Supply Chain Risk Management in Young and Mature SMEs

Abstract

In this article, we examine how external factors such as demand, security regulation, cyber risks, and relative performance influence supply chain risk management (SCRM) in young and mature small and medium-sized enterprises (SMEs) in Turkey. For this, we utilised fuzzy set qualitative comparative analysis (fsQCA) using data from 137 Turkish SMEs. Our results suggest a single significant path for explaining SCRM in young SMEs, while we found three significant paths for explaining SCRM in mature SMEs. Furthermore, the results indicate that demand risk is the only external factor for young SMEs to realise SCRM success. For mature SMEs, demand risk and/or relative performance are essential to explain SCRM performance. Based on our findings, we theoretically contribute by unravelling the pathways through which external factors influence SCRM performance. Moreover, practitioners could align their strategies towards these pathways when constructing a strategy for achieving SCRM performance.

1. Introduction

Supply chain risk management (SCRM) is essential for all types of organisations as it contributes positively to long-term performance (Colicchia and Strozzi 2012). Today’s unstable and dynamic environment shows that members of supply chains are exposed to a large number of risks, old ones and completely new ones, such as COVID-19 (Parast and Subramanian 2021). This situation calls not only for a systematic and holistic approach to SCRM but also one that is proactive (Ratten 2020).

Recent publications suggest that the study of SCRM, in general, has increased (Colicchia and Strozzi 2012; Bak 2018; Fan and Stevenson 2018; Wicaksana et al. 2022); our understanding of this topic from the perspective of small and medium-sized enterprises (SMEs) remains, however, underdeveloped (Ferreira de Araújo Lima et al. 2020). This is an unsatisfactory situation considering that SMEs as members of supply chains are in particular vulnerable because of business specifics and the limited personnel and financial resources available to these businesses (Doern et al. 2019; Herbane 2019; Yaakub and Mustafa 2015). Additionally, SMEs are often the weakest actors in supply chains but are at the same time exposed to the same supply chain risks as their larger counterparts (Thun et al. 2011). Consequently, there is a multitude of circumstances that call even more for SCRM.

While it is acknowledged that risk management is costly and time-consuming (Parast and Subramanian 2021) and thus a demanding business function (Callahan and Soileau 2017), a critical gap remains in how external factors influence SCRM in different types of SMEs. Considering that SMEs (1) typically demonstrate high sensitivity to market fluctuations and regulatory restrictions (Ferreira de Araújo Lima et al. 2020), (2) are quite heterogeneous (Curran and Blackburn 2001), and (3) scholars have recently highlighted that there is a limited understanding of factual and context-specific challenges faced by SMEs with their SCRM (Chowdhury et al. 2021), we address this gap and pose the following questions: How do external factors such as demand risk, regulatory risk, cyber risk, and relative performance influence supply chain risk management (SCRM) in SMEs? How do these factors differ in different types of SMEs, i.e., young and mature ones? By addressing these questions, we aim at gaining insight into how SME decision makers can promote activities conducive to SCRM.

We define SCRM as the process of identifying, assessing, and implementing strategies against potential risks to eliminate supply chain vulnerability. By examining the relationship between demand risk, regulatory risk, cyber risks, and relative performance and SCRM in young and mature SMEs, we contribute to extant research focusing on SCRM in SMEs. By considering different types of SMEs, we move away from the typical approach of viewing SMEs as a homogeneous entity. To test the assumptions of our paper, we surveyed 137 Turkish SMEs in different industries, suggesting that the mentioned factors can be essential for SCRM in young and mature SMEs.

By using fuzzy set qualitative comparative analysis (fsQCA) for analysing the data, we add a new method to the study of SCRM, which, to our knowledge, has not been used so far but could help identify causal configurations and thus provide a deeper understanding of SCRM in organisations.

The remainder of this paper is structured as follows. First, our theoretical framework is introduced, followed by a description of the methodology. Next, the findings are presented and then discussed. The paper ends with a conclusion that provides a summary of the relevant findings and addresses some limitations of the research and future research directions.

