small Business (ICSB-2003)
19 Scopus Conference Kirytopoulos K., Leopoulos V., Greece Risk management: A powerful 2001 4th SMEs
Malandrakis C. (Kirytopoulos, tool for improving efficiency International Conference
Leopoulos, and of project oriented SMEs
Malandrakis 2001)
6 R. TESTORELLI ET AL.

HINDERING
PROJECT TOOLS BENEFITS,
RESEARCH RESEARCH INDUSTRY PROJECT PRM PHASES AND AND
RISK AND RESULTS
OBJECTIVES METHOD TYPE TYPE ACTIVITIES ENABLING
TYPE TECHNIQUES AND COSTS
FACTORS
Improved
Identification of
Civil Engineering Civil Engineering Technical & PRM Techniques Strategic
the Research Empirical Context Analysis Organizational
& Construction & Construction Operative for SMEs Projects
Objectives
Selection
Organizational
Improved
(Related to RKM Techniques Techniques &
Conceptual ICT ICT Consulting Risk Identification Projects
Human for SMEs Tools
Performances
Factors)

Regulations Improvement of
Empirical & ICT Software SW Tools for Financial &
Manufacturing and Risk Analysis Other Managerial
Conceptual Development PRM in SMEs Economical
Authorizations Aspects

Innovation and Financial & Internal Skills &

Services Risk Treatment
R&D Economical Resources

Risk Monitor &

Others Others Market Others
Control

Natural
Others
Hazards

Figure 3. Framework for content analysis.

Figure 4. (a–d) Distribution of papers over the years, business sectors, project types considered in the analyzed papers.

Figure 5. (a, b) Research objectives and risk types considered in the literature.
research motivations, the analyzed papers follow different
research objectives (Figure 5(a)).
Among them, eight papers aim to support the develop-
ment of methodological frameworks in order to guide the
implementation of PRM in SMEs, which do not generally use
the most recognized standards for PRM, in many cases due to
their relative complexity, if compared to the normally reduced
size of SMEs’ projects (Marcelino-S
adaba et al. 2014; Neves
et al. 2014). Indeed, most of the PRM standards were primarily
designed to manage large projects and cannot be fully applied
to SMEs; therefore, their use requires at least some adaptations
to the capabilities of these companies, as many of the most
popular PRM practices are far from being flexible (Blanc
Alquier and Lagasse Tignol 2006; Courtot 1998; Marcelino-
S
adaba et al. 2014; Rowe 2007; Smith and Pichler 2005).
Three papers aim to provide guidelines for the selection
of the most suitable PRM techniques and tools: considering
the relevant number of techniques available, characterized
by different objectives and levels of complexity, it has
become a priority to identify the key factors to be consid-
ered in order to select those most suitable for each SME and
project type. In addition, the selection of an appropriate soft-
ware tool to support PRM implementation in SMEs is another
relevant topic, considering that it could be an important fac-
tor to achieve a higher probability of project success (Hajjaji
and Denton 2011; Kirytopoulos, Leopoulos, and Malandrakis
2001; Leopoulos, Kirytopoulos, and Malandrakis 2006).
Moreover, three of the analyzed papers focus on the inte-
gration of RKM into the PRM process. Indeed, SMEs need to
improve their ability to not only identify but also manage
risks associated with their projects (Jiang, Klein, and Discenza
2001; Neves et al. 2014). Neef (2005) adds that an organiza-
tion cannot effectively manage its risks if it does not manage
its knowledge, which is one of the most powerful tools in
PRM (Cooper 2003; Neves et al. 2014).
PRODUCTION PLANNING & CONTROL 7
Three papers focus on the control of bias and uncertainty
in risk evaluations, considering that unbiased decision-mak-
ing is key to projects’ success. These papers demonstrate
that cognitive biases influence the information that individu-
als notice and the interpretation they reach and may affect
risk perception, causing individuals to discount negative out-
comes (Simon, Houghton, and Aquino 2000; Pereira, Tenera,
and Wemans 2013; Tang, Leung, and Wong 2010). Also, hav-
ing information of poor quality and value will lead to greater
uncertainty, making the decision environment more unstruc-
tured and unbiased judgements more difficult for stakehold-
ers, even during the design and planning stages of a project
(Tang, Leung, and Wong 2010).
Only two papers aim to comprehend the current state of
the art of PRM implementation in SMEs, in terms of the level
of adoption, barriers, and impacts on project performances,
but these analyses are limited to specific business sectors
and geographical areas.
Finally, two papers aim to leverage PRM to enhance SMEs’
credibility in the financial market, considering that SMEs
often experience difficulties accessing funding to support
their projects, especially when they are competing for the
same and limited capital resources (Kenley 2003; Tang,
Leung, and Wong 2010). This situation creates a lot of pres-
sure on SMEs, and the implementation of more effective
PRM methods could represent an excellent solution (Delisle
and St-Pierre 2003).
The research methods followed in the papers are for the
most part empirical (eight papers), including single or mul-
tiple case studies and surveys, followed by conceptual works
(six papers) with model proposals and programming, and
finally both empirical and conceptual ones (five papers)
including model proposals and testing.
Finally, it should be noted that all the most relevant risk
types are considered by the analyzed papers (Figure 5(b)).
8 R. TESTORELLI ET AL.

(a) PRM ACTIVITIES (b) PRM TECHNIQUES (c) PRM SW TOOLS

19 Analysed Papers 28 PRM Techniques in 32 PRM SW Tools in
the Analysed Papers the Analysed Papers

0 5 10 0 8 16 0 15 30

Projects Evaluation
and Selection
PRM
Planning
Risk
Focus of the
Identification
Analysed Papers
Qualitative
Risk Analysis
Quantitative
Risk Analysis
Response
Planning
Monitoring
and Control
Results Management
and Lessons Learned

[Number of papers] [Number of techniques] [Number of tools]

Figure 6. (a–c) PRM activities, techniques, and tools.

