The attitudes of entrepreneurs of the small and medium-sized enterprises sector in Poland to key business risks

Research background: The risk management process is a key element in run ing a business. Moreover, it is basically one of the basic and most important internal processes in any company, regardless of its size. However, due to the extreme ly important role played by small and mediumsized enterprises in the economy, the problem of pr per management of endogenous and exogenous risks becomes particularly important. Purpose of the article: The article aims to show the importance of risk man agement in the operations of modern enterprises in the SMEs sector and the attitudes of entrepreneurs towards key business risks. Methods: The research was based on data on 332 enterprises f rom the SMEs sector operating in Poland. The data was collected using the CSAQ metho d in the period from 12 of November 2019 to 9 of March 2020. The distribution of risk assess ment in the studies was analysed using Tau Kendall statistics, while the risk management index was created by examining the attitudes of entrepreneurs towards individual risk factors. Equilibrium. Quarterly Journal of Economics and Economic Policy, 15(3), 511–536 512 Findings & Value added: The results of the survey showed that three-quarters of enterprises did not manage risk in a formalized way and that decision-makers in enterprises often paid too little attention to the issues related to managing different types of risk. The article should, therefore, draw the attention of managers to the need to build appropriate procedures to enable effective risk management that creates opportunities for the safe operation of the enterprise. The added value of the work is a detailed analysis of the management of individual types of endogenous and exogenous risks, as well as an indication of what features of enterprises affect the effectiveness of actions taken in the field of controlling these risks. Research is valuable because of the small amount of studies that links managers' approaches to risk management with actual risk management effectiveness.


Introduction
In principle, risk is an inseparable element of the activity of every enterprise regardless of the country or industry. Managers knowledge and competences that will allow them to efficiently deal with the risk in the company are necessary to be able to conduct business in an undisturbed way. The risk management process is one of the basic and at the same time one of the most important internal processes in any enterprise, regardless of its size. Four basic elements have a decisive impact on the effectiveness of the risk management process: information, strategy, process organization, and the managers who manage it (Sołtysiak, 2014).
Enterprises belonging to the small and medium-sized enterprise (SMEs) sector are often perceived as necessary elements in terms of economic growth and the possibility of creating workplaces, and thus are factors limiting unemployment (Nowakowska-Grunt et al., 2018;Kowo et al., 2019). In OECD countries, small and medium-sized enterprises are the dominant form of activity and constitute about 99% of all entities. They are also the main source of employment, which accounts for around 70% of workplaces and contribute a lot to value creation, generating 50% to 60% of the valueadded. Moreover, in developing countries, small and medium-sized enterprises generate around 33% of GDP (OECD, 2017). It is often pointed out that due to their size, and sometimes low progress in risk management processes, enterprises from the SMEs sector are particularly vulnerable to all undesirable events, both internal and external ones. Taking into account their huge role in the economy, it is obvious that properly operating risk management processes and the efficient functioning of the entire organization is not only in the interest of the enterprise owners but also in the interest of society as a whole. Therefore, enterprises from the SMEs sector need to learn how to properly manage risk to reduce their impact on the functioning of the organization.
If one wants to manage an enterprise successfully, the conditions under which the business is conducted cannot be ignored (Meluzín et al., 2018;Skalicka et al., 2019;Chłodnicka & Zimon, 2020;Balcerzak, 2020;Sanchez-Roger et al., 2020). Having information about uncertain and changing surroundings can have a positive impact on the effectiveness of decisions. The issue is increasingly becoming the subject of research and considerations carried out by academics who, in the conclusions formulated, indicate the possibilities of comprehensive security of business interests by minimizing the possibility of risk occurrence, and in the event of its occurrence limiting the effects of its implementation (Dankiewicz, 2018;Domańska-Szaruga, 2020). Anticipating future operating conditions poses many difficulties regarding the identification of possible types of risk and their potential consequences (Rogalska, 2018;Chehabeddine & Tvaronavičienė, 2020). However, the possibilities in this regard are limited, because the enterprise is influenced by both external and internal forces, which are often beyond its control. Admittedly, entities strive to limit the negative impact of these interactions by developing the capacity for selforganization. The ability to deal with this phenomenon requires the collection and processing of a lot of information, as well as their proper analysis and assessment. In every enterprise, there are a lot of types of risks that affect its proper functioning to varying degrees. A detailed analysis of the sources and structure of risk allows determining the most serious threats associated with various types of risk and taking effective preventive measures, or at least minimizing the impact of risk on the company financial result. The success of a company depends on the selection of methods and tools to estimate and limit risk.
