1. Introduction
Public sector organizations globally are increasingly expected to operate under complex, uncertain, and high-stakes environments. Risk management is no longer viewed as a peripheral administrative function, but rather as a central element of good governance and strategic control. In this context, the concept of the “risk society” as introduced by Beck (1992) becomes relevant, positioning public institutions as last-resort risk bearers in modern democracies.
Despite the international emphasis on embedding risk awareness in public governance, Greece presents a notable case of delayed institutional adoption. Previous literature (e.g., Bhimani, 2009; Oulasvirta & Anttiroiko, 2017) highlights organizational and cultural barriers to risk management in the public sector, such as limited financial resources, lack of expertise, and political constraints. However, there is a paucity of empirical research focusing on the perceptions of senior public administrators, the very individuals responsible for setting the strategic tone for organizational change.
The role of leadership, the so-called tone at the top, is increasingly recognized as a critical determinant of successful risk governance in both private and public organizations. Leadership not only shapes the strategic orientation of institutions but also influences the organizational culture that governs risk awareness and tolerance (Kaplan & Mikes, 2012; Palermo et al., 2017). However, despite its theoretical significance, empirical research on how public sector leaders perceive and operationalize risk governance remains limited, particularly in non-Anglophone, high-bureaucracy settings (Bracci et al., 2022). Greece represents a particularly underexplored and analytically rich context, given its combination of chronic administrative fragmentation, fiscal oversight pressures, and institutional inertia (Christopoulos & Vlahogiannis, 2020). Unlike countries with long-established risk frameworks, Greece has only recently begun to institutionalize risk governance mechanisms in its public sector. This paper addresses the void in the literature by offering grounded evidence on how Greek public executives interpret and engage with risk management responsibilities. While focused on a single national case, the findings have broad relevance: they illustrate the universal challenges faced by emerging or reforming public administrations in aligning strategic leadership with risk-based decision-making, and they underscore the importance of institutional culture and leadership buy-in as global determinants of public governance effectiveness.
This paper addresses this gap by empirically investigating how top decision makers in Greece’s public interest organizations perceive the drivers and impediments to effective risk management. Particular attention is paid to how the “tone at the top”, that is, leadership attitudes and behaviors, influences the maturity and adoption of risk practices across organizational levels.
The study contributes to the literature by offering evidence from a national context with historically weak institutional trust and fragmented administrative systems. It also informs policy discussions on public sector reform and capability building in the area of risk governance.
2. Literature Review
Risk management has been studied extensively in the context of private sector governance and Enterprise Risk Management (ERM), with frameworks developed to formalize risk identification, assessment, and mitigation (Bromiley et al., 2015; Olson & Dash Wu, 2010). In contrast, public sector risk management remains under-explored, especially in non-Anglo-Saxon settings (Ahmeti & Vladi, 2017; Bracci et al., 2022). This underrepresentation is striking given the centrality of public institutions in managing systemic risks ranging from economic instability to health and climate emergencies.
Scholars have identified multiple barriers to risk management implementation in public organizations. These include institutional inertia, limited technical expertise, politicized decision-making processes, and insufficient performance incentives (Kapuscinska & Matejun, 2014). Furthermore, the lack of a risk-aware organizational culture and the complexity of legal frameworks often discourage proactive approaches to managing uncertainty (Oulasvirta & Anttiroiko, 2017).
The literature also increasingly emphasizes the role of leadership in embedding risk management into public administration. The concept of “tone at the top” refers to the ethical climate and strategic emphasis set by senior leaders, which shapes the broader organizational attitudes towards risk (Andersen, 2016). Empirical studies in private and public sectors suggest that leadership commitment is a decisive factor in the success or failure of risk initiatives (Bhimani, 2009).
Public risk management in Greece has traditionally been reactive, fragmented, and often limited to compliance-oriented procedures rather than embedded strategic foresight. Despite increasing awareness, particularly after the 2009 financial crisis and recent public health and climate-related emergencies, the operationalization of risk management in public entities remains weak. Many Greek public sector institutions lack formalized risk registers, consistent risk ownership, or integrated reporting mechanisms. Risk considerations are often treated as administrative formalities rather than as essential tools for improving performance, governance, and service delivery. This fragmented approach stems from deeply rooted bureaucratic traditions, limited leadership accountability, and a historical emphasis on procedural adherence over strategic agility (Spanou, 2008; OECD, 2022). As a result, risk management in Greece is perceived more as a technical or audit-related responsibility rather than a strategic leadership function, undermining its potential contribution to effective public value creation.