4.2. PRM activities, techniques and tools
The analyzed papers focus mainly on PRM activities related
to risk identification and analysis (Figure 6(a)), offering a
wide range of PRM techniques to support specifically these
steps (Figure 6(b)). It should be noted that the level of util-
ization of risk identification techniques by SMEs is approxi-
mately the same whether PRM is implemented or not.
However, companies that believe in PRM (and presumably
have implemented it) are more likely to apply techniques
that assist them in the more critical areas, namely risk ana-
lysis, response planning, monitoring and control. In other
words, it is relatively easy to identify risks, and a PRM pro-
cess may not be necessary for this purpose, but it would be
required for the more complex activities of the later steps; in
addition, widespread use of risk analysis techniques is associ-
ated with the best project management practices (Raz and
Michael 2001).
Risk monitoring and control techniques also play a funda-
mental role in PRM, as they allow the identified risks to be
kept under control and the effectiveness of risk responses to
be verified. Among the most widespread techniques in SMEs,
there are risk indicators which, despite their apparent simpli-
city, require an accurate definition of metrics. In fact, often
the metrics used in SMEs are not suitable for effectively pre-
dicting the success and/or failure of a project, impacting
negatively on the overall effectiveness of PRM (Marcelino-
S
adaba et al. 2014).
Moreover, the software tools considered, by their very
nature, implement mainly quantitative analysis techniques,
together with some features to assist in risk identification
and qualitative risk analysis (Figure 6(c)).
Finally, it should also be noted that a relevant number of
RKM techniques are proposed in the analyzed literature,
mainly supporting project evaluation and selection, risk iden-
tification, lessons learnt and results management.
From the analysis of the literature, it also emerges that to
obtain the maximum benefit from the implementation of a
formal PRM process, SMEs use methodological frameworks.
With regard to the six PRM methodological frameworks for
SMEs identified in the analyzed literature, it should be noted
that they present different levels of detail in the description
of the phases and they suggest a various set of techniques,
addressing many typical issues related to PRM implementa-
tion in SMEs; some of them assure good coverage of the
PRM process, even including project results management
and the formalization, sharing, and reuse of lessons learnt on
project risks (Blanc Alquier and Lagasse Tignol 2006;
Marcelino-S
adaba et al. 2014; Pereira et al. 2015), far beyond
the central phases usually implemented by these companies.
This confirms that RKM should be considered an integral
part of the PRM process (Neves et al. 2014; Jafari et al. 2011).
However, a number of further aspects need to be devel-
oped. Indeed, the analyzed PRM methodological frameworks
are designed on monolithic models, mostly obtained by sim-
plification of the most complex frameworks used in large
organizations, and they propose a predefined set of techni-
ques, nonetheless retaining a certain structural rigidity that,
in some cases, could reduce the degree of applicability of
the frameworks themselves (Cagliano, Grimaldi, and Rafele
2015; Hillson 1997; Mullai 2006).
To obtain the maximum benefits, what is needed is a
methodology specifically designed for SMEs that includes

scalable and adaptable management processes, tools, and
techniques depending on the size of the project (medium,
small, or micro) to facilitate risk management throughout the
project life cycle (Turner, Ledwith, and Kelly 2010;
Rowe 2007).
In addition, it emerges that the approaches generally
used for risk analysis are mono-criterion, which means that
risks are considered as if they were independent, while in
practice they often present interdependencies. The use of a
risk-clustering approach could greatly improve the quality of
PRM through the evaluation of such interdependencies, max-
imizing the effectiveness of risk responses and also providing
a clear criterion for the assignment of risk management
responsibility to the project team. This point is particularly
relevant because the existence of ‘grey areas’ in the assign-
ment of risk management responsibilities has a negative
influence on the performance of the whole PRM process, in
particular when there are different stakeholders (internal and
external to the company) involved in the project activities
(Marcelino-S
adaba et al. 2014; Marle and Vidal 2011).
However, it should be acknowledged that the analyzed
methodological frameworks represent a major step forward
when compared with the state of the art of PRM implemen-
tation in SMEs and they have paved the way for
future works.
4.3. Benefits obtained from and evidence of
PRM adoption
The most relevant benefits and results obtained through the
implementation of PRM in SMEs are the improved overall
project performances, including time reduction, cost com-
pression, and better quality of results, together with
increased transparency regarding risk exposure; in addition,
PRM helps to identify interactions between risks and to pri-
oritize and address the most critical ones as early as possible,
facilitating communication, understanding, and alignment
between stakeholders with regard to risks (Willumsen et al.
2019). These results are more noticeable in SMEs with a
higher level of PRM implementation, which are more likely
to recognize the importance of PRM for improving project
performances than those with a lower level of PRM practice
(Hwang, Zhao, and Toh 2014).
Other relevant benefits are related to a more effective
selection of strategic projects to be implemented and to a
better definition of project objectives, which help prevent
serious shortcomings in the project definition. According to
Tang, Leung, and Wong (2010) and Kirytopoulos, Leopoulos,
and Malandrakis (2001), PRM could also be a valid support in
the project planning phase, providing an overview of proj-
ects’ vulnerabilities (Willumsen et al. 2019), supporting the
definition of more realistic project plans, project costs, and
cash flow forecasting, and consequently assuring a more
realistic view of what should be expected during the whole
project life-cycle.
Additional positive side effects concern the impacts of
PRM on other management aspects, including improved PM
processes, more effective decision-making and problem-
PRODUCTION PLANNING & CONTROL 9
solving, and then better overall project stability through a
clearer picture of the risks and reduced inconsistency in risk
evaluation among different stakeholders. These results sug-
gest that PRM contributes even indirectly to project success
(Willumsen et al. 2019; Mu, Peng, and MacLachlan 2009;
Oehmen et al. 2014) and, according to Blanc Alquier and
Lagasse Tignol (2006), it allows an improved and systemat-
ized return on experience through RKM, as well as the
enhancement of an enterprise learning process.
5. An emergent framework to implement PRM
in SMEs
5.1. An extended and iterative seven-step PRM process
The major part of the literature focuses on the central steps
of the PRM process and particularly on risk identification and
risk analysis since SMEs usually perform only these activities.
In particular, risk identification and qualitative risk analysis
are often implemented even in companies with a low level
of maturity towards risk; however, these activities are not
always performed with an adequate level of quality, impact-
ing the overall effectiveness of PRM (Jung and Han 2017;
Marcelino-S
adaba et al. 2014; Raz and Michael 2001).
The main differences between the various versions of the
PRM process proposed in the analyzed literature are in the
presence (explicit or implicit) or absence of the initial activ-
ities, aimed at evaluating and selecting projects according to
the SME’s strategy, performing the context analysis, and
developing a PRM plan, as well as the final activities dedi-
cated to results management and lessons learnt through pro-
ject execution (Cagliano, Grimaldi, and Rafele 2015;
Leopoulos, Kirytopoulos, and Malandrakis 2006; Raz and
Michael 2001). This is important, considering that SMEs often
overlook precisely these activities (Marcelino-S
adaba et al.
2014). This means that projects may not even be properly
chosen from a strategic point of view; for this reason, some
authors propose an initial strategic filter to select the best
projects for the company (Marcelino-S
adaba and P
erez-
Ezcurdia 2010; Marcelino-S
adaba et al. 2014; Blanc Alquier
and Lagasse Tignol 2006; Pereira, Tenera, and Wemans 2013;
Pereira et al. 2015; Tang, Leung, and Wong 2010). For this
reason, an initial step devoted to strategic evaluation and
selection of projects based on risks evaluation has been
added to the emerging framework (step 1), in order to miti-
gate strategic risks, obtain a better definition of objectives,
and prevent serious shortcomings in the project defin-
ition phase.
On the other side, SMEs often lose the opportunity to
improve the PRM process through lessons learnt and results
management (Bush et al. 2005; Keizer, Halman, and Song
2002; Marcelino-S
adaba et al. 2014; Pisano 2006; Smith and
Merritt 2002). Accordingly, a final step specifically dedicated
to lesson learnt and the formalization of risk knowledge has
been added to the emerging framework (step 7).
These pieces of evidence suggest the adoption of an
extended seven-step process as a reference for PRM imple-
mentation in SMEs, which includes these two additional
steps, as shown in Figure 7.
10 R. TESTORELLI ET AL.

