Risk management has become an increasingly salient component of modern public governance, particularly following financial crises, health emergencies, and geopolitical uncertainty. Public organizations are being called upon to anticipate, mitigate, and manage complex risks while maintaining service delivery and fiscal prudence. However, public sector adoption of risk-oriented frameworks remains uneven, especially in states characterized by bureaucratic inertia or rigid legal-administrative traditions.

Over the past two decades, a significant number of OECD member countries have institutionalized comprehensive risk management frameworks within their public financial management systems. Notably, countries such as Australia, New Zealand, the United Kingdom, and Netherlands have enacted legislation mandating the disclosure and strategic management of fiscal risks by their Ministries of Finance. These frameworks often include the establishment of Independent Fiscal Institutions (IFIs) tasked with overseeing fiscal policy and ensuring transparency. The proliferation of such practices underscores a global trend towards enhancing fiscal resilience and accountability in the public sector.

Greece presents a compelling case within this context due to its recent efforts to modernize its public financial management amid economic challenges. The establishment of the Independent Authority for Public Revenue (IAPR) and the implementation of laws such as Law 4795/2021 and Law 5013/2023 signify steps towards aligning with OECD best practices. However, the unique administrative culture and historical fiscal issues in Greece pose distinct challenges to the effective institutionalization of risk management. Law 4795/2021 introduced a structured framework for internal control systems in public sector entities, making risk assessment and management a mandatory component of administrative processes. Law 5013/2023 further advanced this agenda by embedding risk management into the broader public financial management system, explicitly linking it to strategic planning, transparency obligations, and compliance monitoring.

This study’s findings offer valuable insights for practitioners and stakeholders by highlighting the practical implications of adopting risk management frameworks in a complex governance environment. Furthermore, Greece’s experience serves as a pertinent example for other OECD countries navigating similar reforms, emphasizing the importance of contextual factors in the successful implementation of risk management practices.

This paper investigates risk management diffusion in the Greek public sector, offering empirical evidence from a broad-based national survey. This study makes three key contributions. First, it extends the literature on public risk governance by providing rare empirical evidence from a Southern European, post-crisis state—a context underrepresented in international comparative research. Second, it captures the perceptions of civil servants across levels of authority, educational backgrounds, and institutional types, enabling a nuanced understanding of organizational readiness and resistance. Third, it delivers actionable insights for policymakers, international organizations (e.g., OECD, IMF), and reform leaders seeking to foster administrative capacity for risk management in complex bureaucracies. The innovation of this study lies in its ability to document a live institutional transformation—where risk governance is not yet fully embedded, but actively evolving—offering a forward-looking view of reform processes in practice. Greece, in this sense, becomes both a critical case and a mirror for other OECD states navigating the tension between policy ambition and administrative reality.

Risk management in the public domain has received growing scholarly attention, reflecting its relevance to strategic control and organizational resilience ( Power, 2007 ; Bhimani, 2009 ). Governments increasingly embed risk discourse in legislative, financial, and administrative functions ( Black, 2005 ; Boin & Lodge, 2016 ), with higher education providing an early example of how risk-based regulation was institutionalized within public organizations ( Huber, 2009 ). Nevertheless, scholarship highlights a persistent gap between formal frameworks and substantive practices ( Kolisovas & Andrius, 2011 ; Palermo, 2014 ). Empirical work often focuses on Anglo-Saxon or Nordic systems, while Mediterranean contexts remain underexplored ( Ahmeti & Vladi, 2017 ; Bracci et al., 2022 ). Evidence from Central and Eastern Europe also highlights case-based challenges in embedding risk management practices within public entities ( Kapuscinska & Matejun, 2014 ). In Greece, recent reforms (e.g., Law 4795/2021; Law 5013/2023) have attempted to centralize and formalize risk responsibilities, but implementation challenges persist. Our study situates itself in this empirical lacuna.