2. Theoretical Framework

2.1. External Factors and Supply Chain Risk Management

Research on supply chains tends to disintegrate risk management into three processes, i.e., risk identification, assessment, and mitigation. The initial stage of the process begins with risk identification, which is also considered critical for risk management (Foli 2022). The primary motive of risk identification is to identify all essential risks that the supply chain is exposed to. Having identified the relevant risks, evaluation and assessment are performed to better understand each of the risks and their relevancy (El Baz and Ruel 2021). To assess the risks identified, they are categorised according to their levels of frequency and severity (e.g., Er Kara et al. 2020). This stage is commonly known as risk assessment. The third process of risk management is risk mitigation. Risk mitigation involves taking concrete steps using timely countermeasures to reduce firms’ exposure to potential risks (Can Saglam et al. 2021; Gurtu and Johny 2021).

Extant literature suggests that supply chains are externally influenced by nature, political system, and market forces (Chopra and Sodhi 2004; Blackhurst et al. 2008; Cucchiella and Gastaldi 2006; Manuj and Mentzer 2008; Wagner and Bode 2008). Therefore, any potential risks associated with these external factors could impede the continuity of the supply chain. Hence, external factors refer to activities outside of the firm, which could directly or indirectly affect supply chain operations (Baghersad et al. 2021), including earthquakes, cyber-attack, competition, limited supply of raw materials, and pandemics. Therefore, the management of external factors is arguably the most difficult aspect of SCRM. Due to their externality, they often are beyond the control of firms. Olson and Dash Wu (2010) indicate that since actors of the global supply chain have less control over political risks, e.g., war and regulations, there is the likelihood of these risks resulting in labour unrest that could hamper the fluidity of the supply chain. Therefore, external factors are essential for consideration in SCRM.

2.2. SCRM and Young and Mature SMEs

Considering the complexity and uncertainty surrounding today’s supply chain, young SMEs (new to the business) are the most vulnerable to supply chain risks when compared with more mature SMEs. The susceptibility to supply chain risks differs between young and mature SMEs as a result of their exposure to newness and foreignness (Mostafiz et al. 2021). Generally, SMEs have their own challenges, which cut across limited financial and non-financial resources (Jarillo 1989) and are more strongly affected by external pressure than larger companies, which have more control over the external environment (Huggins and Weir 2012; Thukral 2021). In addition to that, young SMEs may tend to lack the initial capabilities and knowledge (Mostafiz et al. 2021) that are needed to develop an agile risk management strategy to contain the adverse impact of supply chain risks. Conversely, Harms and Schiele (2012) suggest that young SMEs are more aggressive and risk-takers than matured SMEs. It is argued that organisational inertia stagnates the drive for organisations to explore and learn new things (Majumdar 1997). Given that young SMEs are more advantageous when it comes to the structuring of more dynamic risk mitigation strategies.

The discussions above show there are no doubts that there are differences between young and mature SMEs. In de Jong et al.’s (2021) study, for instance, it was mentioned that young firms manage their resources differently from mature ones. This suggests that firms’ level of maturity shapes their allocation of resources; in particular, the resources invested in improving SCRM performance. Wieczorek-Kosmala et al. (2021) found that firms that have been in a market for some time (i.e., mature firms) develop a strong social capital. In times of crisis, social capital provides a kind of guarantee that helps in seeking support from partners. Hence, we conclude that young and mature SMEs have different SCRM configurations

2.3. Demand Risk and Supply Chain Risk Management

The cause of disruptions from the downstream of the supply chain is mainly a result of demand risks (Jüttner 2005). Demand risks include variation in demand, inefficient distribution channels, inaccurate forecasting, and unreliable customer relationship (Syed et al. 2019). Wagner and Bode (2008, p. 310) posit that demand risks “can originate from the uncertainty caused by customers’ unforeseeable demands”. The definition and sources of demand risks indicate that SCRM performance could be threatened. For example, using a sample of 106 Taiwanese firms across 20 industries, Chen (2018) shows that demand risks negatively affect business performance. To reduce the detrimental consequences of demand risks, the countermeasures to be developed ought to be forward looking by ensuring that the actions taken by the companies are thought through and progressively evaluated (Berg et al. 2008). With that, customers’ demand fluctuations can be well monitored and better met.

SMEs with little experience in supply chain business are more likely to face demand risk due to inadequate knowledge about market precedents. Knowing or having experience with previous market dynamics is always helpful in making informed decisions. A study by Bandaly et al. (2016) examine the effect lead time has on brewing firms’ performance. The results suggest that lead time is crucial to firms’ supply chains, meaning that high lead times are not desired because they keep customers waiting and create uncertainty in orders and demands. Based on the discussed empirical evidence and the tendency for young SMEs to be liable for newness, demand risks are likely to have a greater bearing on their SCRM performance than those of more mature SMEs. Hence, we propose

Proposition 1.