EXAMPLES OF PRM
EXPECTED BENEFITS TECHNIQUES & TOOLS
PRM framework adaptation
•Increased transparency based on the level of 1
• Goals Oriented Quest.
regarding risk exposure maturity toward risk Considering • Strategic Risks Checklist
Strategic filter based
among Stakeholders Stakeholders • Risks Database (refer)
on risks evaluation
perspectives • Entropy Analisys
•More realistic view of 2
project vulnerabilities • SWOT Analysis
• Skills Database
•More realistic project 1 2 3 Evaluation of the • Risks Database (refer)
plans, project costs, PROJECTS PRM interdependencies 3
and cash flow EVALUATION & CONTEXT & among risks • Risks Checklists
forecasting SELECTION PLANNING RISK • RBS
IDENTIFICATION • Expert Judgment
• FMEA
•Improved PM
4
processes, decision- RESULTS • Anchoring Vignettes
Risk Knowledge
making and problem- Management, MANAG. & Control of bias • Cluster Analysis
solving Risks Database
LESSONS 4 and uncertainty • Probability & Impact Mat.
LEARNED • Risks Prioritization
RISK 5
•Better overall project 7 ANALYSIS
stability • Action/Contingency Plans
• Indicators' Checklist
Continuous • Risks Database (refer)
•Improved overall communication MONITORING Reuse of risk
project performances and consultation
& CONTROL
RESPONSE information 6
available from • Risks Indicators/Triggers
with Stakeholders PLANNING
•Improved and • Risks Watchlist
previous projects • Periodic Risks Review
systematized return on 6 5 • Risks Database (feed)
experience through 7
Risk reporting and
Risk Knowledge Clear assignment of • Risks Classification
transparent • Risks Database (analyze)
Management communication risk management • Risks Checklists (feed)
responsibility • Project Results Reporting

Figure 7. The proposed iterative seven-step PRM framework for SMEs.

The proposed process is iterative and not linear, as all
those reported in the analyzed literature: a new process iter-
ation is started when a new project has been selected in
step 1, or even during the execution phase of the project if
its scope or goals have been changed or unforeseen risks
require to reconsider the planned approach to PRM (e.g. in
terms of different skills and effort required, a different set of
techniques to be adopted, or a diverse strategy for risk
responses to be implemented), starting a new cycle from
step 2. Information on risks collected during each process
iteration is analyzed and formalized in order to support the
following process iterations, in the same project or in
future projects.
Further details about the initial step 1 and the final step 7
are given below.
5.1.1. Strategic evaluation and selection of projects
(step 1)
Results from the literature review suggest that this initial
activity has to be based on the reuse of knowledge available
on risks from previous projects (Neves et al. 2014), also con-
trolling bias on risks perception, and considering different
stakeholders’ perspectives (Pereira et al. 2015) in order to
obtain a more realistic view of project vulnerabilities and
expectations during the whole project life-cycle.
It must be underlined that the activity of strategic evalu-
ation and selection of projects is part of the Portfolio
Management Standard of the Project Management Institute
(PMI 2017) that SMEs usually do not implement due to the
limited resources, or implement in a different way from a
large organization. Indeed, SMEs develop too much implicit
knowledge, insufficiently shared between managers and
other employees, mix-up of operational and strategic deci-
sion-making, and efficiency in strategic decision-making. For
all these reasons, all the most important measures of
improvement are devoted to introduce formalized proce-
dures and to focus on risks and their main business indicator
(Blanc Alquier and Lagasse Tignol 2006).
5.1.2. Results management and lessons learned (step 7)
It emerges from the literature review that information on
risks needs to be organized in order to be reused in future
projects, even using a simple risk classification or a risk
ontology, as explained by Blanc Alquier and Lagasse Tignol
(2006), otherwise information on risks will be useless. This
activity could be facilitated by the implementation of a risks
database, collecting the available information on risks from
previous PRM process iterations. For this reason, the emerg-
ing PRM framework proposes the integration of RKM activ-
ities into the PRM process, in order to obtain an improved
and systematized return on experience, as well as the
enhancement of an enterprise learning process. Moreover,
the level of adoption of the RKM process has to be commen-
surate to the characteristic of the specific SME and project,
in accordance with the principle of the flexibility of the PRM
approach, illustrated in the following paragraph.
5.2. A flexible and dynamic approach to PRM in SMEs
To obtain the maximum benefits, what is needed is a PRM
framework specifically designed for SMEs that includes scal-
able and adaptable management processes, tools, and tech-
niques depending on a number of the key factors that have
to be considered, including, for example, the level of matur-
ity towards the risk of the SME and the size of the project
(medium, small, or micro) to facilitate the risk management
throughout the project life cycle (Turner, Ledwith, and Kelly
2010; Rowe 2007).