To contextualize these developments analytically, this study draws from internationally recognized risk management frameworks, ISO 31000 and COSO Enterprise Risk Management (ERM), which provide structured, principles-based approaches to managing uncertainty and enhancing decision-making ( ISO, 2018 ). ISO 31000 emphasizes integration, accountability, and continual improvement across all levels of an organization, aligning risk practices with governance ( Andersen, 2016 ), strategy, and performance ( Lark, 2015 ). COSO ERM ( COSO, 2017 ), in turn, promotes a holistic, integrated approach to risk that aligns with internal control systems and emphasizes value creation, strategic objectives, and organizational culture. Academic reviews, however, caution that despite its promise, ERM research reveals both conceptual fragmentation and unresolved tensions ( Bromiley et al., 2015 ). These frameworks offer conceptual tools for distinguishing between formal, compliance-driven risk routines and embedded, governance-oriented practices. Recent contributions also underline the need to integrate risk management into broader management control systems, offering practical lessons for public sector managers ( Rana, Wickramasinghe, & Bracci, 2019 ). Similar integrative approaches have been noted in private-sector contexts such as supply chain management, where ERM has been reviewed as a means of managing interdependent risks ( Olson & Dash Wu, 2010 ). As such, they serve as useful lenses for interpreting the maturity, fragmentation, and institutionalization patterns identified in our empirical findings.

Despite the growing international focus on public sector risk management, the academic literature remains disproportionately centered on Anglo-Saxon and Northern European administrative contexts, where governance structures tend to be more performance-oriented and technocratically driven. Even within Nordic countries, adoption at the local government level has been uneven and shaped by contextual administrative traditions ( Oulasvirta & Anttiroiko, 2017 ). Empirical studies examining how risk management is interpreted, implemented, or resisted within Southern European or post-crisis settings are rare. Evidence from continental Europe shows that even in well-resourced administrations, risk analysis methods face significant implementation barriers ( Rocher, 2011 ). In particular, Greece remains critically under-researched. Existing studies largely focus on fiscal oversight or broader administrative reform, while overlooking the institutional, cultural, and organizational dynamics that influence risk management uptake within the state apparatus. There is a notable absence of empirical work capturing how public officials, across ministries, agencies, and revenue authorities, perceive and engage with risk-oriented practices.

This study addresses that gap by providing one of the first comprehensive, data-driven examinations of risk management institutionalization within the Greek public sector. By anchoring its analysis in ISO 31000 and COSO ERM ( COSO, 2017 ), it contributes original insights into national policy debates and enables cross-jurisdictional comparisons relevant to the broader field of comparative public administration and risk governance.

This study draws conceptually from institutional theory and the literature on risk society ( Beck, 1992 ). Public organizations do not adopt innovations solely due to efficiency pressures, but also in response to institutional isomorphism, legitimacy concerns, and policy diffusion ( DiMaggio & Powell, 1983 ; Power, 2007 ). Contingency-based perspectives further highlight that the design and operation of risk management systems are highly dependent on organizational and contextual factors ( Woods, 2009 ). Risk logics in late modernity further emphasize reputational concerns as a driving force behind organizational adoption of governance frameworks ( Power et al., 2009 ). Beck ’s (1992) notion of the “risk society” is particularly relevant to post-crisis Greece, where the accumulation of fiscal, social, and institutional vulnerabilities has heightened the salience of anticipatory governance. In this context, risk management becomes not merely a technical or compliance exercise, but a strategic response to the pervasive uncertainties and systemic risks characteristic of a society emerging from prolonged economic and administrative upheaval.