Demand risk is more strongly related to supply chain risk management of young SMEs than in mature SMEs.

2.4. Regulatory Risk and Supply Chain Risk Management

According to Viswanadham and Samvedi (2013), regulatory risks are high in developing markets. From the point of view of the government and industry associations, regulatory actions aim to address a broad spectrum of risk-related issues: different types of fraudulent actions; sanctions and export barriers; environmental, social, and governance requirements; and the mandates of labour, health, and safety laws. In response to these governmental edicts, in the best case, companies organise specific policies, perform monitoring activities such as audits and due diligence, and continuously improve compliance with current and newly released regulations.

Park et al. (2016) also conclude that adherence to compliance with regulations minimises the probability of SC disruption. The complicated scope of ever-changing regulatory initiatives is difficult to follow, let alone comply with, for SMEs. In this sense, fully developed compliance programs are necessary to keep minimising regulatory risk within SC (Hauser 2021). Moreover, several authors report positive impacts of compliance initiatives. For example, Whipple et al. (2009) point out that adherence to compliancy practices, in the long run, leads to improved product quality, increased customer satisfaction, and greater resilience to business threats.

By contrast, when considering the practices of compliance with regulations in SMEs, the situation might often be characterized by a lack of preparedness for changes introduced by new regulations as well as non-compliance with current regulations (Hauser 2021). The adoption of a systematic compliance approach is costly and time-consuming (Park et al. 2016), particularly with the limited resources at the disposal of most SMEs (Hillary 2004; Audia and Greve 2006). Thus, we propose

Proposition 2.

Regulatory risk is more likely to be related to SCRM of mature SMEs than in young SMEs.

2.5. Cyber Risk and Supply Chain Risk Management

Cyber risks within supply chains (SC) have become more harmful during the COVID-19 crisis (Miroudot 2020) because of the even further increasing remote and digitalised engagement between supply chain partners. This posed a considerable challenge, especially for smaller companies, as they are often disposed to a smaller pool of suppliers (Falkner and Hiebl 2015; Ellegaard 2008), practicing/relying on trust-based relationships with their SC partners (Poba-Nzaou and Raymond 2011) and only limited SCRM skills (Lavastre et al. 2012).

According to the National Institute of Standards and Technology (US NIST), cybersecurity risk can be defined as “an effect of uncertainty on or within information and technology. Cybersecurity risks relate to the loss of confidentiality, integrity, or availability of information, data, or information (or control) systems and reflect the potential adverse impacts on organisational operations (i.e., mission, functions, image, or reputation) and assets, individuals, other organisations, and the Nation.” With regard to SC, in particular, the information and data exchanged regarding this business operation are ready targets for cybercriminals since they contain consolidated information that is sensitive and easy to resell (Davis 2015). The breach of SC security may lead to misuse of the sensitive data on company operations, processes, and product specifics, loss of intellectual property, as well as disclosure of personal data of partners or employees and can lead to financial and reputational losses (Cheng et al. 2017; Ghadge et al. 2020; EUAC 2021). In turn, cyber-attacks on SC can lead to a domino effect on the entire SC network (Ghadge et al. 2020), causing work stoppages, loss of critical intellectual property, and ultimately undesirable costs. According to The European Union Agency for Cybersecurity (EUAC 2021) twenty-four supply chain attacks were identified from January 2020 to early July 2021 and such numbers were expected to increase significantly compared to last year.

Extant research on systematic approaches to cyber risks within SC has only started recently and is due to the immense threat posed by this type of risk to organisations of all kinds (Cremer et al. 2022). The implementation of systematic approaches to the risk management of cyber risks is complicated even for large, well-managed organisations, let alone SMEs with their particular challenges in general and regarding SC. However, as highlighted by Williams (2017), a cyber-attack that occurs in an individual company can affect the whole supply chain (knockdown effect). Thus, the inclusion of this type of risk into SCRM should be essential to businesses of any size. Considering that young companies in comparison to matured companies are more likely to run businesses in the IT sector or related sectors, a stronger focus on this type of risk can be assumed (Cueto et al. 2022), which is likely to have an impact on the firms’ approach to SCRM as well. Additionally, it is well established that firms with limited experience in business and ones that are experiencing liability of newness may be more vulnerable to cyber-attacks (Chandna and Tiwari 2021). Due to this, such firms tend to focus more on managing cyber risks in their supply chain operations. Therefore, one can argue that young firms’ supply chain processes are more susceptible to cyber risk, thus making SCRM a more necessary component. Hence, we propose

Proposition 3.

