Enterprise risk management in small and medium family enterprises: the role of family involvement and CEO tenure

Taking the right amount of risk is essential for successful business. As a response to the importance of risk management, the effectiveness and implementation of enterprise risk management (ERM) systems are recently discussed in literature. However, smaller firm entrepreneurs often deal with this challenge in practice in a more informal way. Most of these small and medium-sized enterprises (SME) are family firms, where family dynamics further influence their risk behaviour. Addressing the missing implementation of ERM in Small and Medium Family Enterprises (SMFE), we first analyse how ERM influences the performance of SMFE. In a second step, we investigate the impact of CEO tenure and family involvement as moderators on the ERM – performance relationship. Regression analysis on a sample of 116 Austrian SMFE shows that ERM implementation does not directly influence financial performance. CEO tenure and family involvement, however, both show significant moderating effects on the ERM – performance relationship. Adding to current literature on the topic, this study reveals that ERM performance is positively moderated by CEO tenure and negatively by family involvement.


Introduction
The last economic crises showed the increasing dynamics and complexity of markets evoking a hot debate about the importance of implementing enterprise risk management (ERM) (McShane 2018;Bromiley et al. 2015). Various studies support cost reductions and better performance by implementing ERM (Chen et al. 2019;Hoyt and Liebenberg 2011;Pagach and Warr 2011). Even for Small and Medium Enterprises (SME) the awareness of the importance of managing risks and develop risk models (Angeline and Teng 2016;Altman et al. 2010) to perform successfully in a competitive market has risen (Yang et al. 2018). Risks that endanger their competitive advantage might come from innovative technology, legislation or a more globalized market and the entrance of new niche competitors (Laforet and Tann 2006). On the other hand, ERM risk identification is also opportunity recognition and allows innovative business solutions. SME have restricted capital and human resources making them more vulnerable to external economic shocks (Rehman and Anwar 2019;Wright et al. 2001). ERM may be used to prevent or mitigate the effects of such shocks (Chen et al. 2019;Yang et al. 2018;Falkner and Hiebl 2015).
However, ERM might be a substantial cost factor for SME, putting pressure on the limited financial resources. In addition, the entrepreneur might be able to identify risks informally not feeling any need of formalizing or rendering information explicit and transparent (Cantonnet et al. 2019). Thus, the impact of ERM on SME performance seems not to be straightforward. To assess this basic ERM-performance relationship seems necessary, since informal management structures tend to dominate in SME pointing towards trade-offs because of the costs of implementing ERM (Brustbauer 2014;Arocena and Núñez 2010). ERM studies using samples of SME are only in the beginning (Rehman and Anwar 2019;Angeline and Teng 2016), while suggesting that certain ERM elements impact SME performance (Yakob et al. 2020) and ERM working as moderator for increasing competitive advantage (Yang et al. 2018). When looking at the informal decision-making processes one should not forget that the majority of SME are family firms Eurostat 2011). Family firm theory, including agency theory (Hiebl et al. 2019), behavioral agency model and socio-emotional wealth (Gomez-Mejia et al. 2017), point to different dynamics in family firms influencing the trade-off of costs and benefits of ERM, leading to heterogeneity among the firms. Therefore, we focus on small and medium family enterprises (SMFE) leaving other important characteristics relevant for the ERM adoption trade-off for further research.
In this study, we specifically focus on two characteristics of SMFE, namely CEO tenure and family involvement, as they are intimately involved with information flows in firms. In SMFE, owner-managers typically decide how much risk is taken, which makes the decision process fast, however, dependent on the owner-managers ability to identify and assess risks (Feltham et al. 2005). Independent on the effectiveness of such risk assessment, a family member is not easily removable from the business in times of crises (Kellermanns et al. 2008). This results in a longer CEO tenure (Kellermanns et al. 2008), which was found to negatively influence risk taking (Zahra 2005). In addition, as Finkelstein and Hambrick (1990) point out, longer CEO tenure may result in restricted information processing and analysis. To prevent negative effects of missing information in the firm, ERM might have more benefits for firms with longer-serving CEOs. On the other hand, more generations of family members might be involved in the daily business of SMFE (Gallucci et al. 2015), which may increase diversity and thus prevent the family firm from falling into rigid routines and losing the innovational edge. Other family members might also influence the risk assessment of the ownermanager and therefore the necessity of ERM implementation. In this way, family involvement may also enhance the informal information flows in the firm, making ERM more costly.
