FINANCIAL RISK MANAGEMENT IN SME

Transcription

1 FINANCIAL RISK MANAGEMENT IN SME - THE USE OF FINANCIAL ANALYSIS FOR IDENTIFYING, ANALYSING AND MONITORING INTERNAL FINANCIAL RISKS! MASTER THESIS September, 2011 Aarhus School of Business, Aarhus University MSc. In International Economic Consulting Author: Ann-Katrin Napp Academic Supervisor : Stefan Hirth

2

3 Abstract Motivated by the finding that existing literature and research on risk management misses the focus on small and medium sized enterprises (SME), the aim of this thesis was to propose a mean for SME to manage their internal financial risks. Similar to large companies, SME do also face business risks, which in worst case can cause financial distress and lead to bankruptcy. However, although SME are a major part of the German - and also international - economy, research mainly focused on risk management in large corporations. Due to differences in characteristics and resources, in various fields ranging from management over structure and IT systems to specialty of knowledge, large corporations practices cannot easily be adapted to SME. Therefore the aim was to suggest a possible mean for the risk identification, analysis and monitoring, which can be applied by SME to manage their internal financial risks. For this purpose the financial analysis, which has been used in research to identify indicators for firm bankruptcy, was chosen. An overview was developed, which allows identify risks and negative developments in the main critical areas of internal financial risks to SME, namely liquidity, financing and solvency. The identification, analysis and monitoring is based on a set of financial ratios, which have been proven efficient for risk identification in various researches. To enable a classification of the risk situation, the company data is compared to data of two groups. On the one hand data of bankrupt companies marking the critical area, and on the other hand that of successful companies as a positive benchmark. In comparison to those two groups, the actual risk situation of a SME can be analysed and critical aspects from financing, liquidity or solvency can be identified. Especially when using plan data in the overview, critical developments can be observed at an early stage. At this point further research could identify ways and standardized structures for the SME to go deeper into analysing the sources of the identified risks as well as to handle them. For this, as for the whole process, the characteristics of SME have to be taken into account, too. Therefore the suggested overview is a first and comprehensive mean for analysing and monitoring the overall financial risk situation of SME. It is designed to fulfil their needs as it takes their characteristics into account and can be the base for further research in the field of SME risk management. I

4 Table of contents 1.! Introduction... 1! 1.1.! Context and research question... 1! 1.2.! Methodology and structure of thesis... 2! 1.3.! Delimitations and validity... 3! 2.! Theoretical overview... 3! 2.1.! Definition of main terms... 3! ! Definition of risk... 4! ! Definition and aim of risk management... 5! ! Definition of small and medium sized enterprises... 7! 2.2.! Risk management in theory... 7! ! Process of risk management... 7! ! Risk categories... 13! 2.3.! Financial risk management... 13! ! Financial risks... 13! ! Financial risk management without derivatives... 16! ! Financial risk management with derivatives... 17! 3.! Literature review... 19! 3.1.! Risk management in SME... 19! ! Differences between SME and larger corporations... 19! ! Deficits in literature... 25! ! Important aspects of financial risk management in SME... 27

5 3.2.! Financial analysis... 27! ! Use of financial data and ratios for risk identification... 27! ! Methods of financial analysis... 30! ! Limitations of financial analysis... 35! ! Financial analysis as a mean for risk management in SME?... 35! 4.! Use of financial analysis in SME risk management... 37! 4.1.! Development of financial risk overview for SME... 37! ! Framework for financial risk overview... 37! ! Evaluation of ratios for financial risk overview... 39! ! Choice of ratios for identifying and monitoring financial risks... 47! ! Comparison data for the risk overview... 49! 4.2.! Example for the use of the financial risk overview: case study... 52! ! Case company... 52! ! Overall financial risk situation of the case company... 53! ! Possible extensions... 57! 5.! Critical review and conclusion... 59!

6 List of tables Table 1: Ceilings for small and medium sized enterprises... 7! Table 2: Overview of risk categories and ratios... 33! Table 3: Average risk ratios of non-bankrupt group and bankrupt group... 49! List of figures Figure 1: Structure of the thesis... 2! Figure 2: Risk management process... 8! Figure 3: Risk factors of SME, their possible results and matching financial ratios... 38! Figure 4: Development of total debt/ total assets ratio... 40! Figure 5: Development of working capital / total assets ratio... 42! Figure 6: Development of sales / total assets ratio... 43! Figure 7: Development of EBIT / total assets and net income / total assets... 46! Figure 8: Development of net income / sales and operative income / sales... 46! Figure 9: Ratios for financial risk management overview... 48! Figure 10: Case company analysis of debt / total assets... 53! Figure 11: Case company analysis of long-term assets / (long-term debt + equity)... 54! Figure 12: Case company analysis of working capital / total assets... 54! Figure 13: Case company analysis of EBIT / total assets... 55! Figure 14: Case company analysis of retained earnings / total assets... 56!

