Keywords

9.1 Introduction

Small- and medium-sized enterprises (SMEs) have faced several challenges and risks over the last decade. One of the most challenging business conditions in recent decades has been created by intense global competition, economic uncertainty, rapid technological change, and growing customer demand [18]. In today’s world, risk management is no longer focused on reducing vulnerability but rather on strengthening resilience. An individual, system, or community’s resilience to risk and uncertainty is fundamentally determined by its ability to respond to disturbances, surprises, and changes [45]. As a result, the application of the concept of resilient societies and the ways to create and strengthen them have become more widely used [15]. Economic resilience, given its dynamic and forward-looking nature, can be more effective in increasing the economy's ability to adapt to risks. Economic resilience means identifying ways and behaviors that increase the capacity to resilience external shocks or adverse effects. Alternatively, resilience seeks to reduce the probability of failure or losses of economic risks, and it is before and after the occurrence of shocks [77]. Paying attention to ambiguity and uncertainty is essential [33].

One of the critical features mentioned for a resistance economy is the resilience of the economy. Accordingly, a definition of economic resilience is “the capacity or ability of the economy to maintain performance and optimal allocation of resources in the face of economic uncertainty.” Resilience consists of two tangible sources (such as internal resources) and an intangible source (for instance, strong leadership and fast decision-making) [11]. Liu et al. [39] believe that internal resources help companies adapt to external crises and opportunities to improve corporate business performance potentially. Several recent natural and economic events have demonstrated the vulnerability of countries of all levels of development to disasters. Like terrorism and natural disasters, COVID-19 threatened managers’ lives, emotions, and rationality [25, 28, 72]. From about 350 in 1980 to almost 1000 yearly in 2014, these high-risk events have steadily increased around the world. Economic losses have risen from about $50 billion in the 1980s to about $250 billion in the past decade [72].

Radović-Marković et al. [54] argue that the concept of resilience shows how a country's economy can return to its previous level, based on this concept. However, they say a country's economic resilience is impossible unless small- and medium-sized businesses resist the adverse effects. Therefore, many consider it two sides of the same coin. On the other hand, the risks of "new" forms such as terrorism, the COVID-19 pandemic, the financial sector’s recent economic collapse, and the ensuing global economic crisis can all be borderless in nature [65]. A negative economic cycle characterizes SMEs during COVID-19, which is strongly impacted by the pandemic [2, 5]. Barbosa [4] believes that due to the need for creating resilient ecosystems, resilience is a new research opportunity. Building resilience through risk-informed sustainable development is essential to generating sustainable and resilient communities [2]. Resilience can correct the structure and tools to function in the face of stress, change, and uncertainty. Understanding the risk perspective correctly and identifying the best place to own and manage those risks are essential. Understanding how interrelationships between system components affect the performance of the system and strengthening the components that address those risks are essential [72].

There are many similarities and points of convergence between risk and resilience, according to Mitchell and Harris [45]. In their view, risk assessment and management are key to business resilience, and monitoring risks is a necessary condition for business resilience. Risk management approaches and resilience, however, are often viewed as independent variables in the literature because “Resilience thinking challenges the widely held notions about stability and resistance to change in risk management around the world” [6, 43].

Hence, this study provides a definition and explanation of the concept of resilience at different levels of the economy and to express risk and risk management. In this way, the knowledge gap between risk management and resilience will be reduced. Therefore, businesses with sufficient knowledge of resilience and risk management can be expected to protect their shareholders and customers against an unplanned disruption. Meanwhile, understanding concepts such as resilience, robustness, and antifragility can help firms remain stable in crises and risks.

There are several ways in which this study contributes to the literature on resilience and risk management. First, concepts such as resilience and risk management have not yet been poorly addressed empirically. By identifying different types of resilience and levels of risk, this study increases theoretical and managerial knowledge. Second, in the present study, other concepts such as antifragility and robustness were introduced in future research, these three concepts can be used more accurately in management research, but now the dominant concept is resilience. Third, the findings can help businesses adopt good practices for proper planning and risk management, given the degree of resilience of that business. Businesses can benefit from its implications by adopting appropriate policies and constructing risk management and resilience capacities in order to prevent and respond to disasters.