To our best knowledge, we are the first to assess the influence of ERM on SMFE performance dependent on the SMFE characteristics of CEO tenure and family involvement. By studying SMFE, we follow the calls for examining ERM in family firms (Hiebl et al. 2019) and in SME (Rehman and Anwar 2019;Falkner and Hiebl 2015) applying a resource-based view (Wright et al. 2001). We therefore propose that the need for investing resources of the firm into a formal ERM depends on the ability of the entrepreneur to use resources, and identify and assess risks informally given different levels of CEO tenure and family involvement. Specifically, we investigate the riskperformance relationship and its moderation by CEO tenure and family involvement for Western Austrian tourism SMFE. The Western Austrian tourism industry is heavily shaped by SMFE making it an appropriate sample, with all firms facing a similar risk structure (Glowka and Zehrer 2019). Next, the literature review develops the theoretical background of this work and models the hypotheses tested in this study. This is followed by a section on methodology, results and conclusions including implications for theory and practice.

Theoretical background
Operating in uncertain and ever-changing environments, SMFE constantly have to make decisions under risk, which greatly influence their financial performance (McShane 2018;Ellul and Yerramilli 2013;Aebi et al. 2012). The concept of risk is traditionally based on a scenario that bears consequences together with probabilities that these will occur (Kaplan and Garrick 1981), while the common ground of different approaches is "the distinction between reality and possibility" (Renn 1998, p.50). However, risk can also be defined in a wider approach, e.g. following Brühwiler (2011), who identifies risk as a threat that might lead to a deviation from future goals. This reflects the current trend in risk research to consider uncertainty rather than probabilities and to tentatively incorporate more insecurity and define risks more generally (Shortridge et al. 2017). For example, Aven et al. (2013) incorporate background knowledge used in the risk assessment process in their description of risk.
In this wider view on risk management, ERM emerged as a management approach to assess all kinds of different risks regarding the business (Chen et al. 2019;Gatzert and Martin 2015). For the purpose of this research, we follow Yang et al. (2018), p.2) and Gatzert and Martin (2015, p. 32) defining formal ERM as.
"a process, effected by an entity's board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risks to be within its risk appetite, to provide reasonable assurance regarding the achievement of the entity's objectives". (Committee of Sponsoring Organizations of the Treadway  Commission 2004, p. 2).
Generally, higher risk taking is positively related to performance according to entrepreneurship literature (Rauch et al. 2009). However, offensive risk taking is not leading to success, but rather identifying innovative opportunities and proactively pursuing them with a willingness to take risks (Miller 1983). Risk identification, monitoring and assessment is therefore at the heart of the entrepreneurial process (Brühwiler 2011). If risks are identified and understood, they might become opportunities and enhance the potential for risk taking and innovation (Eshima and Anderson 2017). Implementing a formalized ERM system as defined above, therefore, while reducing risks, also impacts better risk-taking (Stulz 2015).
For SMFE, too, the awareness of the importance of managing risks to perform successfully in a competitive market has risen (Yang et al. 2018). However, the cost benefit analysis of implementing a formal ERM is different for SMFE compared to large firms. From a resource-based view (Barney 1991), larger firms have more resources available than SMFE and often employ a risk manager or form expert boards of directors for risk management, while in SMFE usually firm owners manage risk and take the decisions (Watt 2007). One major benefit of ERM, also for SMFE, is that implicit knowledge is made explicit and that a more complete picture of the firms arises. The advantage of ERM is that shared causes for risks are identified and assessed, while information asymmetries, that would help reduce related risks, are decreased (Hoyt and Liebenberg 2011). This may be useful whenever communication is necessary, e.g. in financial negotiations with banks, but also in easing succession problems. In addition, systematic risk identification through ERM might also be showing unrecognized opportunities especially for rapidly changing and new environments and allows innovative business solutions (Rehman and Anwar 2019).