For these reasons, the emerging framework proposes a
‘flexible’ approach to PRM in SMEs: rather than offering pre-
scriptive activities and fixed sets of PRM techniques and
tools, it is based on the assumption that the PRM approach
has to be customized according to the characteristic of the
specific SME and project, as suggested by Turner and
Ledwith (2018), in terms of:
 level of implementation of the PRM process, that could
be complete (implementing all the phases included in the
framework, for example, for SMEs with a higher level of
maturity towards risk), or partial (limited to central steps
of the PRM process, for example, from risk identification
to risk monitoring and control),
 selection of the most suitable set of PRM techniques
and tools.
The identification of the right level of customization of
the PRM approach is a fundamental goal of step 2 (‘PRM
Context and Planning’) that includes accordingly the assess-
ment of the level of maturity towards risk of the company
and the project characteristics.
The proposed framework is also ‘dynamic’, meaning that
the defined level of customization, in terms both of PRM pro-
cess and set of PRM techniques, could be revised, if neces-
sary, in the following iteration of the PRM process.
5.2.1. Level of implementation of the PRM process
It clearly emerges from the literature that a close relationship
exists between the level of maturity towards the risk of the
SME and the phases of the PRM process that can be effect-
ively implemented as well as, the ability to manage risks,
and the success of projects. According to Cagliano, Grimaldi,
and Rafele (2015), a lack of an adequate level of maturity
towards risk leads to occasional applications of informal PRM
techniques to specific projects and to the management of
issues only when they occur; on the other hand, high levels
of maturity towards risk make it possible to proactively man-
age uncertainty. According to the same authors, the degree
of maturity towards the risk of an organization depends on
its type and size, on its risk-taking culture, and on the avail-
able information on project risks.
5.2.2. Selection of the most suitable set of PRM techni-
ques and tools
A great number of techniques and tools are suggested for
SMEs in the literature, in particular those specifically dedi-
cated to the central steps of the PRM process and RKM tech-
niques that could support the initial and final steps of the
proposed seven-step PRM process.
These techniques are characterized by different objectives
and levels of complexity. Thus, in order to select the most
suitable set for a specific SME and project, the following key
factors have to be appropriately considered (Blanc Alquier
and Lagasse Tignol 2006; Cagliano, Grimaldi, and Rafele
2015; Jafari et al. 2011; Marcelino-S
adaba et al. 2014; Neves
PRODUCTION PLANNING & CONTROL 11
et al. 2014; Osipova and Eriksson 2013; Turner, Ledwith, and
Kelly 2010):
 specific PRM activities to be performed;
 characteristics of the SME, in terms of the maturity level
of the company towards risk and skills and attitudes of
the project team;
 characteristics of the project to be implemented, in terms
of project size, life-cycle stage, level of complexity
and innovation;
 degree of project risk awareness, in terms of nature and
quality of the available information on risks, and level of
uncertainty;
 lessons learnt through the execution of previous projects,
and process iterations
 level of usability of the techniques themselves, in terms
of cost–benefit ratio.
Comprehensive software tools are available, through com-
mercial products, to support PRM implementation in SMEs
but, due to their prices, they may not be always suitable for
the budgets of these companies (Fabac, Radosevi, and Pihir
2010; Goncalves, Kuhlkamp, and Von Wangenheim 2015;
Leopoulos, Kirytopoulos, and Malandrakis 2006); therefore,
open-source software tools for PRM could represent an inter-
esting alternative for SMEs (Goncalves, Kuhlkamp, and Von
Wangenheim 2015; Pereira, Tenera, and Wemans 2013).
5.3. Stakeholders perspective, risk perception, risk
clustering and risk communication
The emerging PRM framework incorporates the stakeholders’
perspective, as suggested by international standards
(ISO21500 2012; ISO9001 2015; ISO31000 2018), and it is
focussed particularly on: the control of risks perception and
bias in the evaluation of risks in step 1 (‘Project evaluation &
selection’), the understanding of the stakeholders’ needs and
expectations in step 2 (‘PRM Context and Planning’), and the
continuous, systematic and transparent communication and
consultation with interested stakeholders. Indeed, the pro-
posed PRM framework for SMEs requires continuous and sys-
tematic communication and consultation with interested
parties in all steps of the PRM process, in order to increase
transparency regarding risk exposure among stakeholders, as
the key targets of risk communication. As suggested by
many authors (Marcelino-S
adaba et al. 2014), transparent
communication is beneficial to PRM effectiveness.
Moreover, from the systematic literature review, it
emerges that risk perceptions and the potential bias in risk
evaluations are relevant factors in PRM implementation in
SMEs, influencing the information individuals notice and the
interpretation they reach (Pereira, Tenera, and Wemans
2013). In addition, having poor quality and value of informa-
tion will lead to greater uncertainty that further make the
decision environment more unstructured, causing stakehold-
ers to discount on negative outcomes and uncertainty asso-
ciated with their decisions (Pereira, Tenera, and Wemans
12 R. TESTORELLI ET AL.
2013; Tang, Leung, and Wong 2010). For these reasons, it is
important for SMEs to control potential bias in risk evalua-
tions, and this aspect has been included accordingly in the
emerging framework, particularly in step 1 (‘Projects