Cyber risk is more strongly related to SCRM in young SMEs than in mature SMEs.

2.6. Relative Performance and Supply Chain Risk Management

Recalling that SCRM is both costly and time consuming, organisations of any size should be interested in seeing the clear advantage of their SCRM efforts. As organisations have to make a trade-off between risk and benefits (Tang et al. 2021), a positive link between SCRM and organisational performance would send a clear signal to the organisations to engage with the former; to smaller ones in particular (Henschel and Durst 2016). As firms compete with other firms, they are also likely to compare how they are performing relative to these firms, most probably relative to their key competitors. Therefore, SCRM from the point of view of relative performance—understood as the measure of how a company is performing relative to its key competitors and viewed as a good sign of success—leads to some observations worth to be mentioned. Extant research suggests that the consideration of performance in SCRM is relatively new. For example, Jüttner et al. (2003) highlight four pillars of activity in a given company, including risk sources, consequences, drivers, and mitigating strategies, and several authors followed this idea and proposed frameworks for SCRM highlighting similar components (e.g., Wagner and Bode 2008; Bugert and Lasch 2018; Fan and Stevenson 2018).

Ritchie and Brindley (2007) extend this view by encompassing performance results as well. According to these scholars, profitability and economic metrics are paramount criteria in evaluating performance relative to SCRM. For empirical results that measured the effect of SCRM on businesses, to correlate with better business performance, Wieland and Wallenburg (2012) explored the impact of comprehensive programs for SCRM on 270 manufacturing companies. They concluded that proactive strategies of SCRM enable better performance for a given company, taken as a whole. They also pointed to the need to organise supply chains in accord with the competitive strategy.

With regard to the arguments in favour of and against establishing SCRM among SMEs, Manhart et al. (2020) found that SCRM enhanced company performance, when embedded in company strategy. In other words, they suggest that proactive SCRM can positively impact company performance, and outweigh the extra costs associated with IT or formalised risk mitigation processes. Vegt et al. (2015) stressed that this consideration of extra costs is crucial for SMEs, which may regard the expense as a burden. This might be a particular issue in young firms that have not yet generated continued streams of revenues and, thus, prioritise other activities over SCRM. In other words, young firms tend to be more interested in SCRM as soon as they have established themselves in the market. For mature companies, this is less of the case, since they had more time to learn and understand the benefits of SCRM for their overall business operations. Transferred to business performance, this means that the relationship between performance and SCRM in mature firms is loose, as opposed to young firms. Thus, we propose

Proposition 4.

Relative performance is more strongly related to SCRM in young SMEs than in mature SMEs.

3. Methodology

3.1. Data Collection

The selection of companies for this study was primarily based on information extracted from the Enterprise Europe Network-Izmir’s (EBIC-Ege). EBIC-Ege is a consortium of three partners spread over the Aegean region of Turkey. Its mandate is to provide general consultancy services to SMEs, with the aim of assisting SMEs to go international using innovative technologies. It is also noted that EBIC-Ege is an affiliate partner of the Enterprise Europe Network (EEN) consortium, under the auspices of the European Union (EU).

The sample of the study was exhaustively selected from a list of SMEs that visited the EBIC-Ege in the year 2019, since that year is said to have received the highest number of visits, according to the EBIC-Ege database. The reason was to reach out to a wide range of active SMEs, apparently in business. A total of 207 SMEs’ profiles were extracted from the database, which includes names of the companies, the names and contact details of the companies’ representatives with high-ranking positions (i.e., CEO, CFO, and Managers) in the area of supply chain management. We prepared an online survey and distributed a questionnaire to the 207 SMEs via email in March 2020. As of June 2020, the data were finally gathered.