In an SME context, recent studies find that the relationship of business strategy and SME performance is partially mediated by ERM (Rehman and Anwar 2019). In addition, ERM positively impacts SME performance and competitive advantage (Yang et al. 2018). While Yakob et al. (2020), p. 164) find an overall positive effect of ERM on SME performance, this is due to "only one element of ERM i.e. objective determination has a significant effect on SME performance, while the remaining seven elements namely internal environment, identification of risk events, risk assessment, risk response, activity control, information and communication, and monitoring were found to be insignificant." Brustbauer (2014) finds two different clusters of SME which he calls "active ERM approach" with high and "passive ERM approach" with low risk management activity. Active SME are strategically offensive trying to increase their competitive advantage and grow. Passive SME aim for long-term stability conducting defensive strategies. These firms are generally less keen on expanding and investing in risky capital. Based on the past decades of research, SMFE seem to be more long-term oriented and probably tend towards a passive ERM approach (Brustbauer 2014).
Despite all promising improvements of ERM implementation, the cost factor is the major counterargument (Chen et al. 2019) for SME having restricted capital and human resources (Larsson et al. 2007). Missing organizational structures and the absence of guidelines on how to implement or adapt ERM for the SME sector are barriers to implement ERM successfully (Brustbauer 2014). Additionally, research points out that many SME are not convinced that they need a formalized risk management and often implement risk measures only to meet legal restrictions (Cantonnet et al. 2019;Bonafede et al. 2016). Regarding risk management, SME often deploy a reactive strategy, rather than proactively managing risks (Falkner and Hiebl 2015). Generally, being more agile, communicating informally and having flat organizational hierarchies are characteristics of SME which all contribute to a more effective informal risk management (Agostini and Nosella 2019).
To sum up, as theory and the literature suggest it is far from obvious, if for SMFE managing risk formally or informally, is better for performance. Most likely, the heterogeneity of firms will influence the overall relationship of ERM and performance, which makes it necessary to look at firm characteristics influencing the cost and benefits of ERM and thus acting as moderating variables. Thus, our focus lies on SMFE.
The vast majority of SME are family firms Eurostat 2011). Typically, an owner-manager is in charge of the SMFE (Feltham et al. 2005). Such firms have longer CEO tenure than non-family firms do, which in turn influences the entrepreneurial behavior (Kellermanns et al. 2008). One reason is that firing or replacing a family CEO is not an easy task due to different ownership structures. Over the years, the CEO contributes essentially to the entrepreneurial culture and nature of the firm (Kellermanns et al. 2008). Family CEOs gain an industry and firm-specific knowledge, which makes them experts in their field, however reduces opportunities in other industries (Revilla et al. 2016). Often, the owner-manager builds personal relationships important for performance, which is a special characteristic of family firms (Gersick et al. 1997). Therefore, professionalization in the case of family firms may lead to negative reactions of business partners, who build trustworthy relationships with the family over the years (Zhang and Ma 2009). Other research reveals that family firms tend to have more informal structures, while non-family firms are more formal (Kotey 2005). In family firms, agency problems are considered less present due to an aligned management and ownership structure (Fama and Jensen 1983), which reduces the need to professionalize (Stewart and Hitt 2012). In the same vein, ERM literature assesses that owner-managed firms are less likely to implement ERM (Paape and Speklè 2012). Hiebl et al. (2019) find a lower ERM adoption in family firms and this effect increases when a family CEO manages the family firm. All these findings seem to suggest that for SMFE the owner-manager management style and knowledge are an important characteristic also for the level of formal or informal control in managing the risk.
However, there is also the argument that there might be the need for becoming more professionalized (Stewart and Hitt 2012). At a certain point of the business life cycle, SMFE have to implement formal structures to cope with the increasing complexity of its operations, however, this requires resources, which are limited in SMFE (Massaro et al. 2016;McAdam and Reid 2001). Another breaking point for SMFE is leadership succession, which is often problematic (Ward 2011), since it involves a change in the family, a change in the ownership profile, as well as a change in the business (Leiß and Zehrer 2018). Having a professionalized and formal risk management system might help to make this transition smoother by enhancing the knowledge transfer.
In SMFE, family CEOs are not replaced by other managers, which contributes to longer CEO tenure (Huybrechts et al. 2013). Zahra (2005) finds that CEO tenure has a negative effect on entrepreneurial risk taking. Other studies support that longer CEO tenure results in less innovative behavior of the firm and believe this is due to inertia, which constrains the ability to adapt to change and stay competitive (Hambrick and Finkelstein 1987). While longer CEO tenure might favor the establishment of relationships and informal risk taking, the CEO can miss to stay open-minded because of developing routines and rigid habits. Relevant information for the risk identification process might be ignored or lost due to the focus of maintaining the business rather than staying innovative and taking risk (Finkelstein et al. 1996). Thus, one way to prevent inertia is introducing a more professional process structure of ERM into the business that requires transparency. In this case, ERM would help to mitigate the negative effects of inertia provoked by longer CEO tenure.