When benchmarked against ISO 31000 standards or best practices from leading OECD countries such as the United Kingdom, Netherlands, and Australia, Greece exhibits substantial implementation and conceptual gaps. ISO 31000 emphasizes a proactive, continuous, and integrated approach to risk that should be embedded across all levels of decision-making, a principle still largely absents in Greek public administration. While Greece has introduced several laws touching upon risk-related obligations, such as Law 4795/2021 on internal control systems and Law 4820/2021 establishing internal audit units in the broader public sector, these reforms tend to focus on compliance, control, and auditing functions rather than strategic risk alignment or risk culture development (Ministry of Finance, 2021). Moreover, the lack of clear guidelines on risk ownership, staff training, and performance incentives means that these legal instruments often suffer from poor implementation. In contrast, OECD frontrunners adopt an integrated governance perspective, supported by digital tools, risk maturity models, and inter-agency learning frameworks (OECD, 2022). Greece remains institutionally underprepared to align its risk governance efforts with such holistic frameworks.
A significant weakness in the Greek public administration is the conceptual misinterpretation of risk management, which is often conflated with administrative control or crisis response rather than strategic foresight and resilience building. The OECD’s Implementation Toolkit for Enterprise Risk Management in the Public Sector (IECD, 2021) stresses that effective public risk management must encompass opportunity identification, leadership engagement, and cultural alignment, dimensions systematically overlooked in Greece. Risk is frequently treated as an exogenous threat to be minimized post hoc, rather than an endogenous and manageable element of governance that can be anticipated, measured, and used to enhance strategic agility. This misalignment is compounded by a lack of cross-sectoral collaboration, data infrastructure, and performance evaluation tools, which prevents risk management from contributing to outcome-oriented policy design. Thus, Greece’s public risk governance suffers not only from operational fragmentation but also from a fundamental misreading of the purpose and scope of modern risk management.
This paper builds on these insights by providing empirical evidence on how Greek public executives understand and act upon risk-related challenges, highlighting the role of organizational hierarchy, experience, and policy culture in risk governance.
3. Methodology
The research employs a mixed-methods approach centered on structured interviews and Likert-scale surveys administered to top-level decision makers (N = 40 top-level decision makers) in Greek public interest organizations. A total of 17 questions were designed and categorized into thematic blocks addressing perceived risk factors, institutional barriers, and departmental effectiveness in managing risk. Notably, interview questions can be grouped as follows:
Questions about the factors that affect risk management (as a whole and its individual aspects).
Questions as to the reasons that delay and/or affect the establishment of a risk management department in public interest organisations.
Questions on the contribution of a risk management department to public interest organisations.
Questions about staffing a risk management department in public interest organizations.
Tables 1-5 examine the factors that influence risk management. Tables 6-9 examine the factors/reasons that influence and/or delay the establishment of a management department in organizations. Tables 10-13 refer to the contribution of a risk management department to public interest organisations and finally, Table 14 and Table 15 refer to the staffing of a risk management department. Therefore, this chapter seeks to answer key questions by highlighting how the leadership of public interest organizations in Greece understands and envisions risk management.
Participants were asked to evaluate various determinants of risk management effectiveness using a five-point Likert scale ranging from “Not at all” to “Too much” (Norman, 2010). Subsequently, respondents were required to rank these factors by importance within each theme, allowing the research to assess both absolute and relative perceptions of importance.
The quantitative data were analyzed using descriptive statistics and thematic interpretation to capture recurring patterns and divergences across responses. Key categories included the influence of organizational size, leadership training, experience, age, and gender, as well as perceived institutional and cultural obstacles to the formation of risk departments.
The design of the instrument ensures the exploration of both strategic perceptions and operational realities from the perspective of those entrusted with decision-making authority. Although the sample size is modest, its targeted composition, senior executives across diverse public entities, enhances the validity and policy relevance of the findings.
In this study, the concept of tone at the top was operationalized through survey items and interview prompts that examined leaders’ perceived responsibility for, and influence over, key aspects of risk governance. Specifically, respondents were asked to rate, on a five-point Likert scale, the extent to which senior leadership (e.g., Governors, Boards of Directors, and General Managers) was responsible for actions such as adopting risk management practices, developing a risk-aware culture, establishing risk management departments, and initiating best practice adoption (Tables 6-9). These questions capture the behavioral and attitudinal dimensions of leadership commitment, core elements of the tone at the top, as reflected in decision-making authority, strategic prioritization, and accountability for risk-related outcomes. By linking these measures directly to internationally recognized definitions of tone at the top (e.g., COSO, 2017; OECD, 2021), the study grounds its analysis in both empirical evidence and established governance theory.
4. Results
The analysis of survey and interview responses reveals a clear set of patterns regarding the factors influencing risk management, the allocation of responsibility, perceived barriers, the contribution of risk management departments, and staffing priorities. To ensure clarity, findings are presented in the order of the tables at the end of the paper, grouped thematically for readability.
4.1. Factors Affecting Risk Management (Tables 1-5)
Across Table 1 and Table 2, organizational size and managerial experience consistently emerged as the strongest factors influencing all categories of risk—strategic, financial, environmental, operational, and reputational. Both factors received high proportions of “very” or “too much” ratings and top rankings. In contrast, age and gender were almost universally rated as having little or no effect. Education and seminars had more mixed assessments, with education generally ranking higher for strategic and operational risks and seminars often positioned in the middle range.