Evaluation & Selection’) and step 4 (‘Risk Analysis’).
Finally, the framework proposes the evaluation of the
interdependencies among risks, in step 3 (Risk Identification)
and step 4 (Risk Analysis), reusing the information available
from previous projects and process iterations. This evaluation
allows a clear assignment of risk management responsibility
to the project team based on risks clustering in step 5
(Response Planning), in order to maximize the effectiveness
of risk responses, as suggested by Marle and Vidal (2011).
5.4. Factors enabling and hindering PRM in SMEs
The factors most frequently reported as hindering PRM
implementation in SMEs are organizational ones. Usually,
SMEs perceive that the benefits of PRM outweigh the costs
of its implementation; however, these companies often do
not implement a formal PRM process due to the lack of a
methodological framework suitable for their needs. Indeed,
the bureaucracy and effort required to implement PRM are
frequently formidable barriers to its adoption (Cagliano,
Grimaldi, and Rafele 2015; Hwang, Zhao, and Toh 2014;
Marcelino-S
adaba et al. 2014; Neves et al. 2014; Pereira et al.
2015; Raz and Michael 2001).
Another important hindering factor, when considering the
implementation of PRM in SMEs, concerns the inevitable limi-
tations regarding the internal availability of resources and
the lack of sufficient internal knowledge on PRM (Cagliano,
Grimaldi, and Rafele 2015).
Additional hindering factors concern the quality of stra-
tegic decisions on risks, which is often affected by a certain
subjectivity and bias because decision-makers perceive risks
differently and have conflicting interests and objectives; par-
ticular attention must be paid to the choice of techniques to
be used to support these activities, as they can influence
strategic decisions regarding which projects to implement
(Pereira et al. 2015; Tang, Leung, and Wong 2010).
Other hindering factors are related to the difficulty of
developing and maintaining a risk corporate memory includ-
ing all the risk information for future use, which is very
important for the soundness of PRM but is also quite difficult
to implement, especially in SMEs, due to their economic limi-
tations (Blanc Alquier and Lagasse Tignol 2006), and other
financial and economic aspects, including low project mar-
gins and false evaluation of projects’ cost–benefit ratios.
Finally, the difficulty in selecting PRM and RKM techniques
and tools could be another relevant hindering factor.
On the other hand, the factors most frequently reported
as enabling PRM implementation in SMEs are organizational,
including the implementation of formalized and standardized
PRM procedures consistent with the maturity level of the
company towards risk, the integration of PRM with PM proc-
esses and other relevant management processes, a cross-
organizational collaboration on PRM, transparent
communication regarding risk exposure, an adequate focus
on lessons learnt, results management, and the reuse of risk
knowledge, together with a strong commitment to PRM
adoption by the CEO or the company’s owner.
For all these reasons, the full adoption of the proposed
extended and iterative seven-step PRM process may require
the definition of an incremental implementation roadmap in
which each step should be consistent with the maturity level
towards risk achieved by the company at the time. For this
purpose, it is advisable to adopt a structured methodology
for the assessment of the company’s level of maturity
towards risks, such as the traditional models proposed by
Hillson (1997) and Cagliano, Grimaldi, and Rafele (2015) or
the more structured Risk Management Capability Maturity
Model of Yeo and Ren (2009). These models make it possible
to identify the strengths and weaknesses of a specific SME in
relation to PRM implementation and then the strategies and
activities to move from the current level of maturity towards
risk to the next one.
6. Discussion and conclusion
This study extends the current research on PRM in SMEs,
placing another stone on the path towards a definition of a
PRM framework suitable for the needs of these companies.
From the systematic literature review, it emerges a PRM
framework for SMEs that integrates different relevant aspects
not fully considered so far. At the same time, in any of the
analyzed papers that focus mainly on specific aspects of the
problem or particular phases of the PRM process, the chance
to offer a systemic and holistic view to SMEs is missing. The
only exception consists of the work proposed by Marcelino-
S
adaba et al. (2014) that presents a PRM framework covering
the relevant phases of the PRM process; nevertheless, results
emerging from the systematic literature review give the
opportunities for further improvements. The relevant novel-
ties suggested by the emerging PRM framework for SMEs are
(1) an extended an iterative seven-steps PRM process that
includes the strategic selection and evaluation of projects
and RKM, (2) a flexible a dynamic approach to PRM process
implementation and to the selection of the most suitable set
of PRM techniques and tools, according to the characteristic
of the SME and the project, (3) the inclusion of the stake-
holders’ perspective, (4) the mitigation of potential bias on
risks evaluation, (5) the use of risk clustering to improve pro-
ject organisational effectiveness in terms of risk responsibil-
ities assignment to the project team, (6) the adoption of a
systematic and transparent communication with the inter-
ested parties to increase transparency and awareness on risk
exposure among stakeholders, (7) the integration of the RKM
process into the PRM process, in order to obtain an
improved and systematised return on experience, as well the
enhancement of an enterprise learning process.
The emergent PRM framework for SMEs, arisen from the
literature analysis, could effectively foster PRM implementa-
tion in SMEs.