Modern risk management concepts are based on several basic assumptions. First of all: individual risk types are not considered, but the risk portfolio perceived in the context of the company strategy. The risk portfolio is not a simple sum of its types, as it is assumed that there are specific relationships between individual types of risk. Secondly, enterprise risk management requires a holistic approach. All types of risk are analyzed together, taking into account the diversification effect. Thirdly, quantitative methods are necessary for adequate risk measurement. Fourthly: the risk management process in the organization should be implemented by employees at all levels. It requires the absolute commitment of management because it is a part of strategic management. Next: many basic types of risk are the result of business activities, concern goodwill, and profit, which in consequence means that this risk cannot be sufficiently secured (Bednarczyk, 2017).
The article aims to show the importance of risk management in the operations of modern enterprises in the SMEs sector in Poland and the attitudes of entrepreneurs towards key business risks through: − identification of risk areas and creation of a hierarchy of key business risks in the sector under examination, relating to both problems that may arise in the external and internal environment; − identification of exogenous and endogenous business risk factors; − examination of entrepreneurs' opinions on possible key threats and issues regarding the approach to risk, in particular, the ways of its identification and assessment as well as management of the identified type of risk.
In order to achieve the above-mentioned aims, the following research hypotheses were formulated and then tested: H1: The most important business risks accompanying the activities of small and medium-sized enterprises are personal and legal risks.
H2: The bigger the company is, the better and more complete the risk management process is. There is a statistically significant correlation between these variables.
H3: Some small and medium-sized enterprises do not manage risk in a formal way, even though they sometimes have appropriate procedures.
Empirical research was conducted with the use of a questionnaire completed by decision-makers of 332 Polish enterprises belonging to the SMEs sector. The data was collected between November 12, 2019 and March 9, 2020, so this was the period before the COVID-19 pandemic. The analysis of the obtained data was carried out with the use of Tau Kendall statistics, and in order to examine the attitudes of entrepreneurs towards risk factors, an appropriate risk management indicator was constructed.
The structure of this article is organized as follows. Section 1 briefly presents the essence and importance of enterprises from the SMEs sector in the economy, as well as the role of risk management in contemporary enterprises. Section 2 reviews the literature and focuses primarily on the most important risk factors in the operations of small and medium-sized enterprises and the impact of appropriate risk management on the operations of companies and their development. Section 3 describes the survey methodology, a sampling process and the statistical methods used in the study. Section 4 presents the most important results obtained in the course of the conducted research, while Section 5 compares the obtained results with the findings of other authors. The conclusions present the real implications for practice, the limitations of the study, and the direction of the authors' future research.

Literature review
Numerous studies show that small and medium-sized enterprises have a huge impact on the development of the national economy. Južnik Rotar et al. (2019) undertook to investigate whether employment in enterprises belonging to the SMEs group affected total employment in the European Union. Based on data from 2005-2016, the authors showed that there was a significant relationship between employment in the SMEs sector, especially in service companies, and overall employment in the economy. The results are very solid, despite the fact that in the indicated years EU countries experienced an economic crisis. This shows the importance of enterprises from the SME sector for economic growth. Due to the extremely high importance of small and medium-sized enterprises in the economy, issues related to risk management in this type of enterprises are even more important (Kot et al., 2018;Pisar & Bilkova, 2019;Lewandowska & Stopa, 2019).
The risk management process is a key element of running a business and one of the basic and most important internal processes in any company, regardless of its size. The literature indicates that the essence and purpose of appropriate risk management is to reduce the risk potential and limit the impact of possible losses on the company (Bajo et al., 2012). The risk management process consists of many stages, but the main phases include identification, risk assessment, risk management, and the monitoring and review phase of procedures (Ferreira de Araújo Lima et al., 2020). Enterprises operating in the modern economic environment are exposed to risks of various origins, and from the point of view of effective risk management, it is necessary for decision-makers to be able to identify individual risks that threaten them. Thanks to this, it will be possible to take appropriate steps to minimize the effects of these risks.
The studies available in the literature show that entrepreneurs differently identify the key types of risk for their business. Research by Belás et al. (2014) on a group of small and medium-sized enterprises from the Czech Republic and Slovakia, show that decision makers consider market risk (understood as the lack of contracts), financial risk (meaning difficult access to financing), operational, personal and legal risk as key risk factors, respectively. Similar conclusions come from the research by Hudáková and Dvorský (2018), which found that Slovak entrepreneurs indicate market, financial and economic risk as the most crucial risks for their business. On the other hand, research by Hudáková and Masár (2018) shows that in the Czech Republic and Poland, the third place in the ranking of key risks is personal, not economic, as in the case of Slovakia. In Hungary, on the other hand, personal risk is on the second position and financial risk on the third. Thus, the analysis of the literature shows that enterprises differently identify their key risks and that endogenous and exogenous risks have different meanings. In some countries, internal risks pose a greater threat to the enterprise, in others the opposite is true. This shows how complex and important for the overall risk management process is the proper identification of risks present in the economic environment.