The data set contains a total of 137 responses (out of 207 responses), thus, a response rate of 66%. The firms included in the study are representing different strata of SMEs (20% micro-enterprises, 29% small firms, and the remaining 51% medium-sized enterprises), all based on the classification criteria in terms of size of employees and annual company turnover extracted from the OECD’s (2005) report. Following Gage’s (2012) reasoning that firms that have been in operation for more than ten years cannot be considered nascent since their chances of survival have increased significantly, we classified SMEs into young and mature. Mature SMEs are those that have been in existence for more than ten years, whereas young SMEs are those that have been in existence for ten years or less.

Table 1. Demographics of participating SMEs.

Characteristics	Categories	Frequency	Percentage (%)
Year of Company Foundation	Young SMEs	32	23
	Mature SMEs	105	77
Size (Employees)	1–9	28	20
	10–49	40	29
	50–250	69	51
Annual Company Turnover	<2 Mio. Euro	45	33
	2–10 Mio. Euro	25	18
	11–20 Mio. Euro	12	9
	21–50 Mio. Euro	55	40

presents the demographics of the SMEs included in the study.

3.2. Measures

The present paper used a structured questionnaire to evaluate actual statistical measurements to operationalize the hypotheses based on empirical data collected, which is fundamental in most quantitative research approaches (Hair et al. 1998). To assess the validity and reliability of the survey instrument, the average variance extractor (AVE) and Cronbach’s Alpha α were computed. The result, as presented in

Table 2. Summary of the reliability and validity analysis.

Constructs/Condition	No. of Items	AVE 1	Cronbach’s Alpha α
Demand risk	6	0.52	0.82
Regulatory risk	3	0.88	0.93
Cyber risk	3	0.54	0.67
Relative performance	8	0.50	0.88
SCRM	2	0.72	0.88

¹ Should be ≥0.5 (Molina et al. 2007) and “α values” are acceptable (Park et al. 2016).

, suggest that all the constructs/conditions used in the study are valid and reliable since their values exceed the minimum threshold. The survey contains items of questions that were used to assess the following constructs/conditions: demand risk, regulatory risk, cyber risk, relative performance, and SCRM performance. All the constructs/conditions were evaluated using a five-Likert scale ranging from “1 = Strongly agree to 5 = Strongly disagree”.

To measure demand risk, we adapted from Park et al.’s (2016) and Wagner and Bode’s (2006) measures using the following items: (1) Our company maintains safety stock in case of supply chain disruptions; (2) Our company keeps extra inventory of strategic items (e.g., raw materials, parts, and finished goods); (3) Our company uses safety stock to have time to prepare response and recovery in case of disruption; (4) Our company maintains safety stock to reduce the likelihood of supply chain disruptions (e.g., supplier failure, machine breakdown); (5) In our kind of business, customers’ product/service preferences change quite a bit over time; (6) Our customers tend to look for new products/services all the time.

Similarly, we adapted from Park et al. (2016) to measure the construct/condition regulatory risk using the following items: (1) Our company follows government or industry-initiated security guidelines (e.g., C-PAT, CSI, FAST, and AMR); (2) Our company verifies that supply chain partners follow government or industry security guidelines (e.g., C-PAT, CSI, FAST, AMR, etc.); (3) Government institutions play the leading role in ensuring secure supply chains.

Cyber risk was measured based on the following items adapted from (Wagner and Bode 2008): (1) The number of attacks on supply chains has increased (e.g., IT); (2) Cyber-attacks cause more damage to supply chains than physical attacks; (3) The number of attacks on supply chains by competitors (e.g., sabotage, espionage) has increased significantly.

We utilised the performance measures from Durst et al. (2019), namely: Compared with our key competitors, our company (1) …is more successful; (2) …has a greater market share; (3) …is growing faster; (4) …is more profitable; (5) …is more innovative; (6) …is more sustainable; (7) …has better responsiveness to changes in the business environment; (8) …is more agile to measure relative performance

SCRM performance was measured based on the following items that were adapted from Hoffmann et al. (2013): (1) The company’s supply risk management is better than that of its competitors; (2) Overall, the company is satisfied with its supply risk management.

3.3. Common Variance Bias

Considering the nature of this present study, which applied a cross-sectional survey involving a single respondent from each firm, a common method bias might be an issue (Podsakoff et al. 2003). Common method bias simply refers to errors in measurement because of methodological issues that mostly arise due to single-source, self-report, and cross-sectional designs (Chang et al. 2010). To check for this bias, the Harman single-factors test was performed via exploratory factor analysis. According to the results, the first component percentage of variance is 45.4%, below the recommended cut-off of 50%. Hence, CMV is not an issue for this study.