However, the longer the CEO tenure lasts the more likely it is that different generations of the family work in the company, which impacts the organizational structure and business decisions (Samara and Berbegal-Mirabent 2018;Kellermanns et al. 2008). With its involvement in the daily management, the family keeps control and pursues family-centered goals and interests (Yeniaras et al. 2017;Gallucci et al. 2015). SMFE follow a shared family vision of the business and have goals like passing the business to the next generation and protecting the family wealth (Berrone et al. 2012;Gómez-Mejía et al. 2007). Thus, the value of non-economic, family-related goals contributes to a distinct set of priorities that are important for SMFE, which impacts the risk taking behavior and risk management ( Often, succeeding generations grow up working in the family business (Alessandri et al. 2018). This enables them to gain tacit know-how of the industry (Gallucci et al. 2015). Working in the business, members bring in new ideas and have different opinions on strategic decisions (Revilla et al. 2016). If this involvement of different generations works, smoothly implementing ERM becomes less relevant. However, family involvement can also result in agency conflict between family members (Madison et al. 2016;González-Cruz and Cruz-Ros 2016;de Massis et al. 2015). Formal control mechanism like ERM might lead to better performance by reducing conflicts. However, Kallmuenzer et al. (2018) found more complex results of the effects implementing control mechanisms in SMFE specifically innovativeness had a less positive effect on performance when control mechanisms are present.

Hypotheses and model development
To our best knowledge, the effect of ERM on performance has not been assessed in a SMFE context. As shown in the literature review, ERM is widely considered state of the art of risk management for large firms and most results showed a positive impact of ERM on firm performance (McShane 2018; Bromiley et al. 2015). However, when looking at SMFE, the relationships within the firm need more attention. Firstly, the formalization of risk management in the form of ERM bears costs and requires investing in resources for the company (Yakob et al. 2020). This implies that ERM might only be profitable for a certain firm size (Hiebl et al. 2019). However, in an SME context, recent studies find that the relationship of business strategy and SME performance is partially mediated by ERM (Rehman and Anwar 2019) and ERM positively impacts SME performance and competitive advantage (Yang et al. 2018). In addition, Yakob et al. (2020) also find a positive influence of ERM on SME performance.
Based on these results, we assume that ERM generally has a positive effect on firm performance of SMFE once firm size, firm age and risk propensity are controlled for.
Hypothesis 1: ERM shows a positive effect on SMFE performance.
Secondly, ownership structures matter for the decision between formal and informal risk management. The ERM literature assesses that owner-managed firms, which is usually the case for SMFE, are less likely to implement ERM due to less agency conflicts (Paape and Speklè 2012). Apart from agency conflicts, which seem to be less relevant in this context for SMFE the major impact of the ownership structure for the effectiveness of risk management is how it impacts risk taking and opportunity recognition and how it influences the information flows and transparency inside the firm. As shown above, one can argue that an informal risk management is working better if there is sufficient information and flexibility while ERM is preferable if there is need for risk identification and transparency. From the literature review, the length of CEO tenure (Kellermanns et al. 2008;Feltham et al. 2005) and the level of family involvement Cabrera-Suarez et al. 2001) seem to be important factors for different risk taking decisions in SMFE. We therefore investigate if they have moderating effects on the ERM-performance relationship. Based on the review above we argue that CEO tenure would have a positive moderating effect on ERM because the formalization of the risk management might prevent rigidity and enhance innovation and transparency.
Hypothesis 2: There is a positive moderating effect of CEO tenure and ERM on SMFE performance.
Various generations of family members working in the SMFE might also generate the advantage of new knowledge and thus informal risk identification and assessment of different aspects (Zahra 2005). This can compensate the tendency of aging SMFE not adopting to change and applying conservative strategies, which includes not taking too many risks (Zahra 2003). A reason for this might be that different generations bring in new perspectives on the business. Research shows that the generations of founders and successors behave differently (Veider and Kallmuenzer 2016) and thus also might vary in their risk management, e.g., how they identify and assess risk. Therefore, the SMFE might be able to identify a wider variety of risks informally in case of more family involvement. If such an informal risk management is working well, the need for a professionalized, firm-wide ERM implementation decreases: Hypothesis 3: There is a negative moderating effect of family involvement and ERM on SMFE firm performance.