7 1. Introduction The first section provides an introduction to the thesis. Hereby the context of the thesis, the research question and the structure of assessing the topic as well as its limitations will be presented Context and research question Risk and economic activity are inseparable. (Liekweg & Weber, 2000, p.277) Every business decision and entrepreneurial act is connected with risk (Stroeder, 2008, p.135). This applies also to business of small and medium sized enterprises as they are also facing several and often the same risks as bigger companies. In a real business environment with market imperfections they need to manage those risks in order to secure their business continuity and add additional value by avoiding or reducing transaction costs and cost of financial distress or bankruptcy (Hermann, 1996, p.38 Oosterhof, 2001, p.2). However, risk management is a challenge for most SME. In contrast to larger companies they often lack the necessary resources, with regard to manpower, databases and specialty of knowledge to perform a standardized and structured risk management. The result is that many smaller companies do not perform sufficient analysis to identify their risk. This aspect is exacerbated due to a lack in literature about methods for risk management in SME, as stated by Henschel (2008): The literature on risk management being available mainly concerns the implementation in very large joint stock companies. (Henschel, 2008, p.48) Although their economic and social impact is important and they differ in many aspects from larger corporations, most empirical studies about corporate risk management focus on the latter ones (Vickery, 2006, p.446; Rautenstrauch & Wurm, 2008, p.106). The two challenging aspects with regard to risk management in SME are therefore: 1. SME differ from large corporations in many characteristics 2. The existing research lacks a focus on risk management in SME The theory about the risk management process is not sufficiently applicable to small and medium sized companies, as it has to consider their characteristics and needs. With focus on German SME and their internal financial risks, this thesis will therefore try to 1

8 convert the theory of financial risk management into practice in a way that it is applicable for small and medium sized companies. The following research question will be central to this work: How can SME manage their internal financial risk? And further: Which aspects, based on their characteristics, have to be taken into account for this? Which mean fulfils the requirements and can be applied to SME? 1.2. Methodology and structure of thesis The research question is followed in different steps, which are presented in figure 1: Figure 1: Structure of the thesis Source: author s illustration After introducing the topic of the thesis, chapter 2 will provide the theoretical background for this work. Here the main terms will be defined and a theoretical overview of risk management will be given. In chapter three a literature review will give insight into the status quo of research. The focus will be on differences between SME and large companies especially with regard to risk influencing characteristics and the use of risk management. Furthermore financial analysis and the possibility of using it as a mean for risk management will be introduced. Additionally it will be pointed out where there are deficits regarding the applicability of the theory on small and medium sized enterprises and what the requirements, defined by their characteristics, for risk management in SME are. Based on those results the financial analysis and the risk management process will be connected in the fourth chapter in an overview. This overview shows a possible solution 2

9 of how smaller companies can use the theoretical approaches to identify, analyse and monitor their internal financial risks. Finally, the overview will be applied in a case study of a medium sized company, whose risk situation will be analysed. Chapter five concludes the thesis and provides a concluding and critical review Delimitations and validity The following work presents an overview for internal financial risk management in SME. This overview, however, concentrates on the risk identification, analysis and monitoring on the top level of the SME. It should be seen as a first step for the risk management and point to the relevant categories, which have to be assessed in detail. This further assessment is not part of the work. The same accounts for possible measures to cope with the identified risks. Depending on the company, its specifics and business environment it needs to be decided what to do in next steps. With regard to validity of the data, which is the base for the risk overview, the following has to be stated. The choice of the ratios for the overview has solely been based on the results and data from different research papers. For this part no further data has been collected by the author. The results of the analysis are therefore based on the papers and could change slightly when using datasets from a different country, sector or decade. Nevertheless the ratios have been chosen with regard to maximize their significance and accordance. 2. Theoretical overview In the following the theoretical background for the thesis will be given. For this first the main terms of the thesis will be defined, after that risk management, how it is found in theory, and especially financial risk management will be presented Definition of main terms For a better understanding of the theory, first of all the terms risk, risk management and small and medium sized enterprises, will be defined as they are understood in this work. 3