Greece offers a critical and revealing case in the study of public sector risk governance, particularly in the aftermath of a prolonged period of fiscal austerity, externally imposed reform, and administrative restructuring. As a member of both the European Union and the OECD (2005, 2014) , Greece has been subject to multilayered compliance demands, including stringent oversight by international creditors and the adoption of standardized governance frameworks. These external pressures, combined with internal demands for modernization, have catalyzed a unique reform trajectory, one that attempts to reconcile inherited legalistic, hierarchical public administration structures with contemporary expectations for strategic planning, transparency, and accountability. Yet, as prior scholarship reminds us, risk management frameworks are themselves fraught with uncertainty and ambiguity in their application ( Vinnari & Skærbæk, 2014 ). The Hellenic Independent Authority for Public Revenue (AADE), established to insulate tax collection from political interference, has played a pivotal role in operationalizing these reforms. Alongside AADE, several ministries, particularly the Ministry of Finance, have begun to adopt risk management language and tools as part of broader efforts to build fiscal resilience and administrative coherence. Yet, the tension between institutional innovation and deeply rooted administrative norms presents ongoing challenges, making Greece a vital case for understanding the contingent nature of public sector transformation under constraint.

We administered a structured questionnaire to 378 civil servants across various ministries, agencies, and public entities in Greece. The sample was stratified by gender, seniority, level of education, and institutional type. The survey assessed perceived maturity in risk procedures, existence of formal frameworks, organizational effectiveness, and training exposure. The analysis is primarily descriptive but offers granular insights into intra-organizational variation and interpretive patterns. Despite its limitations, this approach is appropriate for exploratory inquiries in under-researched administrative contexts.

The survey instrument consisted of a structured questionnaire with predominantly closed-ended questions designed to capture respondents’ perceptions and experiences. Most attitudinal and evaluative items employed 5-point Likert-type scales (ranging from “not at all” to “to a great extent” or from “insufficient” to “very high”), allowing for the quantification of subjective assessments across key domains such as strategic, operational, financial, environmental, and reputational risk management. Demographic and organizational profile questions were also included to enable cross-tabulation and comparative analysis.

To capture domestic experience, a field survey was conducted (questionnaire design, completion, processing, and evaluation of findings). Initially, the sample characteristics are illustrated through Simple Distribution Analysis. Subsequently, gender and the extent to which the organization uses Risk Management procedures will be examined in conjunction with other variables.

The survey sample (n = 378) reflects the demographic and structural composition of Greece’s public sector. Women (63%) outnumber men, reflecting national employment trends where men prefer freelance professions offering higher but riskier returns. The demographic and organizational characteristics of the survey respondents are presented in Tables 1-11 .

Most respondents are aged 41 - 50, with one-third having over 20 years of service, consistent with hiring freezes during the memorandum period. While 44% have spent under five years in their current organization, mobility across entities appears more common than often assumed. Educational attainment is high: nearly seven in ten hold postgraduate degrees, including 7% with doctorates, and 7.4% are graduates of the National School of Public Administration (ESDDA). Organizationally, over half work in ministries, with most employed in entities exceeding 500 staff, and nearly one-third occupy supervisory or directorial roles. These characteristics position respondents to provide informed assessments of their organizations’ risk practices.

Table 1. The gender of the respondents.

Table 2. The ages of the respondents.

Table 3. Period of employment in the institution.

Table 4. Employment time in the service you are in.

Table 5. Previous management experience.

Table 6. Level of study.

Table 7. Studies at the ECHR.

Table 8. Attending seminars or lectures on management.

Table 9. In which category of employment institution is he employed?

Table 10. Position of responsibility.

Table 11. Number of employees in the institution.

Findings highlight a gradual but uneven institutionalization of risk management practices across the Greek public sector. Fewer than half of the respondents report the existence of a formal risk management program, although awareness and procedural uptake are growing. Approximately 25% of participants rate risk procedures as highly embedded, while 38% consider them moderately developed. Notably, financial risk management emerges as the most advanced area, largely attributed to compliance-driven pressures, such as regulatory and audit requirements. In contrast, strategic and environmental risk management remains underdeveloped, indicating a gap in the governance-oriented approach, which emphasizes anticipatory, integrated, and leadership-led risk thinking.