Risk management issues in the SMEs sector have been studied for a long time. One of the reasons for this is, undoubtedly, the sensitivity of this type of enterprise to changes in the business environment. The research conducted by Hudakova et al. (2018) shows that among enterprises in the SMEs sector in the Slovak Republic, market, financial, economic and personal risks are the main ones that affect negatively the business environment of small and medium-sized enterprises. The authors also indicate that to improve the level of risk management, it is necessary to increase theoretical knowledge about it among entrepreneurs, as well as to familiarize them with methods and tools that can be used in risk management processes.
The research on SMEs management practices in risk management shows that many factors influence risk management methods. One of these factors may be the gender of the owners or managers. The research results on this topic are not homogeneous, but some of them indicate that the level of knowledge about key risk factors does not differ significantly due to gender or education (Belás et al., 2015b), while others show that women show greater sensitivity to operational risk (Gorzeń-Mitka, 2015). However, it is pointed out that the managers' lack of skills to understand, identify and predict business risk, and thus also the lack of adequate knowledge in the use of risk management tools and an ability to create a long-term risk management strategy are one of the key factors that impede the development of enterprises (Belinskaja & Velickiene, 2015). The research on companies in South Africa showed that companies were often unaware of what elements make risk management effective. Although owners usually understand what risk management is, problems arise at the stage of being able to use risk management processes to bring benefits to business development (Sifumba et al., 2017). Risk management and sustainable development are areas that are closely related. It is pointed out that the SMEs sector approach to risk management also depends on its approach to sustainable development (Oláh et al., 2019). Such correlation can be observed on the example of the Czech Republic, where the company's approach to risk management is closely linked to the responsibility of managers towards owners and stakeholders (Mikušová, 2017). Therefore, increasing the awareness and knowledge of entrepreneurs is crucial to improving the effectiveness of risk management processes, and sustainable entrepreneurship gives a chance to stand out among the competition. It turns out that the level of knowledge of business owners about the risks surrounding them is often insufficient. The differences occurring in the scope of risk perception between enterprises depending on their size are pointed out. The studies by Belás et al. (2015a) proved that financial risk did indeed significantly affect the business environment of enterprises, but only a few companies can skilfully manage this type of market. Although the knowledge of SMEs owners regarding financial risk is greater than that of micro-enterprise owners, in both cases this level is insufficient. Later research showed that the greatest impact on the intensity of financial risk among the Czech enterprises in the SMEs sector was caused by factors such as proper risk management by entrepreneurs and sufficient financial coverage of enterprises using external sources of financing (Belás et al., 2018a;Belas et al., 2018b;Meyer & Meyer, 2020).
It is also worth emphasizing that a properly organized and effective risk management process in an enterprise, apart from limiting the impact of the negative effects of risk, may bring the company some benefits. The literature also notes the relationship between risk management and company performance. The research conducted by Mohammed and Knapkova (2016) shows that there is a positive and significant correlation between risk management and financial results. Therefore, the authors point out that enterprises should perceive risk management not only from the perspective of defence, but also as a key success factor to ensure stable earnings and improves the overall condition of the enterprise. Effective risk management has a direct impact on the results of enterprises. Similar conclusions can be drawn from the studies by Muslih (2018), who, researching companies listed on the Indonesian stock exchange, proved that proper risk management in an enterprise brought wide benefits in the form of an increase in enterprise efficiency. It was also pointed out that appropriate risk management practices in addition to the significant impact on the company's financial results were an important factor affecting competitive advantage, especially among small and medium-sized enterprises (Yang et al., 2018). Moreover, proper risk management also had a positive impact on such aspects of business operations as the quality of decisions under the influence of risk and greater responsibility, which in turn, in addition to an overall increase in efficiency, translated into a greater ability to achieve strategic goals (Gates et al., 2012). In turn, Fraser and Simkins (2016) emphasize that enterprise risk management primarily provides important information that can help make decisions, and thus contribute to solving problems and dilemmas of managers.
Extensive research on risk and risk management in small and mediumsized enterprises emphasizes the importance of this topic not only for the enterprises themselves, but also for the entire economy, in which it is in the interest of such enterprises to be able to safely conduct their activities.