Table 1. What do you think affects the degree of risk management in an organization (1 = none, 2 = little, 3 = moderate, 4 = very much, 5 = very much).
|
Total Risk |
Strategic Risk |
Financial Risk |
Environmental Risk |
Operational Risk |
Reputation Risk |
From the size of the organization |
1 |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
2 |
16.67% |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
3 |
0.00% |
16.67% |
0.00% |
33.33% |
0.00% |
0.00% |
4 |
0.00% |
33.33% |
50.00% |
16.67% |
0.00% |
16.67% |
5 |
83.33% |
50.00% |
50.00% |
50.00% |
100.00% |
83.33% |
From the level of training of administrative employees with a position of responsibility |
1 |
0.00% |
0.00% |
0.00% |
33.33% |
0.00% |
0.00% |
2 |
0.00% |
33.33% |
0.00% |
33.33% |
0.00% |
0.00% |
3 |
50.00% |
0.00% |
50.00% |
0.00% |
50.00% |
83.33% |
4 |
33.33% |
66.67% |
16.67% |
33.33% |
50.00% |
16.67% |
5 |
16.67% |
0.00% |
33.33% |
0.00% |
0.00% |
0.00% |
From the age of administrative employees with a position of responsibility |
1 |
50.00% |
50.00% |
66.67% |
50.00% |
0.00% |
50.00% |
2 |
16.67% |
16.67% |
16.67% |
33.33% |
50.00% |
16.67% |
3 |
33.33% |
16.67% |
0.00% |
0.00% |
33.33% |
33.33% |
4 |
0.00% |
0.00% |
16.67% |
0.00% |
16.67% |
0.00% |
5 |
0.00% |
16.67% |
0.00% |
16.67% |
0.00% |
0.00% |
By the gender of administrators in a position of responsibility |
1 |
100.00% |
100.00% |
100.00% |
100.00% |
83.33% |
100.00% |
2 |
0.00% |
0.00% |
0.00% |
0.00% |
16.67% |
0.00% |
3 |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
4 |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
5 |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
From whether administrators in positions of responsibility have attended seminars on management |
1 |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
2 |
0.00% |
0.00% |
0.00% |
16.67% |
0.00% |
16.67% |
3 |
66.67% |
50.00% |
66.67% |
33.33% |
66.67% |
66.67% |
4 |
16.67% |
16.67% |
16.67% |
16.67% |
16.67% |
16.67% |
5 |
16.67% |
33.33% |
16.67% |
33.33% |
16.67% |
0.00% |
From the experience of administrative employees with a position of responsibility in management matters |
1 |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
2 |
0.00% |
0.00% |
0.00% |
16.67% |
0.00% |
0.00% |
3 |
0.00% |
16.67% |
0.00% |
0.00% |
16.67% |
16.67% |
4 |
50.00% |
16.67% |
33.33% |
16.67% |
33.33% |
33.33% |
5 |
50.00% |
66.67% |
66.67% |
66.67% |
50.00% |
50.00% |
Table 2. Please prioritize the following factors based on whether they contribute to risk management in an organization using the scale from 1 to 6 (from least to most).
|
Total Risk |
Strategic Risk |
Financial Risk |
Environmental Risk |
Operational Risk |
Reputation Risk |
From the size of the organization |
1 |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
2 |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
3 |
16.67% |
16.67% |
16.67% |
0.00% |
0.00% |
0.00% |
4 |
0.00% |
0.00% |
0.00% |
16.67% |
0.00% |
0.00% |
5 |
50.00% |
33.33% |
66.67% |
33.33% |
50.00% |
50.00% |
6 |
33.33% |
50.00% |
16.67% |
50.00% |
50.00% |
50.00% |
From the level of training of administrative employees with a position of responsibility |
1 |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
2 |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
3 |
16.67% |
16.67% |
16.67% |
16.67% |
16.67% |
16.67% |
4 |
50.00% |
66.67% |
66.67% |
33.33% |
50.00% |
66.67% |
5 |
16.67% |
16.67% |
16.67% |
50.00% |
33.33% |
16.67% |
6 |
16.67% |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
From the age of administrative employees with a position of responsibility |
1 |
0.00% |
0.00% |
0.00% |
16.67% |
0.00% |
0.00% |
2 |
66.67% |
66.67% |
66.67% |
66.67% |
50.00% |
66.67% |
3 |
16.67% |
16.67% |
16.67% |
16.67% |
50.00% |
33.33% |
4 |
16.67% |
16.67% |
16.67% |
0.00% |
0.00% |
0.00% |
5 |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
6 |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
By the gender of administrators in a position of responsibility |
1 |
83.33% |
83.33% |
83.33% |
66.67% |
83.33% |
83.33% |
2 |
16.67% |
16.67% |
16.67% |
33.33% |
16.67% |
16.67% |
3 |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
4 |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
5 |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
6 |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
From whether administrators in positions of responsibility have attended seminars on management |
1 |
16.67% |
16.67% |
16.67% |
16.67% |
16.67% |
16.67% |
2 |
16.67% |
16.67% |
16.67% |
0.00% |
33.33% |
16.67% |
3 |
50.00% |
50.00% |
50.00% |
50.00% |
33.33% |
50.00% |
4 |
16.67% |
0.00% |
0.00% |
16.67% |
0.00% |
16.67% |
5 |
0.00% |
0.00% |
16.67% |
0.00% |
16.67% |
0.00% |
6 |
0.00% |
16.67% |
0.00% |
16.67% |
0.00% |
0.00% |
From the experience of administrative employees with a position of responsibility in management matters |
1 |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
2 |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
3 |
0.00% |
0.00% |
0.00% |
16.67% |
0.00% |
0.00% |
4 |
16.67% |
16.67% |
16.67% |
33.33% |
50.00% |
16.67% |
5 |
33.33% |
50.00% |
0.00% |
16.67% |
0.00% |
33.33% |
6 |
50.00% |
33.33% |
83.33% |
33.33% |
50.00% |
50.00% |
Table 3 and Table 4, which examined factors contributing to the development or improvement of risk management processes, reinforced these patterns. Size and managerial experience dominated, while education gained importance compared to its role in overall risk management. Seminars were again polarising, splitting between low/moderate and very high ratings. Age and gender remained negligible.