9.2 Definition of Resilience, Robustness, and Antifragility

As we examine the definitions of resilience in the planning, environmental, psychology, engineering, organizational behavior, sociology, and economic fields for the past forty years, we are able to draw a comparison between them [59]. Holling first used the term in 1973. The term “resilience” is used to mean “going back in time,” which is derived from the root “resilio” [16], and the equivalent of the word resilience means the ability to recover, rapid recovery, change, elasticity, and buffer and elasticity [47].

The root of resilience (resiliency) is derived from the science of physics and means jumping backward. Holling [30] defined resilience as the system's stability to sudden changes and ability to absorb shocks while maintaining past relationships between parameters and variables in the same state. Finally, [30] defines “the ability of systems to absorb change … as well as to survive” as a definition of resilience. In addition, he sometimes refers to resilience as “buffer capacity.” Pimm [53] describes resilience as the speed at which a system returns to equilibrium. In addition, [51] defined resilience as relative: “the gap between current and critical loads.” In [23], resilience is defined as the ability of a system to adapt, grow, and survive in changing conditions.

On the other hand, organizations can face three consequences after disasters: (1) declining performance and subsequent improvement (i.e., resilience), (2) insensitivity to uncertainty (i.e., robustness), and (3) upside gain (i.e., antifragility). In exploring these distinct outcomes, [49] transfer knowledge from the uncertainty, risk, and system theory literature into organizational resilience. Distinguishing the differences between these different outcomes can clarify our insight of enterprise answers at all times and in any situation with adversity.

The most crucial area of this concept is robustness. These include “abilities that aim to stabilize enterprise in the time of the disorders” and “abilities that aim to reduce the effect of the disorders on performance” [68]. Because if enterprises cannot maintain their strength in adverse times, they cannot recover from the disruption. In words, any enterprise that lacks the ability to have some robustness is likely to suffer from subpar performance and consequent failure [49]. Thus, for example, during the COVID-19 epidemic, online companies could withstand the crisis (i.e., were robust), while audit firms were initially damaged and then recovered (i.e., were resilient).

Robustness is the ability to maintain and resist adverse effects [20, 67]. Systems with the necessary robustness can resist or absorb pressure [20] or withstand and absorb strain and maintain their performance [19]. Robust systems often change their states to keep up performance [38]. While uncommon or unforeseen affairs can reveal vulnerabilities, and as a result, they create situations that they are unable to handle, and eventually firms fail [9].

The notions of fragility and antifragility were introduced by Taleb [70]. It means “things that gain from disorder.” The definition of an antifragile system is as follows:

Some systems profit from shock. That is, when volatility and disorder are present, they grow. In other words, they are interested in adventure, risk, and uncertainty. It is, however, impossible to find a word to describe the careful inverse of fragile. So we call it antifragile. There is no such thing as resilience or robustness when it comes to antifragility. Taleb [70] believes that in times of disorder and shock, strength and resilience cannot help organizations and individuals, while antifragility benefits them. Based on the above, it can be said that any disorder or shock is not necessarily harmful [7]. It should be noted, however, that necessarily is not gainful for all volatility and disorder [7].

Of course, robustness has a limited capacity to absorb disruptions without subsequently disrupting performance [30]. In contrast, resilient systems can return to their previous acceptable levels after the reduced performance [75], enabling business resumption in prior performance levels [63]. It is complicated to differentiate between robustness and resilience. Hillmann and Guenther [29] argue that there is an invisible boundary between the two concepts. Because resilient organizations, in a way, need robustness to be able to withstand pressure [36]. Resilience is about performance recovery after it has been reduced. As antifragility is defined as an increase in performance in the face of adversity [70], as a result, antifragility differs from resilience [55].