Moreover, the pieces of evidence and benefits of PRM
adoption in SMEs and the main factors enabling or hindering
its implementation in such companies are highlighted. The
analysis confirmed the existence of a positive relationship
between the adoption of PRM and a better strategic selec-
tion of projects for SMEs and the improvement of the overall
project performances together with positive impacts on
other managerial aspects. Further, this study reveals that the
relevant factors that could enable PRM implementation in
SMEs are related to an adequate selection of PRM and RKM
techniques and tools.
It should be noted that efforts to develop more flexible
and dynamic PRM frameworks and toolsets to accurately
assist SMEs in PRM implementation still need development.
The more interesting areas for further developments concern
the identification and measurement of benefits generated
through the implementation of PRM in SMEs in order to sup-
port the customization of the PRM approach based on
results (both PRM process implementation and PRM techni-
ques and tools selection), the integration of RKM into the
PRM process in order to leverage on risk knowledge to foster
PRM in SMEs, and the definition of holistic risk-categorization
structures for SMEs, useful for the identification of interrela-
tionships among risks, for risk prioritization, and above all,
for the classification and organization of information on risks
into a risk knowledge repository (risks database).
This analysis also has some limitations, mainly due to
the fact that the current state of the art of PRM imple-
mentation in SMEs and the needs of these companies
have been deduced from the still limited published papers,
which do not cover all business sectors and geographical
areas. Therefore, an empirical analysis of PRM implementa-
tion in SMEs would provide further elements for the
research; it could be initiated starting from the sectors
that typically operate on orders and which typically have
higher levels of maturity towards risk (for example, the
aerospace sector) and then extended to traditional SMEs
that operate by process and use projects for the purpose
of innovation.
In conclusion, this study, starting from a structured ana-
lysis of the literature, suggests an evolution in the approach
to PRM in SMEs, proposing an emergent framework that
could foster PRM in SMEs through the adoption of an
extended and iterative seven-step process, the reuse of infor-
mation on risks, the enhancement of best practices and les-
sons learnt, and the adoption of a flexible and dynamic
approach according to the characteristics of the SME and
the project.
Disclosure statement
No potential conflict of interest was reported by the author(s).
Funding
This work was supported by the University of Padova under Grant
[VERB_SID19_01].
PRODUCTION PLANNING & CONTROL 13
Notes on contributors
Raffaele Testorelli is a c-level manager and a man-
agement and business advisor with more than 20
years of professional experience. He is also a PhD
candidate in Management Engineering and Real
Estate Economics at the University of Padova. His
major research interests include innovation manage-
ment, program and project management, and risk
management in industrial context and in particular
project risk management. In these fields, he partici-
pated to various national and international industrial projects, across
multiple business sectors, with leadership roles.
Priscila Ferreira de Ara
ujo Lima is a post doctoral
research fellow at the Department of Management
and Engineering of the University of Padova (Italy).
After the Master Degree in Management Engineering
she received her Ph.d. in Management Engineering
and Real Estate Economics in 2020. Her major
research interests include risk management in indus-
trial context and in particular project
risk management.
Chiara Verbano is an associate professor of Business
and Engineering Economics at the Department of
Management and Engineering of the University of
Padova (Italy). Her major research interests include
R&D management and organization, risk manage-
ment both in industrial and clinical context and
healthcare operations management, In these fields,
she participated to various national and international
research projects, funded by public and private
organizations. She has regularly contributed to scientific journals as a
reviewer and she is author and co-author of more than 100 scientific
publications.
ORCID
Chiara Verbano http://orcid.org/0000-0002-2300-7235
References
Altman, E. I., G. Sabato, and N. Wilson. 2010. “The Value of Non-Financial
Information in Small and Medium-Sized Enterprise Risk Management.”
The Journal of Credit Risk 6 (2): 95–33. doi:10.21314/JCR.2010.110.
Aven, T. 2012. “The Risk Concept – Historical and Recent Development
Trends.” Reliability Engineering & System Safety 99: 33–44. doi:10.1016/
j.ress.2011.11.006.
Blanc Alquier, A. M., and M. H. Lagasse Tignol. 2006. “Risk Management
in Small-and Medium-Sized Enterprises.” Production Planning &
Control 17 (3): 273–282. doi:10.1080/09537280500285334.
Bush, J. K., W. S. Dai, G. S. Dieck, L. S. Hostelley, and T. Hassall. 2005.
“The Art and Science of Risk management: A US Research-Based
Industry Perspective.” Drug Safety 28 (1): 1–18. doi:10.2165/00002018-
200528010-00001.
Cagliano, A. C., S. Grimaldi, and C. Rafele. 2015. “Choosing Project Risk
Management Techniques. A Theoretical.” Journal of Risk Research 18
(2): 232–248. doi:10.1080/13669877.2014.896398.
Cavacini, A. 2015. “What is the Best Database for Computer Science
Journal Articles?” Scientometrics 102 (3): 2059–2071. doi:10.1007/
s11192-014-1506-1.
Cenciarini, R. A. 1998. Ristrutturazione e Crescita: le Strategie Adottate
Dalle Imprese di Successo. Luxembourg, Luxembourg: Giuffr e.
14 R. TESTORELLI ET AL.
Conroy, G., and H. Soltan. 1998. “ConSERV, a Project Specific Risk
Management Concept.” International Journal of Project Management
16 (6): 353–366. doi:10.1016/S0263-7863(98)00012-X.
Cooper, L. P. 2003. “A Research Agenda to Reduce Risk in New Product
Development through Knowledge Management: A Practitioner
Perspective.” Journal of Engineering and Technology Management 20
(1–2): 117–140. doi:10.1016/S0923-4748(03)00007-9.
Courtot, H. 1998. La Gestion Des Risques Dans Les Projects. Edition
Economica. Paris, France: Redsen Consulting.
Crovini, C., G. Santoro, and G. Ossola. 2020. “Rethinking Risk
Management in Entrepreneurial SMEs: Towards the Integration with
the Decision-Making Process.” Management Decision. Advance online
publication. doi:10.1108/MD-10-2019-1402.
Dallago, B., C. Guglielmetti, and M. Rondinelli. 2012. The Consequences of
the International Crisis for European SMEs: Vulnerability and Resilience.
Abingdon, UK: Routledge.
de Camprieu, R., J. Desbiens, and Y. Feixue. 2007. “Cultural’differences in
Project Risk Perception: An Empirical Comparison of China and
Canada.” International Journal of Project Management 25 (7): 683–693.
doi:10.1016/j.ijproman.2007.07.005.
De Loach, J. 2000. Enterprise-Wide Risk Management: Strategies for Linking