Research methodology
The survey was conducted among Polish companies belonging to the SMEs sector. Before proceeding to the appropriate stage of the survey, a database of enterprises was created based on the data of the Central Statistical Office in Poland. The created database consisted of 6640 entities from the sector of small and medium-sized enterprises and covered all sectors, was representative for the whole economy.
The actual part of the study was carried out by the Computerized Self-Administered Questionnaire (CSAQ) method using Google Forms. 1 The surveys were sent to the companies from the database, and the incoming data were collected in the period from 12 of November 2019 to 9 of March 2020, in the period before the outbreak of the COVID-19 pandemic. The questionnaires were sent to the companies from the database by Flotex Polska as part of its call center activities, which made it possible to reach the widest possible spectrum of recipients. The questionnaire was addressed mainly to decision-makers in enterprises.
In order to reduce errors due to possible distortion of results, it was assumed that entities belonging to the group of large companies had a different, more mature approach to the identification and management of individual risk areas. This is due to access to a range of tailor-made services offered by third parties, which are practically unavailable to other market participants in this format (e.g. interruption insurance or trade credit insurance). Therefore, a group of respondents classified as large companies was excluded from the survey and focused only on the SMEs sector.
The survey covered entities based in Poland, operating in various sectors of the economy. The sample itself had random characteristics, although due to the structure of the SMEs sector in Poland (micro enterprises consti-tute a vast majority, over 83% of the sample), one layer had to be distinguished: enterprise size in order to control the number of small and medium enterprises in the sample. Therefore, the research was conducted on a stratified sample. Finally, 332 companies were covered by the study, which gives 5.4% of maximum error (at confidence level 0.95 and 0.5 fractions).
The companies that ultimately took part in the survey accounted for 5% of the base created and represented all sectors of the economy. Selected enterprises were grouped according to the sector classification in force in Poland. However, the largest number of enterprises were from the industrial processing sector (29.2%), wholesale and retail trade; repair of motor vehicles, including motorcycles (25.8%) and construction (14.7%). Other industries had much smaller shares in the analysed sample.
The data obtained in the course of the research procedure were used to analyse the risk distribution assessment. In this analysis, Kendall's Tau statistics were used as a measure of the monotonic dependence of random variables using the tau-b estimator measure.
Next, the attitudes towards individual risk factors were examined, it was proposed to create a cumulative indicator containing a cumulative assessment of the ability to identify and manage these risks, as a result of which we will obtain the so-called risk management index. The analysis focused on those entrepreneurs who declared to perform specific activities. The following scale was used to create the indicator: 1 -for enterprises that manage at least one type of risk, 2 -at least two, and 3 -which are aware and manage all the presented risks. As a result, at the stage of interpretation of results, a score of 0 is given to respondents who do not manage any of the three presented types of risk. The indicator was calculated as an appropriate combination (sum or difference) of managing individual risk types described in the work in accordance with the proposed formula (see Table 1).

Hierarchy of types of risk experienced by entrepreneurs
The progress of civilization and economic activity cause that new and specific threats are constantly appearing. High dynamics of changes can be observed in recent years and even months when threats to cybersecurity or health due to the invasion of COVID-19 coronavirus appear with increasing intensity while having the significant impact on local and global economies. The approach to risk management is also changing, which is increas-ingly based on early warning systems, which enable the threat to be identified and appropriate remediation processes to be initiated at the right moments, thus allowing an improvement of the situation as soon as possible. The effectiveness of the actions largely depends on the factors affecting the risk and sources of their origin (Kaigorodova et al., 2018). The research allowed an identification of a catalogue of key types of risk related to both problems that may appear in the internal and external environment of the entities (see Figure 1).
The most important risk experienced by the respondents is the personnel risk, which on the one hand is related to the lack of qualified staff, and, on the other, to the negative impact of the human factor in the company. Representatives of medium-sized enterprises (68% of such enterprises) more often indicated personnel risk. This type of risk is particularly acute for construction companies, as 81% of representatives of this area of activity indicated this category. Personnel risk is the least severe for the trade sector (retail and wholesale). The entrepreneurs' responses correspond to the situation in the Polish labour market. Employment in the construction industry in Poland is constantly growing, however, the number of investments carried out means that employers are still looking for employees with appropriate competences. The situation is aggravated by the economic migration of specialists from this industry.