Table 3. The degree of development or improvement of risk management processes in an organization depends on.
From the size of the organization |
|
At all |
0.00% |
Little |
16.67% |
Moderate |
0.00% |
Very |
16.67% |
Too |
66.67% |
From the level of training of administrative employees with a position of responsibility |
At all |
0.00% |
Little |
0.00% |
Moderate |
0.00% |
Very |
83.33% |
Too |
16.67% |
From the age of administrative employees with a position of responsibility |
At all |
50.00% |
Little |
16.67% |
Moderate |
33.33% |
Very |
0.00% |
Too |
0.00% |
By the gender of administrators in a position of responsibility |
|
At all |
83.33% |
Little |
16.67% |
Moderate |
0.00% |
Very |
0.00% |
Too |
0.00% |
From whether administrators in positions of responsibility have attended seminars on management |
At all |
0.00% |
Little |
50.00% |
Moderate |
16.67% |
Very |
0.00% |
Too |
33.33% |
From the experience of administrative employees with a position of responsibility in management matters |
At all |
0.00% |
Little |
0.00% |
Moderate |
16.67% |
Very |
33.33% |
Too |
50.00% |
Table 4. Please prioritize the following factors based on whether they contribute to the development or improvement of risk management processes using the scale from 1 to 6 (from least to most).
From the size of the organization |
|
1 |
0.00% |
2 |
0.00% |
3 |
16.67% |
4 |
0.00% |
5 |
50.00% |
6 |
33.33% |
From the level of training of administrative employees with a position of responsibility |
1 |
0.00% |
2 |
0.00% |
3 |
0.00% |
4 |
83.33% |
5 |
16.67% |
6 |
0.00% |
From the age of administrative employees with a position of responsibility |
1 |
0.00% |
2 |
66.67% |
3 |
33.33% |
4 |
0.00% |
5 |
0.00% |
6 |
0.00% |
By the gender of administrators in a position of responsibility |
|
1 |
83.33% |
2 |
16.67% |
3 |
0.00% |
4 |
0.00% |
5 |
0.00% |
6 |
0.00% |
From whether administrators in positions of responsibility have attended seminars on management |
1 |
16.67% |
2 |
16.67% |
3 |
50.00% |
4 |
0.00% |
5 |
16.67% |
6 |
0.00% |
From the experience of administrative employees with a position of responsibility in management matters |
1 |
0.00% |
2 |
0.00% |
3 |
0.00% |
4 |
16.67% |
5 |
16.67% |
6 |
66.67% |
Table 5 explored whether risk management departments consider these factors and how much they affect departmental effectiveness. Managerial experience received unanimous “too much” ratings (100%) for its effect on departmental performance, and organisational size was also strongly valued. Education was recognised as relevant, while seminars remained divisive. Age and gender were again viewed as irrelevant.
Table 5. Do you believe that the risk management department of organizations takes into account the following factors and to what extent its effectiveness depends on them (1 = none, 2 = little, 3 = moderate, 4 = very much, 5 = very much).