Risk and Opportunities. London, UK: Financial Times/Prentice Hall.
Delisle, S., and J. St-Pierre. 2003. “SME Projects: A Software for the
Identification, Assessment and Management of Risks.” Paper pre-
sented at the 48th World Conference of the International Council for
Small Business (ICSB-2003), Belfast, Northern Ireland, June 15–18.
Dey, P. K. 2012. “Project Risk Management Using Multiple Criteria
Decision-Making Technique and Decision Tree Analysis: A Case Study
of Indian Oil Refinery.” Production Planning & Control 23 (12):
903–921. doi:10.1080/09537287.2011.586379.
Elkington, P., and C. Smallman. 2002. “Managing Project Risks: A Case
Study from the Utilities Sector.” International Journal of Project
Management 20 (1): 49–57. doi:10.1016/S0263-7863(00)00034-X.
Emmenegger, S., E. Laurenzini, and B. Tho €nssen. 2012. “Improving
Supply-Chain-Management Base.” Paper presented at the
International Conference on Knowledge Management and
Information Sharing, Barcelona, Spain, October 4–7.
Fabac, R., D. Radosevi, and I. Pihir. 2010. “Frequency of Use and
Importance of Software Tools in Project Management Practice in
Croatia.” Paper presented at the 32nd International Conference on
Information Technology Interfaces, Cavtat, Croatia, June 21–24.
Goncalves, R. Q., E. D. Kuhlkamp, and C. G. Von Wangenheim. 2015.
“Enhancing dotProject to Support Risk Management Aligned with
PMBOK in the Context of SMEs.” International Journal of Information
Technology Project Management 6 (2): 40–60.
Guz, A. N., and J. J. Rushchitsky. 2009. “Scopus: A System for the
Evaluation of Scientific Journal.” International Applied Mechanics 45
(4): 351–362. doi:10.1007/s10778-009-0189-4.
Hajjaji, M., and P. D. Denton. 2011. “The Integration of Risk Management
into Maintenance Project Approaches For Manufacturing SMEs.” Paper
presented at the 21st International Conference on Production
Research: Innovation in Product and Production, ICPR21, Stuttgart,
Germany, July 31–August 4.
Henschel, T., and S. Durst. 2016. “Risk Management in Scottish, Chinese
and German Small and Medium-Sized Enterprises: A Country
Comparison.” International Journal of Entrepreneurship and Small
Business 29 (1): 112–132. doi:10.1504/IJESB.2016.078048.
Hillson, D. A. 1997. “Towards a Risk Maturity Model.” The International
Journal of Project & Business Risk Management 1 (1): 35–45.
Hussain, J., C. Millman, H. Matlay, U. C. E. Birmingham, and P. Barr. 2006.
“Access to Entrepreneurial Finance: An International Perspective.”
Paper presented at the International Conference on Financing of
SMEs in Developed Countries, Warwick, April 4–5.
Hwang, B.-G., X. Zhao, and L. P. Toh. 2014. “Risk Management in Small
Construction Projects in Singapore: Status, Barriers and Impact.”
International Journal of Project Management 32 (1): 116–124. doi:10.
1016/j.ijproman.2013.01.007.
Iskanius, P. 2009. “Risk Management in ERP Project in the Context of
SMEs.” Engineering Letters 17 (4): 1–8.
Islam, M. A., J. D. Tedford, and E. Haemmerle. 2008. “Managing
Operational Risks in Small-and Medium-Sized Enterprises (SMEs)
Engaged in Manufacturing–An Integrated Approach.” International
Journal of Technology, Policy and Management 8 (4): 420–441. doi:10.
1504/IJTPM.2008.020167.
ISO21500. 2012. “Guidance on Project Management.” International
Organization for Standardization. https://www.iso.org/standard/50003.
html
ISO31000. 2018. Risk management guidelines. Washington, DC:
International Organization for Standardization.
ISO9001. 2015. “Quality Management Systems Requirements.”
International Organization for Standardization. https://pecb.com/white-
paper/iso-90012015-quality-management-systems—requirements
Jafari, M., J. Rezaeenour, M. M. Mazdeh, and A. Hooshmandi. 2011.
“Development and Evaluation of a Knowledge Risk Management Model
for Project-Based Organizations a Multi-Stage Study.” Management
Decision 49 (3): 309–329. doi:10.1108/00251741111120725.
Jiang, J. J., G. Klein, and R. Discenza. 2001. “Information System Success
as Impacted by Risks and Development Strategies IEEE.” IEEE
Transactions on Engineering Management 48 (1): 46–55. doi:10.1109/
17.913165.
Jung, W., and S. H. Han. 2017. “Which Risk Management is Most Crucial
for Controlling Project Cost?” Journal of Management in Engineering
33 (5): 04017029. doi:10.1061/(ASCE)ME.1943-5479.0000547.
Keizer, J. A., J. I. M. Halman, and M. Song. 2002. “From Experience—
Applying the Risk Diagnosing Methodology.” Journal of Product
Innovation Management 19 (3): 213–232. doi:10.1111/1540-5885.1930213.
Kenley, R. 2003. Financing Construction: Cash Flows and Cash Farming.
Abingdon, UK: Taylor & Francis,
Kerzner, H. 2009. Project Management: A Systems Approach to Planning,
Scheduling, and Controlling. Hoboken, NJ: John Wiley.
Keupp, M. M., M. Palmi
e, and O. Gassmann. 2012. “The Strategic
Management of Innovation: A Systematic Review and Paths for
Future Research.” International Journal of Management Reviews 14 (4):
367–390. doi:10.1111/j.1468-2370.2011.00321.x.
Kirytopoulos, K., V. Leopoulos, and C. Malandrakis. 2001. “Risk
Management: A Powerful Tool for Improving Efficiency of Project
Oriented SMEs.” Paper presented at the 4th SMEs International
Conference, Aalborg, Denmark, February 4–7.
Leopoulos, V. N., K. A. Kirytopoulos, and C. Malandrakis. 2006. “Risk
Management for SMEs: Tools to Use and How.” Production Planning &
Control 17 (3): 322–332. doi:10.1080/09537280500285136.
Lima, P. F. A., and C. Verbano. 2019. “Project Risk Management
Implementation in SMEs: A Case Study from Italy.” Journal of
Technology Management & Innovation 14 (1): 3–10. doi:10.4067/S0718-
27242019000100003.
Lima, P. F. A., M. Crema, and C. Verbano. 2020. “Risk Management in
SMEs: A Systematic Literature Review and Future Directions.” European
Management Journal 38 (1): 78–94. doi:10.1016/j.emj.2019.06.005.
Macpherson, A., and R. Holt. 2007. “Knowledge, Learning and Small Firm
Growth: A Systematic Review of the Evidence.” Research Policy 36 (2):
172–192. doi:10.1016/j.respol.2006.10.001.
Marcelino-S
adaba, S., and A. P
erez-Ezcurdia. 2010. “Risk Management in
SME’s Tackled Projects.” Dyna 85 (6): 504–512.
Marcelino-S
adaba, S., A. P
erez-Ezcurdia, A. M. Echeverr
ıa Lazcano, and P.
Villanueva. 2014. “Project Risk Management Methodology for Small
Firms.” International Journal of Project Management 32 (2): 327–340.
doi:10.1016/j.ijproman.2013.05.009.
Marle, F., and L. A. Vidal. 2011. “Project Risk Management Processes:
Improving Coordination Using a Clustering Approach.” Research in
Engineering Design 22 (3): 189–206. doi:10.1007/s00163-011-0106-9.
Mehr, R., and B. Hedges. 1963. Risk Management in the Business
Enterprise. Homewood, IL: Irwin.
Morris, P. 1994. The Management of Projects. London, UK: Thomas Telford,
Mu, J., G. Peng, and D. L. MacLachlan. 2009. “Effect of Risk Management
Strategy on NPD Performance.” Technovation 29 (3): 170–180. doi:10.
1016/j.technovation.2008.07.006.
Mullai, A. 2006. Risk Management System - Risk Assessment Frameworks
and Techniques. Turku, Finland: DaGoB Publications.