10 Definition of risk When doing business, constantly decisions, where the outcomes cannot be foreseen with certainty due to incomplete information, have to be made (Stroeder, 2008, p.135). This uncertainty connected with every kind of business activity is risks. Although this term is of central importance, there does not exist an overall definition of the meaning of risk (Wesel, 2010, p.280). As a first step for the definition, similar terms, which are often used exchangeable in every day s speech, need to be distinguished, namely: uncertainty, danger and risk. Uncertainty is used when the outcomes of future events are uncertain and the different states cannot be connected with probabilities of occurrence (Stroeder, 2008, p.136) The term danger in general stands for unplanned and unpredictable outcomes having a negative impact on something. Like those two terms, risk summarizes events that are uncertain regarding their outcome. The difference is that in the case of risk, the outcomes can be connected with a probability of occurrence (Stroeder, 2008, p.136). Furthermore, risk can be split into two categories. On the one hand there are pure risks or systematic risks, which cannot be influenced by the manager and are independent of business decisions. On the other hand there are unsystematic risks, which are the result of managerial decision-making and can either have a negative or a positive outcome (Stroeder, 2008, p.140; Retzlaff, 2007, p.11). However there are differences in the definitions of risk. First of all some include also possible positive outcomes of a risk, also referred to as upside risks or chances. Other only define the possible occurrence of negative outcomes, or downside risks, as risks because they are more in the focus of the management (Dhanini et al., 2007, p.74). The inclusion or exclusion of chances is not the only difference in the common definitions. They range from (negative) deviations of planned outcomes, over danger of making wrong decisions to danger of losses due to information lacks (e.g. Nassauer & Pausenberger, 2000, p.264; Hermann, 1996, pp.7-11). When focusing on the common features of the definitions, risk is the possibility of deviation from a planned outcome or goal. This implies that all business is connected with risks resulting from the fact that future states of the world and outcomes of decisions can only be predicted. As business activities are uncertain regarding their outcome and this uncertainty implies risks to the profit of the firm, a company needs to manage its risk exposure (Retzlaff, 2007, p.9). 4

11 Definition and aim of risk management The term management can be derived from the Latin word manus (= hand) and means handling. In a business context management is the organisation, administration and leadership of a company (Duden online, 2011). Risk management is therefore the organisation, administration and leading of risks in the company. The roots of risk management can be found in the insurance sector in the 1960s (Form, 2005, p.109). The acquisition of insurance makes it possible to secure business against systematic risks. Over time the understanding of risk management was extended and now also includes the management of unsystematic risk (Stroeder, 2008, p.142). The inclusion of managing unsystematic risks is in contrast with the theory of Modigliani and Miller. They proposed in their paper from 1958 that in a perfect market financial decisions will not influence the firm value. According to them, companies therefore do not need to manage their risks or hedge to protect against possible losses caused by unsystematic risks (Dhanini et al., 2007, p. 73; Oosterhof, 2001, p.2). The market does not price such actions. The only thing that is priced is the systematic risk of the companies (Miller & Modigliani, 1958, p.296). This is based on the assumption that each investor modifies his portfolio according to his risk preference by diversification. Therefore risk does not need to be managed by the company (Berk, 2009, p.283). Nevertheless management uses risk management to decrease the volatility in earnings (Dhanini et al., 2007, p. 73). This is because of market frictions that are absent in the Modigliani-Miller world, which means that corporate risk management can only be relevant if markets are imperfect. (Oosterhof, 2001, p.2) In real business environment there are market imperfections, which are absent in the Modigliani-Miller assumptions. Corporate risk management can therefore add additional value to the shareholders although the financial theory of Modigliani Miller says it is obsolete (Oosterhof, 2001, p.2). One aspect is that in reality not all investors are likely to have the opportunity to diversify their portfolios. Moreover, under the perfect market assumptions taxes and transaction costs are neglected. These factors are however part of reality and might make risk management reasonable (Berk, 2009, p.384). Furthermore there are costs related to defaulting, like direct costs of bankruptcy or financial distress (Triantis, 2000, p.560). In the long run, which is the perspective of 5

12 the theory, gains and losses due to volatility might even out. However this might be different in a short-term point of view, which is important to the company. In the short run, losses might lead to financial distress and cause costs to the company, which can be avoided by risk management (Dhanini et al., 2007, p.73). Another aspect are indirect costs associated with difficulties of entering contracts under high risk of defaulting, which can also be avoided or at least reduced (Triantis, 2000, p.560). The indirect costs of entering contracts refer to stakeholders of the company that are neglected in the theory of Modigliani and Miller. Suppliers, employees and banks, might suffer from the occurrence of a risk (Berk, 2009, p.384). Due to that, stakeholders might demand a premium for entering a business relationship with the company (Triantis, 2000, p.560). The premium paid to banks is even more present, since Basel II is in force. The aim of the act is to increase the stability in the banking sector. One way to achieve this is that banks are obliged to have a risk sensitive amount of equity for each loan outstanding. The higher the risk of the debtor the more equity is required from the banks to support the loan. Risky loans cause higher costs to the bank. Therefore interest rates for loans include a risk premium, which depends on the default risk of the borrower (Schönborn, 2010, p.13). Although Basel II does not explicitly demand the implementation of a risk management system, when rating a company the bank will check the existing management instruments and also the risk assessment (Henschel, 2008, p.4). The existence of a risk management can improve the rating of a company and increase the likelihood of access to new capital and decrease the interest rates for credit financing (Jonen & Simgen-Weber, 2008, p.102). Research has shown that risk management can add value to the firm when market imperfections like progressive taxing of the company, expected costs of financial distress or agency problems are present (Oosterhof, 2001, p.2). Therefore risk management can be of value not only to the investors of a company but also to its other stakeholders (Berk, 2009, p.384). Its overall aim is to secure business continuity and support the achievement of the company s goals by preventing dangerous situations in an efficient way (Hermann, 1996, p.38; Retzlaff, 2007, p.14). However, it is not the goal to offset each single risk the company is confronted with, as risk is essential to business activity and risk elimination also decreases chances (Liekweg & Weber, 2000, p.280). Risks are part of doing business, but should be managed appropriately in a risk management process, which will be presented in section