|
It takes into account |
To what extent does efficiency depend |
From the size of the organization |
|
|
1 |
0.00% |
0.00% |
2 |
0.00% |
0.00% |
3 |
16.67% |
0.00% |
4 |
0.00% |
33.33% |
5 |
83.33% |
66.67% |
From the level of training of administrative employees with a position of responsibility |
|
|
1 |
0.00% |
0.00% |
2 |
0.00% |
0.00% |
3 |
0.00% |
16.67% |
4 |
50.00% |
83.33% |
5 |
50.00% |
0.00% |
From the age of administrative employees with a position of responsibility |
|
|
1 |
50.00% |
50.00% |
2 |
33.33% |
33.33% |
3 |
0.00% |
16.67% |
4 |
16.67% |
0.00% |
5 |
0.00% |
0.00% |
By the gender of administrators in a
position of responsibility |
|
|
1 |
83.33% |
83.33% |
2 |
0.00% |
16.67% |
3 |
16.67% |
0.00% |
4 |
0.00% |
0.00% |
5 |
0.00% |
0.00% |
From whether administrators in positions of responsibility have attended seminars on management |
|
|
1 |
0.00% |
0.00% |
2 |
33.33% |
16.67% |
3 |
0.00% |
33.33% |
4 |
50.00% |
33.33% |
5 |
16.67% |
16.67% |
From the experience of administrative employees with a position of responsibility in management matters |
|
|
1 |
0.00% |
0.00% |
2 |
0.00% |
0.00% |
3 |
0.00% |
0.00% |
4 |
0.00% |
0.00% |
5 |
100.00% |
100.00% |
4.2. Responsibility and Barriers (Tables 6-9)
Tables 6-8 show that top management (Governors, Boards) and General Managers were rated as having the highest responsibility for adopting risk practices, developing a risk culture, creating departments, ensuring effectiveness, and initiating best practices. Directors also featured prominently for some actions, while Heads of Departments and frontline staff were generally seen as having only moderate responsibility. Table 7 ranked the earlier factors in terms of their contribution to achieving organisational goals. Managerial experience and education scored highest, with size close behind. Seminars occupied a middle position, while age and gender were consistently lowest.
Table 6. In the hierarchy of organizations, who do you consider to be most responsible (practically) for risk management in the following actions (1 = not at all, 2 = little, 3 = moderate, 4 = very much, 5 = very much).
|
Top Management (Governors & Boards of Directors) |
General Managers |
Directors |
Head of Department |
Frontline Staff |
Responsible for the adoption of risk management practices and methodologies |
1 |
0.00% |
0.00% |
0.00% |
16.67% |
33.33% |
2 |
0.00% |
0.00% |
16.67% |
16.67% |
16.67% |
3 |
0.00% |
0.00% |
33.33% |
33.33% |
16.67% |
4 |
0.00% |
50.00% |
16.67% |
0.00% |
0.00% |
5 |
100.00% |
50.00% |
33.33% |
33.33% |
33.33% |
Responsible for developing a risk management culture |
1 |
0.00% |
0.00% |
0.00% |
0.00% |
16.67% |
2 |
0.00% |
0.00% |
16.67% |
33.33% |
33.33% |
3 |
0.00% |
0.00% |
16.67% |
50.00% |
50.00% |
4 |
0.00% |
33.33% |
66.67% |
16.67% |
0.00% |
5 |
100.00% |
66.67% |
0.00% |
0.00% |
0.00% |
Responsible for the creation of a risk management department |
1 |
0.00% |
0.00% |
16.67% |
50.00% |
50.00% |
2 |
0.00% |
0.00% |
33.33% |
0.00% |
0.00% |
3 |
0.00% |
16.67% |
0.00% |
50.00% |
50.00% |
4 |
33.33% |
33.33% |
50.00% |
0.00% |
0.00% |
5 |
66.67% |
50.00% |
0.00% |
0.00% |
0.00% |
Responsible for effective risk management |
1 |
0.00% |
0.00% |
0.00% |
0.00% |
16.67% |
2 |
0.00% |
0.00% |
0.00% |
0.00% |
0.00% |
3 |
0.00% |
16.67% |
0.00% |
66.67% |
66.67% |
4 |
83.33% |
16.67% |
100.00% |
33.33% |
16.67% |
5 |
16.67% |
66.67% |
0.00% |
0.00% |
0.00% |
Takes initiatives for the adoption of risk management best practices |
1 |
0.00% |
0.00% |
0.00% |
0.00% |
16.67% |
2 |
0.00% |
0.00% |
0.00% |
16.67% |
33.33% |
3 |
16.67% |
0.00% |
16.67% |
83.33% |
50.00% |
4 |
66.67% |
16.67% |
66.67% |
0.00% |
0.00% |
5 |
16.67% |
83.33% |
16.67% |
0.00% |
0.00% |
Table 7. Please prioritize the following factors based on whether they contribute to the degree of success of the organization’s goals using the scale from 1 to 6 (from least to most).