The second type of risk felt by entrepreneurs is the legal risk related to the negative impact of regulations on business operations. Ministerial transfers indicate permanent facilities that are addressed to entrepreneurs (https://www.biznes.gov.pl/pl; PARP, 2019), however, the audit of legal acts carried out by Grant Thornton (https://barometrprawa.pl/). Representatives of companies that have been in the market for more than 3 years more often feel legal risk. 53.6% of these companies indicated legal risk, while among companies operating in the market for three years, this risk was noticed by 41.5%.
Less than half of the companies participating in the survey indicated existing market risk resulting from insufficient sales of goods and services. This type of risk is more often felt by micro-enterprises (50%), companies dealingwith trade (both retail -62% and wholesale -55.6%), and companies that have been operating in the market for over 10 years (51.9%). This may be the result of increased competitiveness in the Polish market (EY, 2017). Market risk is less perceptible by medium-sized enterprises (44%) and the service industry (43.2%).
Financial risk is assessed at a similar level as market risk. 46.4% of respondents indicated fear of falling financial results due to external and internal factors. The threat of financial risk was more often indicated by rep-resentatives of medium-sized enterprises (52%), engaged in retail trade (57.1%), which have been operating in the market for less than 5 years (58.2%). This type of risk is less experienced by micro-enterprises (42.7%), companies offering services (44.2%), operating in the market for over 5 years (42.7%). Financial risk is associated with personnel risk (the need to employ a sufficient number of people) and market risk (the level of sales of goods and services). What counts here is the "experience" in the market.
Entrepreneurs assigned much less attention to strategic risk resulting from the company's unclear future orientation. Entrepreneurs involved in trade (29.4%) and above all companies that have been operating in the market shorter than for 3 years (39%) indicated this type of risk slightly more often. Representatives of the services sector (23.3%) and construction (23.8%) and companies operating in the market for over 10 years (21%) less frequently indicate strategic risk. The decisive element in perceiving strategic risk seems to be the market presence. "Older" companies often have a better-refined mission and vision of their brand/activity.
The type of risk most frequently indicated by entrepreneurs was operational risk related to insufficient use of production capacity and low quality of production. Representatives of companies dealing with production (15.7%) and construction (14.3%) mainly indicated operational risk. This risk only slightly affects the trade by 5.9%. Therefore, the obtained results confirm the H1 hypothesis, which puts personal and legal risk at the forefront of key risks among enterprises from the SMEs sector. Undoubtedly, these risks have the significant impact on the operations of enterprises, because both human errors and changes in the legal environment may pose serious threats to their stable functioning.
In the survey, business risks were examined in terms of their prioritization, i.e. the importance of risks in the perception of respondents. On the other hand, endogenous and exogenous risk factors were used to clarify whether the respondents manage these factors in their enterprises. Selected risk factors are discussed in detail later in the article due to the area of the author's research interests.

Exogenous business risk factors
Only four of the companies declared that they are "export-only" businesses. Another 85 companies (25.6% of respondents) focus on their activities on both the domestic and foreign markets. So, just over a quarter of the companies deal with export. Another 23 companies (6.9%) declared that exports were in their strategic plans (but they are still operating in the domestic market). This means that for the vast majority of the enterprises from the SMEs sector, the domestic market (73%) is the one for the operation.
Representatives of export-related companies were asked to assess their capabilities in identifying and managing the risk associated with the presence in foreign markets. Only 12.4% of exporters declared that they were unable to identify, assess, and manage such risk. 31.5% did not have an opinion in this respect, and the others said that they were dealing with export risk management. Thus, one-third could not assess their skills in this area, but -importantly -56.1% of the companies (at least in their assessment) deal with export risk. Variables such as the size of the enterprise, years of operation or the economic sector represented do not affect declarations as to the skills and capabilities of export risk management, even though it can be presumed that experience should play an important role in this field.
In the analysis of the distribution of answers to the question about market risk, it should be emphasized once again that the study was carried out before the true scale of the economic crisis associated with the COVID-19 pandemic was revealed, in the second half of March 2020 in Poland. 15.6% of SMEs sector representatives said that market risk (resulting in a lack of sales for the company) was considered "inappropriate" (which could be considered as "too high"). Another 40.1% did not have a clearly defined opinion in this respect (which may suggest the scale of uncertainty in emerging increasingly pessimistic crisis scenarios), but as many as 44.3% declared that this risk is adequate (the summary result for the answer "definitely yes" and "rather yes") (see Table 2).
It is not difficult to guess that in the case of market risk assessment, the size of the enterprise is of key importance, and micro-entrepreneurs feel least confident, and probably representatives of medium-sized entities (Kendall's tau-c = -166 for i = .012). Interestingly, the years of operation of a given enterprise or business sector do not matter and do not differentiate respondents in a statistically significant way.