We summarize the theoretical framework in Fig. 1 (see below).

Sampling and data collection
We conducted a questionnaire survey directed to family business owners for the purpose of this research. The survey was distributed to an email list of 895 randomly selected family firms from the three Austrian states of Vorarlberg, the Tirol and Salzburg, provided by the Austrian Chamber of Commerce. We checked via desk research that these firms fulfilled the criteria for common family business classifications: that require a majority of family ownership (Zahra 2003) and involve at least two members of the family in the management and daily business activities (Chua et al. 1999). The research context region is heavily dependent on the tourism industry and characterized by community type destinations such as Kitzbühel or Sölden that have a high number of family firms, which are strongly embedded in the local community (Zehrer and Hallmann 2015;Zehrer et al. 2014). There are several characteristics, which make this sample interesting. In these mountain regions, SMFE are heavily involved in the community, establishing societal meaning to their stakeholders (Glowka and Zehrer 2019). They build the economic ground of the regions, offering job opportunities and fostering regional development (Kallmuenzer and Peters 2017).
After choosing the constructs for measuring the different variables in the literature, German native speakers collaborated to translate the constructs, ensuring accuracy and liability. Finally, SMFE owners from the target regions filled out 13 pretests. The data collection took place between 16th of March and 1st of May 2016. 116 firms completed the questionnaire, which equals a sound overall response ratio of 13.0% that can be compared to similar family business studies (e.g. Sieger et al. 2013). Although the sample size is not large, the typical heuristics of 15 to 20 observations per variable is still valid for regression analyses (Ogundimu et al. 2016;Siddiqui 2013). Table 1 summarizes the descriptive statistics of the sample. It indicates that all firms own at least 90% of their business are of diverse longevity and are all SME with less than 180 employees. One to four generations are involved in the business, while the majority of the firms only have one (31.9%) or two generations (54.3%) actively involved compared to a smaller amount of firms where three (11.2%) or four or more generations are involved. While, on average, three family members are working actively in the company, two family members are managing on average. The average length of tenure among family firm CEOs is nearly 18 years, while the longest CEO tenure is 50 years. In this study, 71 of the CEOs were male; their average age was 49 years. Overall, the sample was largely composed by hotels (93.1%), completed with + -Performance CEO tenure Family involvement ERM Fig. 1 Research model a small amount of retail firms (5.2%) and some service agencies (1.7%). Firm sizes distribution and further descriptive statistics are shown in Table 1.

Measurement
For the testing of the hypotheses stated above, regression analysis is used. As a proxy for the existence of ERM in a firm, we include CRO appointment, which is often used as a measure for ERM adoption (Beasley et al. 2005;Pagach and Warr 2011;Hoyt and Liebenberg 2011).
In addition, we used the risk identification dimension of the ERM scale by Brustbauer (2014). This is a four item construct: 1) Risk experts in company: Qualified employees focus exclusively on identifying risks. 2) Outsourced risk management: Our company employs external experts to identify risks. 3) Use of risk manuals: Our company writes a report on identified risks. 4) Professional consulting: Our company seeks professional advice as needed. Responses for ERM items were given on a 7-point Likert scale, ranging from 1 ('strongly disagree') to 7 ('strongly agree'). Further, the regression incorporates two contextual factors specific to family firms. CEO tenure was measured by the number of years the current CEO held this position and designed as an open answer for the indication of years (Zahra 2005). Family involvement was measured by asking how many different generations of the owner family are actively involved in running the family business. Responses were given in full numbers from 1 to for 4 as for the generations involved and more if there were more than four generations involved in the business (Zahra 2005).