13 Definition of small and medium sized enterprises Small and medium sized enterprises (SME) differ from large corporations among other aspects first of all in their size. Their importance in the economy however is large (Hermann, 1996, p.3). According to latest statistics of the European Commission, SME represent around 99% of all companies in Germany as well as in the EU. (European Commission, 2011; IfM Bonn, 2011). More than every second employee works for a SME and over one third of the German annual turnover is earned by SME (IfM Bonn, 2011). Those statistics are based on the definition of SME from the European Commission. Their latest definition for SME was established 1.January 2005 and it states three criteria for defining SME: number of employees, annual turnover and balance sheet total. At least one of the financial criteria needs to be fulfilled in addition to the number of employees criteria (European Commission 2011). The ceilings for small, medium sized enterprises are the following: Enterprise category Headcount Turnover Balance sheet total Small sized < 50! " 10 million! " 10 million Medium sized < 250! " 50 million! " 43 million Table 1: Ceilings for small and medium sized enterprises Source of data: European Commission (2011) Next to this definition, there are also others used among researchers in different countries. Some definitions distinguish the branch of business for classifying the company into small, medium or large (Hermann, 1996, p.117). Most often, however, the quantitative EU criteria are used (Wesel, 2010, p.32) Risk management in theory The following section will provide insight into the theory of risk management by presenting first the risk management process and then different categories of risk Process of risk management The different tasks of risk management are structured in a process of chronological phases (Form, 2005, p.121). Although different researchers define the phases similarly, the definitions to be found in the literature differ in the way the tasks are ordered into the phases. Furthermore the wording differs also, although the tasks to be done in the 7

14 process stay the same (Hermann, 1996, p.40). Therefore the difference in the definitions does not change the general steps of the process, which are visualized in figure 2. Figure 2: Risk management process Source: author s illustration First of all a company needs to understand the sources of risk it is exposed to, to be able to manage those (Triantis, 2000, p.571). Therefore the process of risk management starts with the identification of risks. This is followed by the analysis and evaluation of risks (Form, 2005, p.122). After that, in the risk assessment, the best ways to handle the identified risks and how this handling can be included into daily business are evaluated (Triantis, 2000, p.571). The final step of the process is the risk monitoring, which becomes part of the daily business until the process is started again from the beginning (Form, 2005, p.122). These phases are presented in detail in the following. Before entering this process however, the goals and expectations of the business need to be specified in order to structure and implement the risk management process (Hartman Schenkel, 2003, p.39). This is especially important due to the fact that when risks are limited, also opportunities might be limited (Liekweg & Weber, 2000, p.280). Maximum accepted risk levels or losses should therefore be defined beforehand. The maximum risk should be set appropriately according to the expected return and opportunities involved (Liekweg & Weber, 2000, p.283). Furthermore it should be defined from which value on, a risk is classified as essential or as problematic and from when on prevailing actions start. Then the risk management process can be started (Wesel, 2010, p.292). Risk identification The first phase is risk identification. The aim of this phase to identify all risks, which could interrupt or damage the business development (Hermann, 1996, p.41; Stroeder, 2008, p.212). The risks that should be identified can either have a negative impact on the balance sheet, the financial statement or the cash flow situation of the company and therefore also on its development (Wesel, 2010, p.282). This identification is of great 8

15 importance as only identified risks can be handled successfully in the next steps of risk management (Stroeder, 2008, p.212). The uncertainties of the company and critical factors of the business can be identified by checking the business processes with regard to their risk potential (Form, 2005, p.122; Liekweg & Weber, 2000, p.284). Here, two different approaches are possible, referred to as the progressive and the regressive approach. The progressive approach aims to identify possible plan deviations and losses based on typical risk factors (Hermann, 1996, p.41). Those risk factors can be of different origin; as for example they can result from changes in the markets, legal aspects, company intern aspects or financial factors (Liekweg & Weber, 2000, p.284). The second approach is regressive, starting the other way around with the main goals of the company and trying to find possible reasons among the risk factors that could lead to a deviation from the goals (Hermann, 1996, p.41). Risk identifying techniques of the approaches are either creative or analytical. In the group of creative tools, mainly brainstorming, interviews and a subjective assessment of the risk are used. When using analytical tools, for example flow charts or a cause and effect analysis are mainly applied in the regressive approach and checklists of risk categories and factors are mainly applied in the progressive one (Hermann, 1996, p.41). With both approaches, there is no detailed general procedure for identifying the relevant risks. All techniques aim to find the areas where possible deviations from plans or goals can evolve, due to risk factors. The experience and knowledge of the management and their ability to gather relevant information are of main importance in this process (Hartman Schenkel, 2003, p.40). Also with regard to saving resources, based on experience the management can eliminate irrelevant risk factors already in the beginning (Scheve, 2005, p.46). In order to identify all risks and react with an appropriate timeline, the management needs actual and complete data (Stroeder, 2008, p.212). However, a problematic aspect of the risk identification is that while the aim is to use as detailed and accurate information as possible to identify all and also new risks, the identification should not demand too many resources of the company (Hermann, 1996, p.42). The completeness of information is contradicting the aim for economical reasoning of the process 9