The third type of exogenous risk for enterprises is financial risk. For 70.8% of the companies, financial risk is part of their daily activities. The opposite view is taken by 10.8% of respondents. However, 64.2% of respondents declare that they can properly manage this risk in their own company. Also, in this case, an attempt was made to check whether variables such as the size of the enterprise, the duration of the enterprise, or the represented sector are statistically significant in the distribution of these responses. It turns out that a statistically significant correlation only takes place in the case of a pair of variables: enterprise size and assessment of financial risk management skills (Kendall's tau-c = -.123 for i = .005), which means that again micro-entrepreneurs feel less confident in financial risk than representatives of medium-sized companies and indicates that the hypothesis H2 is true (see Table 3).
At the end of the analysis of attitudes towards individual types of exogenous risks, it was proposed to create a collective indicator, including a cumulative assessment of the possibilities to identify and manage these risks. With one caveat -as a small part of the companies is related to exports, the export risk was omitted, and the developed index covered only market and financial risk. Going a step further, it is worth dividing the respondents into two categories. The first category is those who considered that they are coping well with a given risk (they chose the answers "definitely yes" and "rather yes"). The latter are the others (the scale of the answer "I have no opinion" indicates a great sense of uncertainty, so in the context of the content of questions about risk, it is worth simply connecting these respondents with those who explicitly stated that they cannot cope with these risks).
In this way, an exogenous risk management index (summary index for two questions about market risk and financial risk) was created (see Table 4).
The results clearly show that only one-third of the companies deal with two types of external risks for the enterprise, at least in the declarative sphere. Again, it was checked whether the size, duration of the activity, and sector of the economy could have statistical significance for the formulated answers. Again, the correlation is statistically significant for the size of the enterprise (Kendall's tau-b = .179, for i = .000). In other words, the larger the SMEs enterprise, the more complete the management of exogenous (market and financial) risks.

Endogenous business risk factors
Strategic risk results primarily from the lack or defective implementation of the strategy adopted by accompany. This results in unfavourable or incorrect decisions that do not correspond to changes taking place in the external environment. The condition for the success of activities is a continuous interaction with the environment, which in certain cases even enforces specific actions constituting a departure from the assumed plan while conditioning the success of the project. Entrepreneurs more and more often consciously accept such a state that the results of the survey also confirmed their attitudes. It should be noted that 60.5% of the entrepreneurs agreed with the statement (20% strongly agreed) that proper strategic management improved the company's competitive ability and stability in the domestic and foreign markets. 12.6% of respondents raised objections in this respect, while opinions on this subject could not be expressed more often than every fourth respondent (26.8%) (see Table 5). An important role in the assessment of the importance of strategic management in a company is played by its size. The positive significance of proper strategic management was more often reported by medium-sized enterprises than by micro and small ones (Kendall's tau-c = -.095 for i = .022). The opinions on strategic risk management are not statistically significantly affected by the company's seniority in the market or the industry it represents. Since 60% of entrepreneurs appreciate the role of "proper" strategic management, and only every fourth (24.7%) indicated that strategic risk was important to them, it could be assumed that the majority of procedures were implemented to manage this type of risk. Here, however, there is dissonance in the respondents' declarations. 44.6% of respondents confirmed that the company regularly monitored, assessed, and managed strategic risk. The lack of activities in this area was indicated more often than every fifth respondent (22%), and every third (33.4%) was unable to determine their opinion.
As in the question about the importance of strategic management, also in the question about taking action in this area, the size of the enterprise is of key importance. Regular activities regarding monitoring, assessment, and management of strategic risk are undertaken more often in mediumsized enterprises than in micro and small ones (Kendall's tau-c = -.117 for i = .000). Interestingly, there are no differences in activities related to strategic risk between companies that they consider to be significant and those for which it is not significant. As a result, it can be concluded that compared to other types of risk, entrepreneurs downplay the strategic risk. This results in the fact that it is located almost at the very bottom of the hierarchy of the perceived risk, and entrepreneurs, although often appreciate the positive importance of proper management of this type of risk, are less likely to take regular actions to manage it.
Similarly, as in the case of the market and financial risk, a cumulative indicator was created covering the cumulative assessment of opinions on the role of strategic risk management and actions undertaken in this respect by entrepreneurs. In this way, an index of endogenous risk management, which is a strategic risk, was created.