The dependent variable in the regression is firm performance. Following Lumpkin and Dess (2001), the family firms were asked how they consider their own performance compared to competitors within the last three years on a seven point Likert scale (1 = low performance, 7 = high performance). Sales growth, gross profit, net profit and return on sales served as financial ratio items (Lumpkin and Dess 2001). Additionally, return on equity, return on investment and enterprise value were measured as valuation items (Becker 2005). In this study, we control for firm size, firm age and risk propensity. As common, firm size and firm age are important control variables (Lee and Chu 2017;Hoyt and Liebenberg 2011;Brustbauer 2014). The number of employees working in the family business measures firm size. The founding year indicates firm age. In addition, risk propensity is an important control variable when studying ERM in family firms. Although the majority of research finds that family firms are risk averse, some results for risk taking in family firms remain contradictory, recently suggesting more complexity to the topic (Lee et al. 2018). Naldi et al. (2007), for example, find that risk taking relates negatively to family firm performance in their study. Thus, we control for risk propensity in this study to prevent wrong implications, if the risk propensityperformance relationship does not positively correlate as expected by the majority of the literature (Lee et al. 2018). Measuring risk propensity is based on Block et al. (2015). The first item consists of a seven point Likert scale measuring the willingness to take risks: 1) Willingness: In your entrepreneurial decisions, are you prepared to take risks, or do you try to avoid taking risks? Secondly, participants play a lottery. The second item is called 2) Lottery investment: "Imagine you have won €100,000 in a lottery. After having received the money, you have the possibility to invest the money in an entrepreneurial activity. With a probability of 50%, you double the amount. With a probability of 50%, you would lose half of the invested money. How much money obtained from the lottery would you invest?" Investing is possible in intervals of € 10.000 from €0 up to €100.000 as in Block et al. (2015).
Finally, the regression specification for testing the hypothesis is the following: Firm Performance ¼ a*ERM þ b*CEO tenure þ c*Family Involvement þ d*Firm Age þ e*Firm Size þ f *Risk Propensity þ g*ERM*CEO tenure þ h*ERM*Family Involvement:

Results
This section reports the results of the data analysis. Table 2 summarizes the Spearman's correlations including the means and standard deviations. All correlations are below the recommended threshold of .65 and thus indicate that multi-collinearity is not an issue (Tabachnick et al. 2007).
Regarding validity of the data, we first conduced an exploratory factor analysis (EFA), which assesses the degree of internal cohesion of the constructs. Factor loadings were above .5 for all items, indicating acceptable levels of validity (Hair et al. 2006) (Table 3).
Second, we conducted Cronbach's alpha to assess the reliability of the constructs. The minimum score of α > 0.7 (Alpha) was the necessary requirement (Hair et al. 2006), commonly used in current family business research (Arzubiaga et al. 2018;Lee and Chu 2017;Memili et al. 2010). Both scores for ERM and financial performance passed this threshold, respectively, and thus fulfilled the necessary requirements. To pass the average variance extracted (AVE), principal component analysis concerned a threshold score of 50%, yet ideally around 70% (Lee and Chu 2017;Memili et al. 2010). The AVE scores were 56.960 for risk propensity, 54.864 for ERM, 55.594 for generational ownership and 72.135 for financial performance, indicating that our constructs seemed to be reliable and valid (Hair et al. 2006).
The results for the regression analyses are shown in Table 4. ERM shows no significant effect on financial performance. Therefore, Hypothesis 1 cannot be confirmed. The moderating effects of CEO tenure and the family involvement, however, both show significant effects on the ERM-performance relationship of family firms, confirming Hypotheses 2 and 3. Hypothesis 2 states that the moderating effect on ERM and CEO tenure positively affects firm performance (β = 0.010, p < 0.05). Hypothesis 3 argued that the moderating role of family involvement and ERM on the firm performance is negative. The regression coefficient is negative and significant (β = − 0.261,  Enterprise value (EV) 0.700 p < 0.05) supporting hypothesis 3. Firm age as control variable has no significant effect in the regression analysis. Firm size and risk propensity have the usual positive impact on performance, both effects being significant in our data. R 2 and adjusted R 2 remain relatively low, explaining 19.5% of the variation in SME performance in Model 3. However, the F value for Model 1 is F = 5.344 with ρ = 0.002, for Model 2 F = 2.840 with ρ = 0.013 and for Model 3 F = 3.239 with ρ = 0.002, implying significance at 1% and 5% level respectively. In addition, Yakob et al. (2020) find comparable values of R 2 , adjusted R 2 in their recent study of ERM on SME performance.