3.4. Statistical Method (fsQCA)

Combining both qualitative and quantitative characteristics in a unified system for statistical analysis requires analytical techniques that could transform and standardise inputs of data set into binary format for easy interpretation (Ragin 2008). To the best of our knowledge, among the statistical techniques available in the literature, fuzzy-set qualitative comparative analysis (fsQCA) is one of the ubiquity approaches in this regard, and more importantly very effective in dealing with issues concerning small sample size (Ragin 2008). The fsQCA technique has been applied successfully in several disciplines, such as business (e.g., Silva et al. 2021), humanities (e.g., Kunasekaran et al. 2022), natural and applied sciences (e.g., Delhi and Mahalingam 2020), and social sciences (e.g., Han et al. 2022). Technically, fsQCA employs “Boolean algebra logic to examine the relationships between an outcome and all binary combinations of the independent variables” (Kraus et al. 2018, p. 17). Generally, fsQCA involves three concrete steps: data calibration, truth table building, and analysis by using Boolean algebra logic. An overview of the methods carried out using the three-step approach of fsQCA is explained in the subsequent paragraph.

Before applying the fsQCA, we divided the raw data set into two groups based on mature and young SMEs using criteria proposed by Mostafiz et al. (2021). The division generated 105 and 32 sets of data for mature and young SMEs, respectively. In the process of employing the fsQCA technique, first, data calibration was executed to convert the raw data into scores of set memberships. This was undertaken to ensure raw data variable values are ranked from 0.00 to 1.00; where the full membership score represents 95%, crossover point represents 50% and full non-membership score represents 95%. Once the data calibration was terminated, the truth table was constructed and analysed using the Boolean algebra logic for each of the groups (mature and young SMEs) independently based on the five defined constructs/conditions.

4. Findings

4.1. Analysis of Necessity

The necessary conditions analysis (NCA) results are presented in

Table 3. Analysis of necessary conditions for achieving SCRM performance in both young and mature SMEs.

Condition	Young		Mature
	Consistency	Coverage	Consistency	Coverage
DR	0.819405	0.689252	0.972895 *	0.612654
RR	0.604599	0.782293	0.604850	0.695096
CR	0.749079	0.744381	0.731045	0.675017
RP	0.937185 *	0.734829	0.944163 *	0.713213

* The level of consistency is significant at the cut-off point of >0.900 (Taheri et al. 2020); DR—demand risk; RR—regulatory risk; CR—cyber risk; RP—relative performance.

. NCA was initially performed to identify necessary conditions by “formulating a quantitative in degree and expressing which level of condition X (predictor) is necessary for which level of condition Y (outcome)” (Dul 2016, p. 37). In other words, this was carried out to better understand each construct/condition’s effects on the independent variables—in this case, demand risk, regulatory risk, cyber risk, and relative performance—on the outcome variable, SCRM performance. From the results, it is observed that relative performance is the only necessary condition for young SMEs concerning SCRM performance. However, for mature SMEs, in addition to relative performance, demand is also a necessary condition for SCRM performance.

4.2. Analysis of Sufficiency

Table 4. Analysis of sufficient conditions for achieving SCRM performance in both young and mature SMEs.

	Path	DR	RR	CR	RP	Raw Coverage	Unique Coverage	Consistency	Solution Coverage	Solution Consistency
Young SMEs (n = 32)	A1	⚪	⚫		⚪	0.68364	0.17584	0.68817	0.773213	0.645848
	A2	⚪		⚫	⚪	0.53164	0.05341	0.65752
	A3	⚫	⚫	⚪	⚫	0.30321	0.03615	0.89563
Mature SMEs (n = 105)	B1	⚪	⚫	⚪		0.56312	0.11939	0.72785	0.780316	0.644376
	B2	⚪	⚪	⚫		0.42379	0.04526	0.75564
	B3		⚫	⚫	⚪	0.42068	0.03010	0.73753
	B4	⚪		⚪	⚫	0.45431	0.00103	0.92398
	B5	⚪	⚪		⚫	0.38621	0.00373	0.90116

Note: “⚫” represents full membership, “⚪” represents partial membership, and “blank” represents full non-membership.

represents the results of fsQCA based on the analysis of sufficiency. It shows a total number of eight configurations available to trigger SCRM performance in both young and mature SMEs. However, to assess the sufficiency of these configurations, the values for the consistency and raw coverage are compared with the minimum threshold; 0.75 and 0.3, respectively. According to the results, four out of the eight configurations satisfy the requirement. Therefore, the results of the analysis of sufficiency do support paths A3, B2, B4, and B5, as sufficient configurations are needed to trigger SCRM in young and mature SMEs.