The resulting index allows one to "group" entrepreneurs into those who have: − consistent beliefs about strategic risk: (a) appreciate its importance and regularly manage it (38.9% of entrepreneurs); (b) do not see the importance of managing this risk and do not take any action in this respect (8.7%); (c) cannot assess strategic risk (15.7%); − divergent beliefs about strategic risk: (d) appreciate its importance, but do not take the "right" action (6%); (e) conduct regular activities but do not see their significance for the company (1.8%). The value of the endogenous risk management index is influenced by the size of the enterprise (Kendall's tau-c = -177 for i = .000). According to declarations, 57.3% of medium-sized enterprises appreciate and apply strategic risk management, while in the group of micro-enterprises only 30.9% of companies present such an attitude. The lack of activities in the field of strategic management and the lack of its effects was reported by only 4% of medium-sized enterprises and 11.8% of micro-enterprises. The lack of opinion on strategic risk is characteristic of 30% of small companies.
Market and financial risk analyses indicate that the larger the SMEs, the more complete the endogenous risk management is.

Opinions of entrepreneurs on possible threats in the near future
The respondents were asked to identify 3 most significant threats to the represented enterprises in the next 5 years. The answers do not add up to 100% because it was a multiple-choice question. The outcomes are presented in Table 6, where they are ranked from the most to the least frequently indicated.
The threats indicated by entrepreneurs are dominated by those related to market risk (which means a decrease in sales for the enterprise). Here, however, a very interesting relationship is revealed -companies that (according to their declarations) do not control exogenous risks, consider legislative changes as the most important challenge (56.6% of responses), while those that manage these types of risk see the biggest problem in the slowdown economic growth (59.5% of responses). Exogenous risk management correlates with the size of the enterprise. It turns out that risk management is an awareness issue, even affecting the identification of basic threats, which is somewhat an obvious conclusion, but also showing the potential scale of educational challenges in this area.

Methods for risk identification and an assessment in enterprises
Efficient identification of existing risk types together with an objective assessment is one of the key skills that decision-makers responsible for company development should possess. To verify the answers obtained in the study, the authors developed the so-called aggregate enterprise risk management indicator, using the answers to the following questions: Our company regularly monitors, assesses and manages strategic risk, I assess market risk (resulting in no sales for my company) and I can manage financial risk in my (our) company. These three questions were originally on a five-point ordinal scale from 1 -"definitely yes" to 5 -"definitely not", where 3 meant "I have no opinion". Therefore, the recording was first made by combining "yes" answers under code 1, and the remaining ones were assigned to the code 0. This means that the analysis focused on those entrepreneurs who declared performing specific activities. As a result, at the stage of interpretation of the results, the result 0 is given to respondents who do not manage any of the three types of risk presented. For example, financial, market, and strategic, 1 -those who manage at least one of them, 2 -at least two, and 3 -those who are aware and manage all the risks presented. On this basis, the distribution of the obtained responses in terms of the development of the cumulative index was analysed (see Table  7).
The interpretation of results allows for stating that as many as one-fifth of the enterprises do not manage any of the three identified types of risk. A similar result is a sufficient awareness to manage all three; at least in the sphere of declarations. The real problem is an approach to risk, and in particular, how the respondents identified and assessed it. The analysis of the responses may come as a surprise, since as many as 13% of respondents declare that they do not deal with such issues, and as many as 59.6% do it at most intuitively and spontaneously during other processes. This means that de facto three-thirds of the entrepreneurs do not formally manage individual types of risk, which indicates that hypothesis H3 is true. In order to obtain the full picture of the situation, a comparison of risk management attitudes with the risk management index was done (see Table 8).

Discussion
The conducted research proved that enterprises belonging to the small and medium-sized sector were often not very good at managing certain types of risk. The results show that the vast majority of entrepreneurs identify and assess risk in their company spontaneously and do not manage risk in a formal way. These results are in line with most of the available studies. The lack of adequate refinement of risk management procedures in, among others, Polish enterprises was also indicated in the research by , where the reason for this state of affairs was given, among others, in the inappropriate attitude of managers to risk, as well as their lack of knowledge and experience in risk management. These results are also consistent with the studies by Crovini et al. (2020), where it was indicated that the risk management process was not always formalized, but an unconscious, intuitive risk analysis was always performed. In turn, studies by Britzelmaier et al. (2015) carried out on German companies proved that risk management was most often used by large entities, therefore the use of this process in small and medium-sized enterprises played a minor role.