From the size of the organization |
|
1 |
0.00% |
2 |
0.00% |
3 |
50.00% |
4 |
0.00% |
5 |
33.33% |
6 |
16.67% |
From the level of training of administrative employees with a position of responsibility |
1 |
0.00% |
2 |
0.00% |
3 |
0.00% |
4 |
50.00% |
5 |
33.33% |
6 |
16.67% |
From the age of administrative employees with a position of responsibility |
1 |
0.00% |
2 |
100.00% |
3 |
0.00% |
4 |
0.00% |
5 |
0.00% |
6 |
0.00% |
By the gender of administrators in a position of responsibility |
1 |
100.00% |
2 |
0.00% |
3 |
0.00% |
4 |
0.00% |
5 |
0.00% |
6 |
0.00% |
From whether administrators in positions of responsibility have attended seminars on management |
1 |
0.00% |
2 |
0.00% |
3 |
50.00% |
4 |
16.67% |
5 |
33.33% |
6 |
0.00% |
From the experience of administrative employees with a position of responsibility in management matters |
1 |
0.00% |
2 |
0.00% |
3 |
0.00% |
4 |
33.33% |
5 |
0.00% |
6 |
66.67% |
Table 8 confirmed that organisational size and managerial experience were perceived as the most influential in decision-making and in establishing a risk management department. Education was also seen as influential, while seminars split respondents evenly between moderate and high influence. Age and gender had little or no effect. Table 9 identified the main barriers to establishing a formal risk management programme. The leading obstacles were complexity of procedures (81.94%), lack of relevant culture (80.56%), and complexity of the legislative framework (76.39%). The absence of integrated frameworks, insufficient leadership commitment, inadequate infrastructure, and limited training were also noted. Attitudes such as “no need” or incompatibility with strategic objectives were rare.
Table 8. From your personal experience, what factors do you think influence decision-making and the establishment of a risk management department in an organization.
From the size of the organization |
|
At all |
0.00% |
Little |
0.00% |
Moderate |
0.00% |
Very |
16.67% |
Too |
83.33% |
From the level of training of administrative employees with a position of responsibility |
At all |
0.00% |
Little |
0.00% |
Moderate |
33.33% |
Very |
50.00% |
Too |
16.67% |
From the age of administrative employees with a position of responsibility |
At all |
16.67% |
Little |
50.00% |
Moderate |
16.67% |
Very |
16.67% |
Too |
0.00% |
By the gender of administrators in a position of responsibility |
At all |
100.00% |
Little |
0.00% |
Moderate |
0.00% |
Very |
0.00% |
Too |
0.00% |
From whether administrators in positions of responsibility have attended seminars on management |
At all |
0.00% |
Little |
0.00% |
Moderate |
50.00% |
Very |
50.00% |
Too |
0.00% |
From the experience of administrative employees with a position of responsibility in management matters |
At all |
0.00% |
Little |
0.00% |
Moderate |
16.67% |
Very |
16.67% |
Too |
66.67% |
Table 9. Why does a significant part of public bodies (Organizations, Enterprises, Local Authorities, Ministries) not have an official risk management program? What reasons delay it using the scale from 1 to 12 (from least to most).
F. Complexity of processes |
81.94% |
L. Lack of relevant culture |
80.56% |
G. Complexity of the legislative framework |
76.39% |
K. Lack of an integrated risk management framework resulting in an isolated approach to risk management |
75.00% |
C. Lack of initiative and commitment on the part of the government and/or administration |
63.89% |
E. Insufficient or lack of risk management infrastructure (tools, data support structures, unreliable data) |
58.33% |
D. Lack of training-specialization of human resources |
50.00% |
I. Inability to adopt risk management standards in public sector procedures |
44.44% |
I. Limitations on the quality and reliability of the information required |
43.06% |
B. Insufficient resources (human, financial, etc.) |
41.67% |
H. Risk management cannot go hand in hand with strategic objectives |
23.61% |
A. No need |
11.11% |
The findings on procedural and legislative complexity as critical barriers have direct implications for policy-making in Greece. Addressing these obstacles requires reforms aimed at simplification, harmonisation, and standardisation of risk management regulations. First, a consolidated National Risk Management Framework could be introduced to replace fragmented provisions currently dispersed across multiple legislative instruments. This would align with OECD (2014) recommendations on regulatory coherence and streamline compliance requirements. Second, procedural steps for establishing and operating risk management departments could be codified into clear, standardised protocols, supported by digital platforms that enable uniform implementation and monitoring across public sector entities (Miller et al., 2020). Third, embedding proportionality principles in legislation—ensuring that compliance demands scale with organisational size and capacity—could reduce the burden on smaller agencies without undermining governance quality (Power, 2007). Finally, dedicated capacity-building programmes for senior public officials could help shift the prevailing compliance-oriented culture toward one where risk management is seen as an enabler of strategic performance, consistent with international frameworks such as ISO 31000 and the COSO ERM model.
These measures would not only reduce administrative friction but also enhance the integration of risk management into strategic decision-making, thereby moving Greek public administration closer to global best practices.
4.3. Contribution of Risk Management Departments (Tables 10-13)
Table 10 and Table 11 show unanimous agreement among respondents that risk management departments improve organisational effectiveness and support opportunity identification. Table 12 indicates that such departments are seen as contributing most to: establishing a standard framework and manual, creating a risk register, setting strategic benchmarks, fostering innovation, and anticipating/preventing risks. Complete elimination of risks was recognised as neither feasible nor cost-effective. Table 13 confirmed the primacy of framework creation, followed by the risk register, highlighting positive results from existing processes, setting strategic benchmarks, and identifying opportunities from unprecedented situations. The development of a remuneration system and complete risk elimination were ranked lowest.