4.3. Causal Configuration for Young SMEs to SCRM

Among the three paths available, only one of the paths was chosen for young SMEs (i.e., A3). This indicates that young SMEs have limited pathways to attain SCRM performance. Path A3 shows that a significant level of demand risk, regulatory risk, and relative performance is needed for SCRM performance under low cyber risk.

4.4. Causal Configuration for Mature SMEs to SCRM

We discovered that three paths (i.e., B2, B4, and B5) can explain SCRM performance among mature SMEs. Path B2 suggests that SCRM performance significantly depends on cyber risk; however, there is a partial effect of demand risk and regulatory risk on SCRM performance. Path B4 also suggests that in an environment of little demand risk and cyber risk, a high level of relative performance could largely trigger SCRM performance. Alternatively, path B5 indicates that SCRM performance level could be attained through little influence from demand risk but a high level of relative performance.

5. Discussion

This study aims to examine how external factors such as demand, regulatory risk, cyber risk, and relative performance explain supply chain risk management (SCRM) in young and mature SMEs. Our findings indicate that there is a single significant path to achieve SCRM performance in young SMEs, and three significant paths to achieve SCRM performance in mature SMEs, as shown in Table 4 and Figure 1. Our result demonstrates the necessary conditions needed to explain SCRM performance. Based on our assumptions, we now interpret our results as follows:

Proposition 1 assumed that demand risk is more strongly related to supply chain risk management of young SMEs than in mature SMEs. Our results suggest that demand risk is a necessary condition needed for mature SMEs to attain SCRM performance. On the contrary, demand risk is not considered a prerequisite for SCRM performance by young SMEs. This suggests that the degree to which SCRM is explained under the influence of demand risk differs among young and mature SMEs, regardless of their size. For mature SMEs to explain SCRM performance, the presence of demand risk cannot be overlooked in that the older an SME becomes, the more complicated it becomes to maintain their safety stock since their customers might have increased over time, causing undesired lead times (Bandaly et al. 2016); a situation that young SMEs may not experience. While the presence of demand risk is not a necessity for SCRM performance in young SMEs, but rather, it is a sufficient condition. Path A3, which is the only path that leads to SCRM performance for young SMEs, identifies demand risk as a full member as opposed to being a partial member in all three pathways for mature SMEs. It is clear from this result that mature SMEs have more avenues for achieving SCRM performance under the influence of demand risk than young SMEs, thereby contradicting our assumption.

Proposition 2 assumed that regulatory risk is more likely to be related to SCRM of mature SMEs than in young SMEs. From the necessary condition results, it is observed that regulatory risk does not serve as a necessary condition for achieving SCRM performance either for young or mature SMEs. On the other hand, the analysis of the sufficient condition result indicates that regulatory risk is a sufficient contributor to achieving SCRM performance for young SMEs (path A3). Similarly, regulatory risk is also seen as a sufficient condition in achieving SCRM performance in two of the three paths in mature SMEs, although in a partial state. Since the regulatory risk is found in two paths in mature SMEs as opposed to one in young SMEs, we can argue that regulatory risk is more prevalent in mature SMEs. This finding is consistent with the second assumption. This can be explained by the fact that mature SMEs’ past experience plays an important role in dealing with disruptions in the SC as a result of government laws and regulations. As previous studies (Park et al. 2016; Whipple et al. 2009) have indicated, compliance with regulations mitigates potential threats to the supply chain network.