16 (Hermann, 1996, p.42; Stroeder, 2008, p.212). Partly standardized processes or setting a level from where on risks should be taken into account can help to solve the conflict of goals. Moreover, the company can focus on certain areas, where it can be expected that more and also more important risks are occurring (Stroeder, 2008, pp ). Risk analysis and evaluation Once the risks are identified, they need to be analysed and evaluated. The separation of the first and the second phase of the risk management process is not clear, as they are directly based upon each other. Furthermore defining a process or position as a risk can already be viewed as an analysis or evaluation (Hermann, 1996, p.42). However, this does not change the process, where after the identification the risks are categorized and then evaluated. The aim of the risk evaluation is to determine the degree of the identified risks and quantify their financial impact on the company. It is therefore necessary to analyse in which way the risk could affect the business (Hermann, 1996, p.42; Liekweg & Weber, 2000, p.285). In order to get a better overview, the identified risks are first clustered or categorized based on the field of risk, for example whether it is market or financial risks. More specifically the source of origin determined by the single risk factors of the risk fields can be used (Stroeder, 2008, p.217; Form, 2005, p.123). The clustering allows for a company to later analyse whether some of the risks are related and whether some of them offset each other (e.g. in and outflows in a foreign currency). Furthermore the clustering will assist to identify the main risks of business, which is of help for future analysis and focus of risk management (Nassauer & Pausenberger, 2000, p.269). Next the influence of the different risks and their potential harm to the company needs to be evaluated. This will require an identification of the costs to the company in case the risk occurs as well as the probability of occurrence (Scheve, 2005, p.46). With help of those values the expected damages of the risk positions can be calculated and the single risks can be evaluated (Hermann, 1996, p.43; Scheve, 2005, p.74). However, a quantification of the impact is in most cases not possible, as the future outcomes are uncertain. Therefore companies need to rely on estimations (Nassauer & Pausenberger, 2000, p.270; Liekweg & Weber, 2000, p. 286). Both quantitative and qualitative methods can be used for this estimation (Boutellier, Fischer & Montagne, 10

17 2009, p.1). Quantitative methods involve the use of statistical programs in order to simulate, calculate and forecast the influence and occurrence of the risk (Liekweg & Weber, 2000, p. 286). When using qualitative methods, the risks frequency and impact are evaluated based on experience and assessment of the company s management and employees (Boutellier, Fischer & Montagne, 2009, p.2). In both cases the aim of the estimations is to get an overview about the potential loss resulting from the different risks (Form, 2005, p.123). The risks may then be ranked based on the expected loss or visualized in a matrix with regard to the magnitude of their effect and the probability of occurrence (Liekweg & Weber, 2000, p.287). To further assess the importance of managing the single risk positions, the impact of the risk should be compared with the maximum tolerated loss, which should be defined in the risk strategy. At least those positions exceeding the tolerated loss or threaten business continuity need to be assessed in the third phase of risk management (Wesel, 2010, p.295). Nevertheless, determining the accurate damage that can be caused by the risks, as well as the probability of occurrence can be difficult in practice (Hermann, 1996, p.43). In order to determine the possible loss with quantitative methods, objective and large data sets are necessary for statistical analysis. Larger corporations as well as bank and insurance companies have access to those data sets and the IT systems to evaluate them (Boutellier, Fischer & Montagne, 2009, p.8). Smaller companies in most cases do not have those resources and therefore have to rely on qualitative methods (Wesel, 2010, p.300). As those evaluations are subjective, experience from the past is essential and a huge help in this phase of the risk management process (Hermann, 1996, p.43). Risk assessment According to the risk willingness, measures to handle the risk will be chosen in the third phase (Wesel, 2010, p.300; Hartman Schenkel, 2003, p.42). Those measures range from risk avoidance or prevention, over risk reduction, to transfer of risks and finally acceptance of the risk (Henschel, 2008, p.7). A simple measure to handle an identified risk position is to decide to avoid the risk (Form, 2005, p.124). However, the company has to accept that avoiding single risks eliminates besides the risk also all activities and chances connected with it (Stroeder, 2008, p.250). The abandonment of possible gains of risky activities is not always 11