Discussion
In terms of theoretical implications, the findings of the study make a valuable contribution to the debate on issues surrounding ERM in SMFE. Several patterns and observations emerge from our findings, which increase the knowledge about the benefits of ERM for SMFE. We find that in the case of SMFE, ERM has no significant direct effect on firm performance. The most likely explanation is that the firms in the sample are rather small and thus, costs and needed resources for establishing ERM and formalizing risk management are too high. Bearing in mind our specific sample of SMFE operating in the tourism industry, the result suggests that the positive impact of ERM on firm value has to be analyzed for different size and industry separately as it seems that studies on large firms or high risk sectors do not generalize easily (McShane 2018; Gatzert and Martin 2015).
The argument of too high costs has to be regarded in relation to the benefits resulting from ERM, which consist mainly in more pervasive and systematic information about processes, risk and opportunities. In SMFE, usually all available information passes to the owner-manager and is concentrated in one person. This however, might offset the need for ERM as a catalyst to be able to form strategies and make the right decisions for increasing the performance of the firm. This is in line with the findings of Paape and Speklè (2012) that owner-managed firms are less likely to implement ERM. As long as the information flows are working well, ERM is not generating sufficient value added. However, also SMFE may face difficulties e.g. because of succession or because it loses its completive advantage in its niche because of changes in the business environment. Interestingly, some authors find that ERM moderates the effect of business strategy on performance, as well as it moderates the effect of competitive advantage on performance (Rehman and Anwar 2019;Yang et al. 2018). They find that financially educated owner-managers benefit from ERM, presumably because they can understand the information provided by ERM and use it (Yang et al. 2018).
The common thread between these findings and the moderating variables is that they are linked to the crucial information flows specific to family firms. CEO tenure can be thought of as a proxy for the danger of increasing rigidity and problems with the information flows, while family involvement points to a vibrant and agile SMFE with well working communication structures. The first moderating effect of ERM and CEO tenure examined is significantly positive. This shows that ERM might provide a way to inhibit stagnation of family firms evoked through long CEO tenures and their failure towards risk taking (Zahra 2005). ERM therefore provides a structure for a systematized approach for firm-wide risk management (Bromiley et al. 2015) in case of deficient information flows. An additional effect might be that more knowledge on risk is more easily accessible and transferred, e.g. in case of leadership succession.
The second moderating effect of ERM and family involvement on performance is significantly negative. Thus, the costs of ERM implementation exceed the benefits of an ERM approach to professionalized risk management in firms with high family involvement. This could be an indicator that more generations actively involved in managing the family business increase the ability to identify risks and opportunities, supporting the idea that family members bring in new ideas and have different opinions (Revilla et al. 2016). In line with this argument is that family businesses "provide the seedbed for nurturing entrepreneurial talent across generations" (Wang and Poutziouris 2010, p. 370) and so are able to stay competitive over years. For a very specific sample, this study does not support the findings from recent research in which family involvement affected innovation or performance negatively (Arzubiaga et al. 2018;Stewart and Hitt 2012).
The study makes several theoretical contributions to the literature and adds to the current body of ERM in SMFE. First, from a theoretical perspective, Yakob et al. (2020) propose the resource-based view as a theoretical lens to understand ERM in SME, which was also applied in the current paper. Therefore, we also argue based on the resource-based view that SME have restricted capital and human resources that are relevant for the cost-benefit analysis of implementing a formal ERM. In SMFE, further resources might include personal resources (e.g., characteristics of individual family members such as self-esteem, knowledge and skills); family system resources (e.g., internal attributes of the family unit such as cohesion, adaptability and communication); as well as social support (e.g., capabilities of people outside the family on which the family can draw or a network in which the family is valued, such as the tourism destination in this sample) (Leiß and Zehrer 2018). Second, to assess dynamics in family firm theory, this study applies some elements of agency theory (Hiebl et al. 2019), and the concept of socio-emotional wealth (Gomez-Mejia et al. 2017) to suggest the owner-manager risk behaviour. The results point to the importance of investigating more deeply how information flows in SMFE are positively working or negatively failing, which determines the firm's ability to identify risks sufficiently in an informal manner. Thirdly, regarding the influence of CEO tenure and family involvement on the effect of ERM in SMFE, we contribute to understand more complex dynamics and interrelated processes (Wang and Chugh 2014) underlying ERM activities. Our findings are congruent with previous research that the involvement of the family and their collective actions, along with CEO tenure, affect the quality of decision-making in SMFE (de Massis et al. 2015), which also applies to decisions on ERM.