9.2.1 Different Levels of Resilience

Rose and Krausmann [60] expressed the operational criteria of resilience in two categories: Direct Static Economic Resilience (DSER) and Total Static Economic Resilience (TSER). Economic resilience on a direct static basis refers to the level of a business or industry (micro and meso), which is based on the evaluation of “partial equilibrium” or the performance of an enterprise or household. Basically, total static economic resilience (TSER) refers to the macro-level of economics. Ideally, it would encompass all price-quantity interactions in an economy, referred to as “general equilibrium.” In addition, resilience can be assessed behaviorally. Researchers face three problems in the area of resilience. Measures of resilience, including those that violate rational behavior, need to be identified at the conceptual level. This may cause challenges to the model of individual, group, and community behavior on an operational level. At the practical level, data collection on resilience, particularly to determine models, is difficult [58].

Finally, [59] expresses resilience on the following levels: microeconomic (households or businesses), meso-economic (markets or industries), and macroeconomic (an economic entity that includes all economic entities and their interactions) (Fig. 9.1).

Fig. 9.1
figure 1

Business resilience based on different levels [64]

Full size image

9.2.1.1 Resilience at the Microeconomic Level

The purpose of this section is to show how economic production theory can be used to analyze economic resilience at the micro-level. A business’s ability to produce profits from different inputs is represented by this abstract model. A framework called Computable General Equilibrium (CGE) is viewed in economics as a set of integrated (macro-level) supply chains and deals with how businesses interact in supply chains (meso-level). Businesses’ performance remains the focus of this approach.

Resilience in business has two aspects. Customer-side resilience creates through disruption (quantity and timing) in the delivery of inputs and to utilize the resources available in businesses and households. Also, it has a relationship with static resilience. For example, resilience is primarily a demand-side issue in a particular period, meaning the existence of a specific fixed capital or any fundamental disruption in the supply of input. In contrast, supply-side resilience is related to providing output to customers. In addition to system redundancy, dynamic resilience usually involves repairing or constructing critical inputs. Supplier efforts or capital repairs are entirely separate from customer resilience, which is the responsibility of input providers [59].

From an economic point of view, economic resilience relates to the ability of the economy to withstand shocks and return to its original path; however, this ability also depends on the level of vulnerability of the economy [8]. Economic resilience means identifying ways and behaviors that increase the capacity to deal with external shocks or adverse effects. On the other hand, resilience seeks to reduce the likelihood of failure or loss of economic risks before and after shocks [77]. Due to its dynamic and forward-looking nature, the economic resilience approach can have been more effective in adapting to risks.

9.2.1.2 Resilience at the Meso- and Macroeconomic Level

From a meso-economic perspective, resilience is an option to strengthen the market or parts of it. Examples are pricing mechanisms, aggregation of resources and industry information, and various types of infrastructure. Most researchers in the field of economic believe that the intrinsic resilience of market prices, which acts as an “invisible hand” to direct resources to better allocation, should be considered as a disaster. Rose [59] believes that the market is likely similar to its buildings, and human disasters will be damaged. Under normal market failure conditions, two alternatives to some (or all) economies are presented similarly, public goods, and market power:

  1. (1)

    It is replacing judgments or scheduling with significant costs and higher than its implementation.

  2. (2)

    Both approaches, such as improving information, are considered resilient to strengthen the market.

Connelly [13] explained resilience at the meso-level (the level of businesses) shown in Figure 9.2. Connelly [13] believes that a business’s risk and governance management are the most critical elements.

Fig. 9.2
figure 2

Meso-level resilience (the business level) [13]

Full size image

From a macroeconomic perspective, resilience is affected by sector interactions. Martin and Sunley [42] reason that the resilience of macroeconomics is not just a function of resilience measures at the microeconomic level (individual business or household). All companies and markets have an impact on it (at the meso-economic level).