18 possible and also not aimed when doing business (Hartman Schenkel, 2003, p.42). Instead the company can decide to keep the chances and reduce the expected damage (Hermann, 1996, p.45). This can be achieved by either decreasing the probability of occurrence of the risk or limiting its financial impact (Form, 2005, p.124). The probability of some risks can be reduced by strategic handling and surveillance. In case the risk cannot be reduced within the company, external parties are needed and the reduction is achieved by transferring the risk to a third party (Stroeder, 2008, p.250; Form, 2005, p.124). Those can be institutions as insurance companies or markets, where opposed risks can be matched or are transferred to someone who can better handle them (Hartman Schenkel, 2003, p.42). The last possibility is to fully accept the risk of a position (Form, 2005, p.124). This is the opposite of risk prevention and can be an alternative when for example the risk is not regarded dangerous and the benefits from insurance are smaller than the costs (Hermann, 1996, p.45). Furthermore not all risks can be insured. When the risk is closely connected to the core business, eliminating the position is not possible and the company can decide to accept the risk (Stroeder, 2008, p.251) In order to choose the appropriate measure for each risk position, the importance of the risk position for the company and the urgency to mange it need to be considered (Wesel, 2010, p.296). As a result, most companies employ a mix of all four risk measures (Henschel, 2008, p.7). Risk monitoring At the last phase of the risk management process it should be checked with a risk monitoring whether the risk identification, evaluation and assessment have been successful (Hermann, 1996, p.48). This phase is crucial for taking appropriate measures in time in case deviations between the actual and planned risk situation are identified (Henschel, 2008, p.54). The monitoring should therefore include developments of the risk positions and measures to control them (Form, 2005, p.126). Moreover the overall risk situation of the company should be compared to the plan and the risk strategy and deviations should be documented (Liekweg & Weber, 2000, p.290). When identifying differences, the risk management process should be started all over again. In iterative learning the next circle of the risk management process will start (Hermann, 1996, p.48). 12

19 Risk categories In general risks can occur everywhere within the company or its business environment. Operational risks, financial risks and organizational and management risks are internal risks as they have their source within the firm (Henschel, 2008, p.8). External risks occur in the business environment of the company and can be economical, technological, political, legal or cultural changes (Scheve, 2005, p.26). Economic risks apply to all companies, as they include the influence of macroeconomic variables on the company, its input factors and demand for the firm s products (Triantis, 2000, p.558). As this category covers risks, which depend on changes in financial markets, it is also often referred to as external financial or market risks. The main risk factors in this category are changes in interest rates, exchange rates and commodity prices (Triantis, 2000, p.559; Eckbo, 2008, p.542). However financial risks can also occur independent of the development of international markets. Also the way of financing, liquidity and equity consumption due to losses can become risks to the company. All three risks are internal financial business risks (Hermann, 1996, p.153). According to a study of Henschel (2008), the most relevant risk categories for SME are internal and external financial risks, strategic risks and business process risks. His findings are also confirmed by other studies (Henschel, 2008, p.106). In the following, internal and external financial risks will be specified while the other risk categories will not be assessed any further Financial risk management The focus of the next sections is on financial risk management. First, the different financial risks and then possibilities of managing them will be presented Financial risks Financial risk management has received increased attention over the past years (Glaum, 2000, p.373). The reason for this is that financial risks, though they are not a core competency of non-financial firms, also influence their business operations to a large extend (Triantis, 2000, p.559). Financial risks can be of different forms. On the one hand there are external financial risks depending on changes on financial markets. On the other hand there are internal financial risks, where the company itself is the source of the risks (Eichhorn, 2004, p.43). 13

20 External financial risks are based on the risk factors of exchange and interest rates as well as commodity prices (Schönborn, 2010, p.3). These three risks will be assessed in the following: Exchange rate risk Exchange risk occurs when a company is involved in international business and the cash in or outflows are in a foreign exchange rate. As this rate is not fixed and cannot be fully anticipated a possible change in a foreign exchange rate leads to the risk of changes in the amount of a payable / receivable and by that a change in the amount of money the company has to pay / will receive. This risk is measured by the concept of transaction exposure (Glaum, 2000, p.375; Armeanu & Bãlu, 2007, p.65). Furthermore economic exposure can be included in the evaluation of exchange rate risk. This includes changes in the quantity of future sales due to changes in the exchange rate and therefore relative competitiveness of the company (Nassauer & Pausenberger, 2000, p.271). However, the prediction of this sensitivity is difficult and hardly measurable and thus the company cannot manage this risk actively. Most firms therefore concentrate on transaction exposure and by that on the price change and not the quantity change caused by the exchange rate volatility (Smithson, Smith & Wilford, 1995, p.6). Interest rate risk Interest rate risk is based on changes in interest rates and can be observed in different forms. The first form refers to changes in interest rates in connection with variable loans and short-term financing. A rise in the interest rate leads to higher interest payments for the variable rate loan and more expensive follow-up financing. This decreases the company s earnings and can in worst case it is lead to financial distress. Second, the vice versa case refers to cash positions of the company with a variable interest rate. A fall in this rate leads to a loss in earnings. Thirdly, also fixed rate debt contracts can be a risk for the company. In times of declining interest rates those contracts cause higher payments then a variable loan would do and are disadvantageous for the company. However, these costs are opportunity costs and not real costs to the company (Dhanini et al., 2007, p. 74). Therefore it can be summarized that the more corporate debt and especially short-term and variable rate debt a company has, the more vulnerable it is to changes in the interest rate (Dhanini et al., 2007, p.71). Finally demand sensitivity caused by interest rate changes can also be regarded as part of the interest rate risk. However, similar to economic exposure of foreign exchange rate risk, also the 14