Table 10. In your opinion, how much will the operation of a risk management department affect the effectiveness of the operation of the organizations?
At all |
0.00% |
Little |
0.00% |
Moderate |
0.00% |
Very |
50.00% |
Too |
50.00% |
Table 11. In your perception, how important it is to highlight opportunities through risk management.
At all |
0.00% |
Little |
0.00% |
Moderate |
0.00% |
Very |
66.67% |
Too |
33.33% |
Table 12. In your opinion, how important is the contribution of a Management department in a Public Sector organization to the following functions.
A. Anticipation and prevention of any form of danger before it occurs |
|
At all |
0.00% |
Little |
0.00% |
Moderate |
0.00% |
Very |
83.33% |
Too |
16.67% |
B. Complete elimination of all possible risks |
|
At all |
0.00% |
Little |
50.00% |
Moderate |
16.67% |
Very |
33.33% |
Too |
0.00% |
C. Highlighting opportunities that may arise from dealing with unprecedented situations |
At all |
0.00% |
Little |
0.00% |
Moderate |
16.67% |
Very |
50.00% |
Too |
33.33% |
D. Highlighting positive results from existing procedures without related to existing or potential risks |
At all |
0.00% |
Little |
0.00% |
Moderate |
50.00% |
Very |
33.33% |
Too |
16.67% |
E. Highlight new innovations to achieve the organization’s purpose more effectively |
At all |
0.00% |
Little |
0.00% |
Moderate |
16.67% |
Very |
66.67% |
Too |
16.67% |
F. Establishment of a standard framework and development of a relevant risk management manual |
At all |
0.00% |
Little |
0.00% |
Moderate |
0.00% |
Very |
33.33% |
Too |
66.67% |
H. The creation of a risk register |
|
At all |
0.00% |
Little |
0.00% |
Moderate |
16.67% |
Very |
33.33% |
Too |
50.00% |
G. Establishment of a strategic risk benchmark |
|
At all |
0.00% |
Little |
0.00% |
Moderate |
0.00% |
Very |
66.67% |
Too |
33.33% |
I. Development of a reward system |
|
At all |
0.00% |
Little |
0.00% |
Moderate |
50.00% |
Very |
50.00% |
Too |
0.00% |
J. Development of an accountability-accountability system |
|
At all |
0.00% |
Little |
0.00% |
Moderate |
0.00% |
Very |
66.67% |
Too |
33.33% |
Table 13. Rank on a scale from 1 to 10 (from least to most) the contribution of a risk management department to public sector organizations.
G. Establishment of a formal framework and development of a relevant risk management manual |
80.00% |
H. The creation of a risk register |
68.33% |
D. Highlighting positive results from existing procedures without related to existing or potential risks |
66.67% |
I. Establishment of a strategic risk benchmark |
66.67% |
C. Highlighting opportunities that may arise from dealing with unprecedented situations |
65.00% |
E. Highlighting new innovations to more effectively achieve the organization’s purpose |
61.67% |
A. Anticipation and prevention of any form of danger before it occurs |
58.33% |
K. Development of an accountability-accountability system |
50.00% |
B. Complete elimination of all potential risks |
16.67% |
J. Development of a remuneration system |
16.67% |
4.4. Staffing Priorities (Table 14, Table 15)
Table 14 and Table 15 examined the professional specialisations considered most important for staffing risk management departments. Law, finance, and informatics were consistently rated highest. Statistical analysis/econometrics was also valued but with more varied rankings. Operational employees (without a specific specialisation) received mixed ratings, reflecting uncertainty about their role in specialised units.
Overall, the results consistently identify organisational size, managerial experience, and leadership at the top as the strongest enablers of effective risk management. The most critical barriers are procedural and legislative complexity and a lack of risk-aware culture. Education, specialist expertise, and targeted training can strengthen capacity, but demographic variables such as age and gender have little influence. There is strong consensus on the value of formal risk management departments, provided they are staffed with appropriately skilled professionals and embedded within the organisation’s strategic leadership framework.
Table 14. In your opinion, how important is the contribution of the following specialties in a Management department in a public sector organization.
A. Law |
|
At all |
0.00% |
Little |
0.00% |
Moderate |
16.67% |
Very |
16.67% |
Too |
66.67% |
B. Operational Employees (end-users) |
|
At all |
0.00% |
Little |
0.00% |
Moderate |
33.33% |
Very |
33.33% |
Too |
33.33% |
C. Informatics |
|
At all |
0.00% |
Little |
0.00% |
Moderate |
16.67% |
Very |
16.67% |
Too |
66.67% |
D. Finance |
|
At all |
0.00% |
Little |
0.00% |
Moderate |
0.00% |
Very |
33.33% |
Too |
66.67% |
E. Statistical analysis and econometrics |
|
At all |
0.00% |
Little |
0.00% |
Moderate |
0.00% |
Very |
50.00% |
Too |
50.00% |
Table 15. Rank on a scale from 1 to 5 (from least to most) the contribution of the following specialties to a management department in a public sector organization.