After understanding resilience, robustness, and antifragility concepts and getting familiar with different levels of resilience, the concepts of risk and its management will be discussed. In addition, the relationship between resilience and risk management will be explained.

9.3 Risk, Risk Management, and Business Resilience

Around 1200 in Venice, “risk” was the first word to appear and be used in European languages to resolve uncertainty. Other terms, such as “uncertainty,” appeared much later [37]. In general, risk refers to the possibility of loss or unfavorable outcomes associated with an action. From [31] point of view, risk is a situation in which the result of activities is accompanied by uncertainty. The Institute of Internal Auditors (IIA) describes risk as uncertainty about the occurrence of an event that could influence the goal achievement. Having uncertainty means not knowing what will happen in the future—risk increases with uncertainty [14]. The goal of risk management for a manager is to maximize expected returns subject to the risks and tolerances of the organization. Crane et al. [14] argue that taking risks allows you to make money. In other words, there would be no return if there were no risks. Positive or negative consequences may result from the risk, or simply uncertainty may result. For an organization, thus, the risks associated with opportunity and loss or the existence of uncertainty may be taken into account. Each risk has characteristics requiring exceptional management or analysis [32]. Therefore, attention to risk and its management has become more important in businesses.

Pike et al. [52] have divided the risks into two categories with internal and external drivers. There are two kinds of risks associated with external drivers: financial risks (risks associated with accounting standards, foreign exchange, interest rates, and customer credit) and market environment risks (risks associated with competition, customer demand, economic conditions, technology developments, and legal requirements). As well as risks associated with internal incentives, there are risks associated with controls and control environments, liquidity, investment, fraud, accounting information systems, and human resources. Moeller [46] also divides the risks that must be managed into strategic, operational, financial, and information risks. Therefore, a business must address the various risks in achieving its targets.

The enterprise is a dynamic combination of organized resources to achieve a set of purposes and missions. Therefore, defining these goals is vital to any enterprise’s management. In these circumstances, it is clear that the unavailability of all or part of a particular resource can prevent the organization from achieving its goals. Reasons for this “lack of access” to resources include the occurrence of risks or unidentified “accidental” events. In this context, the purpose of the risk management process can be defined as the availability, under any set of conditions, of resources at a level consistent with the enterprise’s core objectives. Then, to achieve an operational definition of the risk management goal, a closer look at the organization's goals is necessary [12]. Risk management is the process used by the board of directors and senior executives to identify events that affect the business [57]. Risk management has become an essential issue for all companies today, so it is used in decision-making in the categories of CEO and middle managers [10]. Risk management theory shows the reduction of various accounting costs that help improve the company’s performance [76].

The relationship between risk management and performance has also been debated by researchers for a long time, mainly because the relationship between risk management and value in imperfect and inefficient markets has not yet been established [24]. Past studies of corporate risk management have concluded that organizations may be able to improve their performance by adopting a dependent view of risk management [22]. Iwedi et al. [35] studies have shown that risk management aims to maximize shareholder value. Studies by Ashari and Krismiaji Krismiaji [3] and Shad et al. [61] also show the effect of risk management on performance and return on equity.

One of the dimensions of risk management is industry competition. An essential feature of the competition is that there is more than one firm in the market, and this feature makes firms comparable in terms of performance. Comparability of firms allows investors to choose firms with optimal performance for investment. In particular, Shatnawi’s [62] studies have shown that corporate risk management involves a combination of managing threats and strategic risks based on corporate policies. In this sense, the risk management process not only becomes a tool for preventing and managing the impact of destructive events on the business but also becomes a force for seeing an opportunity [69]. The three stages of risk management are as follows: (1) identification of risks, (2) risk assessment, and (3) risk reduction [21], and higher-ability managers can improve performance [34]. Enterprise risk management is made up of eight parts: control environment, targeting, event identification, risk assessment, risk response, control activities, communication, and monitoring [57]. Merna and Al-Thani [44] believe the risk management process should be dynamic and regularly reviewed.