The study also has several practical implications that we believe are noteworthy, and of particular interest and relevance for SMFE in tourism. Firstly, the study offers important managerial implications, recommending that smaller firm owner-managers should implement ERM with the increase in years of the family CEO. This might prevent the firm from rigidity and business routines, and increase the identification of opportunities, which is important to stay competitive (Eshima and Anderson 2017;Rae 2006). Additionally, this suggest that CEO of SMFE benefit from a deeper understanding and reflection on ERM implementation. Secondly, if more generations are involved, the need for spending on ERM implementation diminishes, since intergenerational learning might emerge in the SMFE along daily business activities, with children acquiring role-specific knowledge and coping with lacking skills of older generation family members (Leiß and Zehrer 2018). This last point is important to know for SMFE and highlights the importance of learning across generations, which might benefit ERM implementation (Walsh 2002). This might counter-balance that SMFE are usually more operationally oriented and risk management is conducted rather on a spontaneous and/ or intuitive level. Thus, given the dynamics of time, considering formal ERM in a timebound context of generations might be beneficial.

Conclusion
This study produced a number of findings that are noteworthy, and contributes to the ongoing research stream on ERM and SMFE. The results both reinforce and complement former studies and create foundations for future research on ERM implementation. The findings generally show that the implementation costs of ERM seem to contribute to an insignificant overall effect of ERM on financial performance in the case of SMFE and confirming the importance of firm size as determinant of ERM effectiveness. However, findings also and most notably also show that in the case of SMFE, ERM can have an effect on firm performance if ERM is moderated by CEO tenure. In this case, the effect on firm performance turns significantly positive. This means that ERM implementation becomes more important, the longer the CEO tenure is. Contrary, the moderating effect of ERM and family involvement shows to be significantly negative for performance. This finding suggests that if more family members are involved in the business, different perspectives contribute to better risk management, although in an informal manner. Nevertheless, to prevent the firm of rigidity caused by a long CEO tenure, the implementation of a formal management structure like ERM can significantly increase financial performance.
Before discussing future research avenues, it is important to reiterate the study's limitations. This study has limitations, mainly because of the specific context of our sample and the contents of the information available. As mentioned above, the sample we study consists only of small and medium-sized tourism firms. Obviously, this limits the generalizability of the results because the sector-specific context that shapes perceptions and behaviors may drive some of our results. Considering the heterogeneity of SMFE, we think it is fruitful to examine such specific data sets because one may assume that sector specific homogeneity of the business controls partially for this variability. It would be very interesting to perform similar studies in other sectors to further compare similarities and show differences; e.g. within the services industries, the banking or financial service sector would equally be interesting. One advantage of our specific sample is that several control variables considered in the ERM literature are not relevant for the small and medium-sized firms in our sample including leverage, capex or asset turnover. However, the lacking use of other suitable control variables might be regarded as a limitation of this study. In addition, providing a cross-sectional study, the temporal dimension is limited to a snapshot, which makes causal inference difficult and excludes the assessment of firm-fixed effects.
For future research, we propose a more integrated risk management approach. This includes focusing not mainly on the risk propensity of family firms and its effects on performance, but also comprehensively investigating risk identification and risk perception in more detail (Brustbauer 2014;Brühwiler 2011). We believe that doing so would enrich family business research by asking if they are able to identify or perceive risks objectively, caused by a dominance of risk scenarios regarding SEW (Gomez-Mejia et al. 2017). Moreover, future studies should evaluate if knowledge transfer from one generation to the other (Hatak and Roessl 2015) might be improved as generations work alongside each other, which decreases the need for a formalized ERM. This could be especially relevant in case of succession problems (Cabrera-Suarez et al. 2001). Future research could also consider multiple research methods, e.g., a qualitative study would be of value to gain further knowledge and an in-depth understanding of the underlying reasons of risk identification and its impacts on firm performance. Even a multiple case study approach would enhance the understanding on ERM in SMFE on an individual basis as well as along the generations of the firms. Also, continuing with quantitative research and investigating an alternative array of mediating factors would considerably advance our understanding of ERM in SMFE and would additionally help derive further implications. Hence, further research is needed to elaborate on risk behaviour of family firms using different research methods and investigating the issue from different angles. It is our hope that the findings of this paper encourage other researchers to explore the topic further by using larger samples, investigating other industries and making use of mixed methods to confirm the fundamental premises we made.
Funding Information Open access funding provided by MCI Management Center Innsbruck -Internationale Hochschule GmbH.
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/.