21 prediction of this sensitivity is also difficult and hardly measurable. It is therefore in practice ignored for most products and companies (Schönborn, 2010, p.4). Commodity price risk A risk on the procurement market is the price volatility of commodities. This can become a significant risk for the company if the commodities are relatively important inputs with regard to price and/ or quantity (Stroeder, 2008, p.219). Fluctuations can then cause much higher (or also lower) procurement costs than anticipated and decrease (increase) the profit margin of the firm. In worst case the company makes a loss with the production (Eckbo, 2008, p.544). The group of internal financial risks consists of risks regarding the financing of the firm, liquidity risks or the solvency risk (Hermann, 1996, p.153). In the following, the three risks will be specified. Financing risk Firm financing can become a risk for the company due to different reasons. The choice between fixed rate and floating rate debt, the duration of the debt and the overall amount of debt financing are possible sources of risks, which already have been assessed in the paragraph about interest rate risk. The firm wants to be flexible and at the same time lower the costs for financing (Börner, 2006, p.298). The duration of loans is important in connection with the assets, which are financed with the loan. Here, often a mismatch between the durations can be observed. Longterm assets are then financed with short-term and adjustable rate loans, leading to a shortfall in cash flows in times of rising interest rates. This fact again can lead to a worse ranking of the company and worse conditions to get future loans. Furthermore difficulties regarding follow-up financing over the rest of the lifetime of the asset can occur. Vice versa long-term financing of short-term assets might lead to access financing when the asset is no longer existent. This causes unnecessary interest payments for the company (Vickery, 2006, p.447). Finally, a high amount of debt financing can become a risk to the company. In case the return decreases and is lower than the demanded interest rate, the company is not able to pay the interest without making a loss in that year. This consumes part of the equity and might lead to an even more dramatic situation in the next period (Hermann, 1996, p.156). 15

22 Solvency risk The partly or whole consumption of equity is another financial risk of a company when the company is not able to earn a profit for the year. However this is the result of other risks, which influence the business. Reasons can be a decrease in sales or an increase in costs for example the financing of the firm and high interest rates, which lead to a deviation from the plan and a loss. The result is a partly or whole consumption of equity in the period and loss of solvency (Hermann, 1996, p.154). Liquidity risk As well as consumption of equity, liquidity risk is mainly the result of other risks, which cause a deviation of the planned outcome and might lead to lower cash inflows or higher cash outflows. Liquidity measures the ability of the firm to cover its expenses and therefore it also shows whether the company is able to cope with some losses due to risk occurrence (Smithson, Smith & Wilford, 1995, p.121). A lack of financial funds can cause problems in the ability of the firm to pay its bills on time and by that lead to additional costs (Börner, 2006, p.298). On the one hand costs occur for arrears fees. On the other hand the rating of the company can be lower and therefore future financing leads to higher interest payments (Eichhorn, 2004, p.44). Due to that the financing risk becomes more urgent and can lead to higher liquidity and solvency risks. As external and internal financial risks can have a huge impact on the company and its business continuity, a management of these risks is essential also for non-financial companies Financial risk management without derivatives The reasons for managing financial risks are the same as those for implementing a risk management, as financial risks are a subcategory of the company s risks. One of the main objectives is to reduce the volatility of earnings or cash flows due to financial risk exposure (Dhanini et al., 2007, p.75). The reduction enables the firm to perform better forecasts (Drogt & Goldberg, 2008, p.49). Furthermore this will help to assure that sufficient funds are available for investment and dividends (Ammon, 1998, p.12). Another argument for managing financial risks is to avoid financial distress and the costs connected with it (e.g. Triantis, 2000, p.560; Drogt & Goldberg, 2008, p.49) Finally also managerial self-interest of stabilizing earnings or the aim to keep a constant tax level can be motives for financial risk management (Dhanini et al., 2007, p.76), 16