Naude, M. J., and N. Chiweshe. 2017. “A Proposed Operational Risk
Management Framework for Small and Medium Enterprises.” South
African Journal of Economic and Management Sciences 20 (1): a1621.
doi:10.4102/sajems.v20i1.1621.
Neef, D. 2005. “Managing Corporate Risk through Better Knowledge
Management.” The Learning Organization 12 (2): 112–124. doi:10.
1108/09696470510583502.
Neves, S. M., C. E. S. da Silva, V. A. P. Salomon, A. F. da Silva, and B. E. P.
Sotomonte. 2014. “Risk Management in Software Projects through
Knowledge Management Techniques: Cases in Brazilian Incubated
Technology-Based Firms.” International Journal of Project Management
32 (1): 125–138. doi:10.1016/j.ijproman.2013.02.007.
OECD. 2012. Financing SMEs and Entrepreneurs 2012: An OECD
Scoreboard. Paris, France: OECD.
Oehmen, J., A. Olechowski, C. R. Kenley, and M. Ben-Daya. 2014.
“Analysis of the Effect of Risk Management Practices on the
Performance of New Product Development Programs.” Technovation
34 (8): 441–453. doi:10.1016/j.technovation.2013.12.005.
Ojala, M. 2006. “Risks and Risk Management in ERP Project – Cases in
SME Context.” Paper presented at the 9th International Conference
on Business Information Systems, Klagenfurt, Austria, May 31–June 2.
Osipova, E., and P. E. Eriksson. 2013. “Balancing Control and Flexibility in
Joint Risk Management: Lessons Learned from Two Construction
Projects.” International Journal of Project Management 31 (3): 391–399.
doi:10.1016/j.ijproman.2012.09.007.
Pereira, L., A. Tenera, J. Bispo, and J. Wemans. 2015. “A Risk Diagnosing
Methodology Web-Based Platform for Micro, Small and Medium
Businesses: Remarks and Enhancements.” Communications in
Computer and Information Science 454: 340–356.
Pereira, L., A. Tenera, and J. Wemans. 2013. “Insights on Individual’s Risk
Perception for Risk Assessment in Web-Based Risk Management
Tools.” Procedia Technology 9: 886–892.
Pisano, G. P. 2006. “Can Science Be a Business? Lessons from Biotech.”
Harvard Business Review 84 (10): 114–125.
PMI. 2017a. The Standard for Portfolio Management. 4th ed. Newton
Square, PA: Project Management Institute.
PMI. 2017b. A Guide to Project Management Body of Knowledge: PMBoK
Guide. 6th ed. Newton Square, PA: Project Management Institute.
Porter, M. E., and M. R. Kramer. 2006. “The Link between Competitive
Advantage and Corporate Social Responsibility.” Harvard Business
Review 84 (12): 78–92.
Purdy, Grant. 2010. “ISO 31000:2009-Setting a New Standard for Risk
Management.” Risk Analysis 30 (6): 881–886. doi:10.1111/j.1539-6924.
2010.01442.x.
Qazi, A., J. Quigley, A. Dickson, and K. Kirytopoulos. 2016. “Project
Complexity and Risk Management (ProCRiM): Towards Modelling
Project Complexity Driven Risk Paths in Construction Projects.”
International Journal of Project Management 34 (7): 1183–1198. doi:10.
1016/j.ijproman.2016.05.008.
Radner, R., and L. Shepp. 1996. “Risk vs. Profit Potential: A Model for
Corporate Strategy.” Journal of Economic Dynamics and Control 20 (8):
1373–1393. doi:10.1016/0165-1889(95)00904-3.
Raz, T., and E. Michael. 2001. “Use and Benefits of Tools for Project Risk
Management.” International Journal of Project Management 19 (1):
9–17. doi:10.1016/S0263-7863(99)00036-8.
Rowe, S. F. 2007. “Project Management for Small Projects.” Paper pre-
sented at the PMI Global Congress 2007. Atlanta, GA, October 6–9.
Scherer, F. M. 1988. “Corporate Takeovers: The Efficiency Arguments.”
Journal of Economic Perspectives 2 (1): 69–82. doi:10.1257/jep.2.1.69.
Sharif, A. M., and M. Z. A. Rozan. 2010. “Design and Implementation of
Project Time Management Risk Assessment Tool for SME Projects
Using Oracle Application Express.” World Academy of Science,
Engineering and Technology – International Journal of Computer and
Information Engineering 4 (5): 1029–1034.
PRODUCTION PLANNING & CONTROL 15
Sharif, A. M., S. Basri, and H. O. Ali. 2013. “A Study on SME Software
Development Background and Risk Assessment Implementation in
Malaysia.” World Applied Sciences Journal 12: 1637–1642.
Simon, M., S. M. Houghton, and K. Aquino. 2000. “Cognitive Biases, Risk
Perception, and Venture Formation: How Individuals Decide to Start
Companies.” Journal of Business Venturing 15 (2): 113–134. doi:10.
1016/S0883-9026(98)00003-2.
Smith, P. G., and G. M. Merritt. 2002. Proactive Risk Management:
Controlling Uncertainty in Product Development. New York, NY:
Productivity Press.
Smith, P. G., and R. Pichler. 2005. “Agile Risks/Agile Rewards.” Software
Development 13: 50–53.
Tang, L. C. M., A. Y. T. Leung, and C. W. Y. Wong. 2010. “Entropic Risk
Analysis by a High Level Decision Support System for Construction
SMEs.” Journal of Computing in Civil Engineering 24 (1): 81–94. doi:10.
1061/(ASCE)0887-3801(2010)24:1(81).
Toulov
a, M., M. Tuzov
a, and L. Vesel
a. 2016. “Key Risk Factors in
Internationalisation of Czech Engineering Small and Medium-Sized
Firms.” International Journal of Business and Globalisation 17 (3):
404–422. doi:10.1504/IJBG.2016.078840.
Tranfield, D., D. Denyer, and P. Smart. 2003. “Towards a Methodology for
Developing Evidence-Informed Management Knowledge by Means of
Systematic Review.” British Journal of Management 14 (3): 207–222.
doi:10.1111/1467-8551.00375.
Turner, J. R., A. Ledwith, and J. Kelly. 2009. “Project Management in
Small to Medium-Sized Enterprises: A Comparison between Firms by
Size and Industry.” International Journal of Managing Projects in
Business 2 (2): 282–296. doi:10.1108/17538370910949301.
Turner, J. R., A. Ledwith, and J. Kelly. 2010. “Project Management in
Small to Medium-Sized Enterprises: Matching Processes to the Nature
of the Firm.” International Journal of Project Management 28 (8):
744–755. doi:10.1016/j.ijproman.2010.06.005.
Turner, R., and A. Ledwith. 2018. “Project Management in Small to
Medium-Sized Enterprises: Fitting the Practices to the Needs of the
Firm to Deliver Benefit.” Journal of Small Business Management 56 (3):
475–493. doi:10.1111/jsbm.12265.
Verbano, C., and K. Venturini. 2011. “Development Paths of Risk
Management: Approaches, Methods and Fields of Application.” Journal
of Risk Research 14 (5): 519–550. doi:10.1080/13669877.2010.541562.
Voss, C., N. Tsikriktsis, and M. Frohlich. 2002. “Case Research in Operations
Management.” International Journal of Operations & Production
Management 22 (2): 195–219. doi:10.1108/01443570210414329.
Wacker, J. G. 1998. “A Definition of Theory: Research Guidelines for
Different Theory-Building Research Methods in Operations
Management.” Journal of Operations Management 16 (4): 361–385.
doi:10.1016/S0272-6963(98)00019-9.
Willumsen, P., J. Oehmen, V. Sting, and J. Geraldi. 2019. “Value Creation
through Project Risk Management.” International Journal of Project
Management 37 (5): 731–749. doi:10.1016/j.ijproman.2019.01.007.
Wohlin, C. “Guidelines for Snowballing in Systematic Literature Studies
and a Replication in Software Engineering.” 2014. Paper presented at
the 18th International Conference on Evaluation and Assessment in
Software Engineering, New York, NY, May 13–14.
WTO. 2016. “World trade report.” World Trade Organization. https://www.
wto.org/english/res_e/booksp_e/world_trade_report16_e.pdf
Yang, C., and Z. Man-Li. 2010. “Research on Product Innovation Project
Risk Identification Thought.” Paper presented at the International
Conference on Information Science and Engineering, Xi’an, China,
August 7–8.
Yeo, K. T., and Y. T. Ren. 2009. “Risk Management Capability Maturity
Model for Complex Product Systems (CoPS) Projects.” Systems
Engineering 12 (4): 275–294. doi:10.1002/sys.20123.
Yun-Hong, H., L. Wen-Bo, and X. Xiu-Ling. 2007. “An Early Warning
System for Technological.” Paper presented at the 2007 International
Conference on Management Science & Engineering, Harbin, China,
August 20–22.