On the other hand, when examining the opinions of entrepreneurs about the key business risks, it was noticed that among the surveyed entities, the most significant perceived risk was personal risk, followed by legal risk, while the answers obtained indicated operational risk the least frequently, which is consistent, inter alia, with the results of the Havierniková and Kordoš research (2019). Partially consistent conclusions can be drawn from the studies by Belás et al. (2014) carried out on a group of small and medium-sized enterprises from the Czech Republic and Slovakia, where basically the same risks were indicated, but their hierarchy was different. On the other hand, the research conducted by Hudáková and Dvorský (2018) on the group of small and medium-sized enterprises from Slovakia shows that entrepreneurs are most concerned about financial, market and economic risks, and in our research these risks were not indicated as key. A possible explanation for the observed differences in results may be that enterprises operate in a slightly different economic environment, and therefore their perceptions of key risks may be different. Moreover, a lot also depends on the individual attitudes of the managers whose answers were the subject of the research.
The research also showed that when entrepreneurs identified the most important threats to their companies, they most often indicated such fears as economic slowdown, legislative changes and increased competition. Therefore, these are mainly threats related to the market risk (the risk of a decrease in sales for the company). These results are consistent with the results of Gorzeń-Mitka (2012) and Hudáková and Masár (2018), who indicated market risks as the main sources of threats in all European Union countries. The obtained results are also partly consistent with the results of Oláh et al. (2019), who, while researching the countries of the Visegrad Group, indicated that the risk of insufficient profit wasthe greatest threat to enterprises.
By analysing individual risk factors, our research showed that when entrepreneurs assessed market and financial risk, the key factor was the size of the company, not the age of the company or the sector. Only between these variables there was a statistically significant relationship. The results obtained differ from the results of studies conducted, for example, by Virglerová et al. (2016), where it was indicated that, in addition to the size of the enterprise, risk management was also influenced by the factors such as the age of the entrepreneur and the company. On the other hand, research by Brustbauer (2016) showed that the risk management process was also influenced by variables such as the sector or ownership structure. The described differences in results may be the consequence of different operating conditions, which are slightly different even in countries with a similar level of economic development. However, referring to the available studies, it can be stated that the larger the SMEs enterprise, the more fully it manages exogenous and endogenous risks.
It seems obvious that the greater the awareness and formalization of procedures, the more risks are managed in a given entity. Our research showed that sometimes it was different (declarations were being analysed) -that despite having formal procedures or even a specialized risk management unit, some types of risk were not managed by selected enterprises. These results are consistent with the observations in previous studies. Some small and medium-sized enterprises manage risk based on the beliefs of owners and managers, and despite carrying out some forms of risk identification and assessment, and thus having certain procedures, owners may simply ignore certain types of risk (Sparrow, 1999).

Conclusions
The research showed that decision-makers of enterprises in most cases were aware of specific risks in their environment. However, in case of external risks, only one-third of the companies could manage two types of risks. Besides, the research showed that the larger the SMEs enterprise, the more complete the management of both exogenous (market and financial) and endogenous risks. According to the companies, the most important threats in the next five years were also identified in the research. In the entrepreneurs' opinion, those related to market risk (which means a decrease in sales for the enterprise) dominate. However, the research showed a very interesting relationship -companies that (according to their declarations) did not control exogenous risks, considered legislative changes as the most important challenge, while those that managed these types of risk saw the biggest problem in the slowdown in economic growth. As to the results of research, as many as one-fifth of the enterprises surveyed do not manage any of the identified types of risk. However, an approach to risk, and in particular, how it is identified and assessed by the respondents, are the main problems. It is also surprising that despite having formal procedures or even a specialized risk management unit, some types of risk are not managed by selected enterprises, which is consistent with other research available in the literature.
The results of the conducted research may indicate practical implications for those involved in the management of small and medium-sized enterprises. Our results should in particular draw managers' attention to the need to design procedures in such a way that they can effectively identify and manage risks in a way that ensures the safe functioning of the company. The most important novelty and added value of this work is a very detailed analysis of the management of particular endogenous and exogenous risks. The research is valuable due to the small number of works that link managers' approaches to risk management to the actual effectiveness of risk management.
However, there are some limitations to this research. Firstly, the scope of the research was limited to the territory of Poland only, which gives a picture of risk management in one country only. Secondly, the authors did not manage to reach a wider group of companies. The results collected from a larger number of entities could give better results and allow for drawing more specific conclusions supported by the actions of a large group of decision-makers. In addition, the use of a wider range of statistical methods could produce slightly more accurate results. Despite these limitations, the authors believe, however, that the article raised some interesting issues which will stimulate further research and discussion.
In future studies, the authors will focus, among other things, on the subject of risk management by small and medium-sized enterprises with more internationalised activities. Moreover, in the future, the authors would like to expand the scope of their work and compare the results of research conducted on a group of Polish enterprises with entities operating in other countries of Central and Eastern Europe, the European Union or other countries of the Visegrad Group.