23 Depending on which of the arguments is in the focus of the company, the risk management can be structured. The focus is either on minimising volatility or avoiding large losses (Ammon, 1998, p.2). Internal financial risks Reduced volatility in cash flows or earnings and prevention of losses allow better planning of liquidity needs. This can avoid shortcuts of available funds and consumption of equity (Eichhorn, 2004, p.44). However, in order to maintain financially liquid and avoid end of period losses, it needs to be analysed which the maximum tolerated loss is. The focus of the risk management should therefore be in correspondence with the actual financial situation of the company. Then, by managing, among others, internal and external financial risks, also the liquidity risk and solvency risk are taken care of. Financing risk, which needs to be managed directly, mainly depends on a mismatch between the duration of assets and their financing. The company should therefore try to match the two durations in order to avoid problems with and high costs of follow-up loans. Furthermore this reduces the risk of having more debt than needed after the asset s lifetime and by that it saves interest costs (Vickery, 2006, p.447). External financial risks External financial risks depend on changes on the financial markets. One possibility to secure against price or exchange rate volatilities would be to buy or sell the amount, which is needed or will be received in the future, already today. However the organization of the transactions requires administrative work.. Furthermore this is sometimes not possible as the commodities cannot be stored or keeping them causes high costs. Foreign funds or debt causes work and costs in similar ways. Finally, the possibility to secure the interest rate exposure or change the conditions of the contract is often limited. This is because the specifics of debt contracts to a large extend depend on the credibility of the company and are not flexible (Brünger, 2008, p.122) Financial risk management with derivatives For the management of external financial risks financial instruments have been developed, which match the characteristics of the different risks and can be used to assess these. As the instruments are derived from an underlying asset, as for example commodities, metals and oil or financial assets, they are called derivatives. (Chisholm, 17

24 2010, p.1) Futures, forwards, options and swaps are the first generation of derivatives (e.g. Armeanu & Bãlu, 2007, p.65; Berk, 2009, p.287). Other derivatives are mainly based upon the four main categories. However, they are more complicated and require mathematical tools and computer programs to analyze their effects (Armeanu & Bãlu, 2007, p.65). Therefore more advanced derivatives are not widely used by companies (Chisholm, 2010, p.112). The four derivatives have in common that the contract s performance is moved to a future date while the specifications are agreed upon today (Berk, 2009, p.287). By using them, the risk can be fully or partly moved to a third party that has the capacity for that risk or faces the opposite risk exposure so the two risks neutralize (Triantis, 2000, p.563). When the company has decided to hedge a risk position fully or partly, it needs to be evaluated which instrument suits best the purpose of the company. The group of linear instruments includes forwards, futures and swaps. They are used when the development of the cash flow is a linear function of the development of the risk factor, as for example when securing import and export transactions and interest rate exposures (Bartram, 2004, p.2; Brünger, 2008, p.122). All three instruments are binding for both parties of the contract. This means that by the day the contract is made, both parties exactly know when they will receive what (Chisholm, 2010, p.44; Albrecht & Maurer, 2008, p.577). In case of forwards and futures this includes a single transaction, while swaps are agreements between two parties to exchange streams of future payments. Therefore the first two are used to secure against volatile prices of the underlying assets and the latter to change the leg of a payment stream (Chisholm, 2010, p.2). Options, however, are nonlinear and mainly used for securing financial portfolios. Here the development of the cash flow is nonlinear and for example depends on price and quantity changes due to volatility of the risk factor (Bartram, 2004, p.2, Brünger, 2008, p.122). Another important difference to the other derivatives is, that only the person selling the option is obliged to fulfil the business stated. The buyer buys the right to decide at expiration date whether he wants to exercise the option and sell (buy) a financial position etc. (Chisholm, 2010, p.2). The advantage of using options is that losses at the date of maturity are limited but possible gains are not limited (Glaum, 2000, p.377). 18

25 However hedging in most cases also eliminates possible chances. Further the security achieved through hedging has its price due to fees for the instrument and the management s time involved in the process (Brünger, 2008, p.66). However, the administrative costs will decrease over time and with increasing routine. Furthermore the price for the hedge is lower the less specialized the instrument and the less volatility involved (Eckbo, 2008, p.550). 3. Literature review In the following chapter a review of the literature on risk management in small and medium sized enterprises and the financial analysis will be given Risk management in SME SME and larger companies differ in many aspects, also in risk management practices. The differences are discussed in the following. Furthermore deficits in literature are pointed out and important aspects for risk management in SME are derived Differences between SME and larger corporations The official EU definition of small and medium sized enterprises was presented in section It concentrates on differences in size - of headcount, turnover and balance sheet sum - to distinguish between small, medium sized and large companies. However, SME differ from larger corporations not only in size but also in aspects of management structure, specialty of knowledge and position on procurement and financial markets. Furthermore - at least in Germany - a different legal framework applies to them. Those factors influence the business risk and also the risk management of the company (Krey & Rohman, 2008, p.363). Therefore they will be presented in the following. Management structure and specialty of knowledge In contrast to larger corporations, in SME one of the owners is often part of the management team. His intuition and experience are important for managing the company (Hermann, 1996, p.119; Pfohl, 2006, p.18). Therefore, in small companies, the (owner-) manager is often responsible for many different tasks and important decisions (Hermann, 1996, p.128). Two reasons for this can be found. First of all the concentration of power and competences might be due to structure of the company. Second, a lack of resources in SME often forces the management to fulfil other 19