Risk management plays a central role in resilience [41]. Risk management purpose is to manage all the uncertainties that may interfere with the goals and missions of the organization and to ensure the survival of the organization in any situation (environmental and economic) that it may face. Risk analysis is fundamental to preventing business failure, including risk assessment and management [50]. Park et al. [50] believe risk analysis is impossible where risks are unknown.

Conversely, the goal of resilience is to build the capacity to overcome disorders or stress while maintaining the functions needed for survival and possibly progress [40]. Somers [66] argues that there is more to resilience than just surviving. In the event of a disaster, this means identifying potential risks and taking precautions to ensure the organization’s progress.

The main areas of resilience can be categorized as follows: organizational, operational, financial, technological, and business resilience. Since the objective of businesses is sustainability, they must understand the risks they will face in the future and be prepared for those risks. They can achieve this goal through adaptive and mitigation measures. Resilience plays a significant role in this case because resilience demonstrates the ability of businesses to cope with expected and unpredictable events. To this end, it is imperative for companies to identify, evaluate, and plan for future risks that they may face.

Torabi et al. [71] argument measures such as risk reduction and process reengineering can help in proper risk control in traditional risk management. The resilience concept, along with the risk concept, has been considered by researchers in recent years. Hence, different perspectives have been expressed in this regard [56]: As a complementary approach to risk management, resilience is viewed from the first perspective. In this perspective, it is believed that traditional risk management systems in times of crisis have not been able to respond appropriately, so resilience can be considered a new and appropriate way to manage crises. As seen from the second perspective, resilience and risk are completely separate concepts. In this perspective, it is believed that businesses will move toward risk management or increased resilience in times of crisis. Lastly, both concepts are regarded as unifying elements from the third perspective. In terms of logic, resilience and risk are quite different, but they both aim to increase access to resources for a longer period of time [56]. The resilience approach requires preparation for the unexpected. Risk analysis, on the other hand, assumes that risks are identifiable. Table 9.1 compares the perspectives of risk management and resilience.

Table 9.1 Perspectives on resilience and risk management [50]
Full size table

9.4 Conclusion and Discussion

The business environment is constantly changing and full of risk [1]. By ignoring the invisible nexus between business and their environment, businesses miss out on many new sustainable development opportunities that may prohibit businesses from collapsing [48]. Moore and Manring [48] argue that business plans should articulate the opportunities and constraints of changing social and environmental conditions. If businesses, tiny and medium-sized businesses, cannot adequately cope with possible crises and problems, they cannot survive and are doomed [26]. Therefore, companies must take steps to make themselves more competitive to survive and increase their competitiveness. Varmazyari and Imani [74] believe that the resilience of the country's economy (at the macro-level) and businesses (at the micro- and meso-level) can make the economy resistant to external and internal shocks.

This concept increases the ability of businesses to cope with abrupt and unpredictable changes and shocks (internal and external factors). Herbane [27] points out that businesses mainly suffer from a lack of resources such as liquidity to meet market and customers’ needs. Van Gils [73] also enumerates factors such as raw material supply and financial needs in this regard. This school of thought includes perspectives based on management risk-focused strategies.

Based on the above, if businesses at the micro- and meso-levels want to resilience possible crises such as sanctions and coronavirus which affect their economic conditions, they must understand their strengths and weaknesses. Analysis of strengths and weaknesses can affect the future and survival of such businesses because businesses can increase their competitiveness and resilience through resource and cost management (liquidity, financing, etc.). In addition, recognizing the risks and proper coverage of these risks can be very important in the continuity of businesses. Understanding threats and opportunities allow businesses to use various financial tools (using the concept of financial engineering and risk management) to counter these threats. Dahles and Susilowati [17] argue that companies have been able to survive (and even grow some) emerging crises by using flexible expertise (in any situation), diversifying, and combining different sources of revenue within and across sectors.

Conflicts of Interest

The authors declare that they have no conflicts of interest regarding the publication of this paper.

Funding

The authors funded the research.