A. Law |
|
1 |
16.67% |
2 |
16.67% |
3 |
0.00% |
4 |
50.00% |
5 |
16.67% |
B. Operational employees (end-users) |
|
1 |
33.33% |
2 |
16.67% |
3 |
16.67% |
4 |
0.00% |
5 |
33.33% |
C. Informatics |
|
1 |
16.67% |
2 |
0.00% |
3 |
50.00% |
4 |
33.33% |
5 |
0.00% |
D. Finance |
|
1 |
0.00% |
2 |
66.67% |
3 |
16.67% |
4 |
0.00% |
5 |
16.67% |
E. Statistical analysis and econometrics |
|
1 |
33.33% |
2 |
0.00% |
3 |
16.67% |
4 |
16.67% |
5 |
33.33% |
5. Discussion-Inferences
The results reinforce existing claims in the literature that risk management in the public sector hinges on leadership, organizational capacity, and institutional alignment. One of the most significant insights from this study is the persistence of a conceptual misinterpretation of risk management within Greek public administration. Respondents’ emphasis on procedural compliance, coupled with minimal recognition of risk as a tool for strategic value creation, reflects a mindset aligned more with audit and control than with proactive governance. This compliance-focused orientation contrasts with internationally recognized frameworks such as ISO 31000 (ISO, 2018) and the OECD’s ERM Implementation Toolkit (OECD, 2021), which advocate for embedding risk management into strategic planning, innovation, and performance measurement. In such frameworks, risk management is not merely a safeguard against negative outcomes but a structured process for identifying opportunities, optimizing resource allocation, and enhancing public value. By positioning risk management as a driver of resilience, adaptability, and service improvement, rather than solely as a mechanism to meet legal or procedural obligations, public organizations can move towards a more mature, value-creation-oriented risk culture.
The prominence of size and managerial experience as enablers suggests that institutional maturity and human capital play decisive roles in embedding risk practices in Greek public administration.
The stark insignificance of factors such as gender and age, while consistent with literature, challenges some traditional assumptions about demographic influences on strategic behavior. This might reflect the highly bureaucratic structure of the Greek public sector, where formal authority is more significant than individual characteristics.
Importantly, the identification of procedural and legal complexity as dominant barriers highlights the bureaucratic and fragmented nature of Greek public administration. This underscores the need for institutional simplification, cross-departmental collaboration, and a coherent risk governance strategy supported at the central level.
The confirmation that leadership, the “tone at the top”, determines not only the adoption but also the success of risk practices, contributes to a growing body of scholarship on public sector governance. In contexts like Greece, where public trust is fragile and institutional change is slow, leadership legitimacy and administrative capacity must be aligned to achieve meaningful risk governance reforms.
6. Conclusion
This study examined how senior public sector leaders in Greece perceive the determinants and constraints of risk management implementation. The empirical findings underscore the significance of organizational size and managerial experience as key enablers, while highlighting institutional complexity, cultural inertia, and legislative burden as critical barriers. Theoretically, the study advances our understanding of how leadership behavior and administrative structure jointly shape public risk governance. Practically, the findings reinforce the need for targeted leadership development, simplification of risk-related procedures, and the establishment of formal risk management units across public organizations.
The findings affirm that the tone at the top, the values, priorities, and direction set by senior executives, is foundational for embedding effective risk management practices in the public sector. Without leadership commitment, risk processes become perfunctory and disconnected from core strategic decision-making. For public stakeholders—ranging from ministry officials and auditors to policy designers—this means governance frameworks must include clear risk ownership, accountability metrics tied to executive performance, and annual disclosure of top risks. Greece’s example demonstrates how even legally mandated frameworks (e.g., ISO 31000 or Law 4795/2021) fail when they lack the anchoring of active leadership engagement.
Greece offers a revealing lens through which to study public risk governance. Its unique mix of fiscal supervision, administrative fragmentation, and externally driven reform pressures makes it a critical case for understanding challenges in institutionalizing risk culture. Despite extensive global literature on enterprise risk management, few studies have explored how senior leaders in Southern European or high-bureaucracy systems understand and implement risk practices. This study helps fill that void, offering grounded evidence from an EU member state under transformation, while delivering insights applicable to reforming or capacity-constrained administrations globally.
Future research should pursue comparative studies across EU states and longitudinal research within Greece to capture institutional change over time. As leadership continues to emerge as a pivotal force in public sector transformation, understanding how risk thinking becomes normalized across hierarchical levels remains a vital task for scholars, governments, and international organizations alike.
Acknowledgements
The author gratefully acknowledges the financial support provided by the University of West Attica, which made this research possible.