Proposition 3 assumed that cyber risk is more strongly related to SCRM in young SMEs than in mature SMEs. As we found, our results for the necessary conditions do not provide enough evidence to support the assertion, since cyber risk is not considered a necessary condition to explain SCRM performance in young and mature SMEs. By analysing the result of sufficient conditions, it is found that cyber risk is partially present in path A3 for young SMEs, whereas full membership (B4) and partial membership (B2) have been observed in mature SMEs. This suggests, therefore, that cyber risk is strongly related to SCRM performance in mature SMEs as opposed to young SMEs. In this sense, the third assertion in our paper is refuted. This may be explained by the fact that mature SMEs, being viewed as pioneers in the industry due to their long stay in the industry, are more likely to be targeted by cybercriminals. The reason may be that mature SMEs have long-term reputations in the industry, which makes them more attractive to cybercriminals. Thus, mature SMEs place a high value on cyber risk as a way to maintain effective SCRM to avoid financial and reputational losses (Cheng et al. 2017; Ghadge et al. 2020).

Proposition 4 assumed that relative performance is more strongly related to SCRM in young SMEs than in mature SMEs. Our results suggest both young SMEs and mature SMEs consider relative performance as an essential factor to necessitate SCRM performance. However, by considering the paths analysed, it is observed that relative performance is more evidenced in mature SMEs than in young SMEs. Our finding also contradicts this assumption. As indicated earlier, relative performance is determined by how well firms perform compared to their competitors, and since mature SMEs are well established (Gage 2012), they are likely to command higher market prices. Consequently, mature SMEs are more likely to have the resources to invest in SCRM strategies, thus improving their performance (Manhart et al. 2020; Wieland and Wallenburg 2012).

Implications

Our study contributes significantly to theory and practice. From a theoretical viewpoint, fsQCA offers new perspectives on achieving SCRM performance. Although our study reveals a single path for young SMEs to attain SCRM performance, it also demonstrates that there are multiple ways to attain SCRM performance, which is validated by mature SMEs. So, with this, we depart from a generic one-pathway approach to understanding SCRM. In previous studies (Chopra and Sodhi 2004; Blackhurst et al. 2008; Cucchiella and Gastaldi 2006; Manuj and Mentzer 2008; Wagner and Bode 2008), factors/conditions of SCRM performances were standardised, while in our study, the factors/conditions were delineated into necessary and sufficient conditions to understand the conditions that must be met before the outcome variable (SCRM performance) will occur, and also the conditions that will lead to the outcome variable (SCRM performance). A unique feature of our study is how we partitioned SMEs into young and mature by examining their SCRM performance configurations individually.

Practitioners such as CEOs and supply chain managers working in small businesses can benefit from our research. SMEs in the infancy stage should be aware that the pathways to attain SCRM performance are relatively limited in comparison to mature SMEs. In this respect, it is prudent for nascent SMEs to channel their efforts into innovation initiatives to improve their overall performance. SMEs at this maturity level must handle their demand risk very rigorously to ensure that they optimise their inventory to reduce costs and improve their SCRM performance.

6. Conclusions

While the body of research on SCRM is steadily growing, the specific case of analysing SCRM among SMEs remains limited. The current study utilised fsQCA to define the relationship between external factors (demand risk, regulatory risk, cyber risk, and relative performance) and SCRM performance for young and mature SMEs. Our research found that young SMEs could achieve SCRM performance through a single pathway, while mature SMEs could achieve it through three pathways. Demand risk was regarded as a necessary condition for young SMEs while demand risk or/and relative performance are essential conditions for mature SMEs.

Despite the contributions, there are some limitations to this study. The use of fsQCA brings several new insights to SCRM research; however, it will be interesting to investigate this phenomenon in more depth through case study designs to answer the how and why questions (Robert 2003). Furthermore, the study is limited to constructs/factors of SCRM performance, and future research can investigate the configuration of other conditions/risk factors that have not been discussed in this study such as shortage of qualified staff, spare parts, or other relevant material needed for the provision of the firms’ goods and services. Finally, the study was conducted in Turkey, which is an emerging economy characterised by high levels of economic downturn and political unrest, including riots, general strikes, and anti-government demonstrations, which compounds additional risks and uncertainties involved in SCRM. As such, the transferability of the findings to other contexts is difficult unless there are some elements of common socio-cultural, economic, and political characteristics. It will be interesting to know whether the conditions/risk factors of SCRM performance identified in this study will remain the same taking into account the role of context. Hence, future research is invited to transfer the findings to other/different research contexts to assess the relevance and robustness of the findings and by doing so further develop research on SCRM.