This distinction between compliance-based risk management (focused on adhering to rules and controls) and governance-based risk management (focused on strategic foresight and institutional resilience) is essential for interpreting the findings. Empirical evidence from Northern Europe further illustrates how vernacular practices interact with formal systems, shaping the effectiveness of risk governance in public organizations ( Carlsson-Wall et al., 2019 ).

Tables 12-23 present respondents’ evaluations of how risk factors are considered, the extent to which organizational objectives are achieved, and the perceived effectiveness of programming, overall performance, and specific domains of risk management, including strategic, financial, environmental, operational, and reputational dimensions. While over 70% of respondents noted some improvement, these advances appear incremental and largely procedural. As such, the broader institutionalization of risk management, as a core element of governance and decision-making, remains incomplete.

Table 13. Degree of achievement of objectives.

Table 14. Evaluation of the organization at the programming level.

Table 15. Evaluation of an organization at the level of effectiveness.

Table 16. Does the agency have an official risk management program.

Table 17. Degree to which the operator uses risk management procedures.

Table 18. Degree of development or improvement of management processes.

Table 19. Management assessment at the strategic risk level.

Table 20. Management assessment at the level of financial risk.

Table 21. Management assessment at the level of environmental risk.

Table 22. Management assessment at the operational risk level.

Table 23. Management assessment at the level of reputational risk.

Cross-tab analyses provide deeper insights into how risk management is perceived across different demographics and organizational contexts. Tables 24-39 report cross-tabulation analyses, illustrating how perceptions and use of risk management procedures vary across demographic characteristics, professional experience, education, training, organizational type, managerial responsibility, and institutional size.

Table 25. To what extent does your employer use risk management procedures? * What is the length of time you have been employed in a Public Institution? * What is your gender?

Table 26. To what extent does your employer use risk management procedures? * What is the length of time you are employed in the service/organization/business you are currently in? * What is your gender?

Table 27. To what extent does your employer use risk management procedures? * Have you had previous experience in a public or private body on issues related to risk management? If so, how many years? * What is your gender?

Table 28. To what extent does your employer use risk management procedures? * What is your level of study? * What is your gender?

Table 29. To what extent does your employer use risk management procedures? * You are a graduate of the E.S.D.D.DA * What is your gender?

Table 30. To what extent does your employer use risk management procedures? * Have you attended seminars (or lectures) on risk management? * What is your gender?

Table 31. To what extent does your employer use risk management procedures? * In which category of public sector do you employ? * What is your gender?

Table 32. To what extent does your employer use risk management procedures? * Do you have a position of responsibility? * What is your gender?

Table 33. To what extent does your employer use risk management procedures? * How many people work in your Employment Organization? * What is your gender?

Table 34. To what extent do you think risk management processes are currently being developed or improved in your employment organisation? * What is the length of time you have been employed in a public institution? * What is your gender?

Table 35. To what extent do you think risk management processes are currently being developed or improved in your employment organisation? * What is the length of time you are employed in the service/organization/business you are currently in? * What is your gender?

Table 36. To what extent do you think risk management processes are currently being developed or improved in your employment organisation? * Have you had previous experience in a public or private body on issues related to risk management? If so, how many years? * What is your gender?

Table 37. To what extent do you think risk management processes are currently being developed or improved in your employment organisation? * In which category of public sector do you employ? * What is your gender?

Table 38. To what extent do you think risk management processes are currently being developed or improved in your employment organisation? * Do you have a position of responsibility? * What is your gender?

Gendered and experiential patterns emerge: men with over 20 years of service and women in mid-level management report higher satisfaction with procedural improvements. For example, cross-tabulation results indicate that among respondents with more than 20 years of public sector experience, 40% of men rated the use of risk management procedures as “very large” compared to only 22% of women in the same tenure group. Conversely, women in supervisory roles reported higher scores for perceived procedural improvement than their male counterparts, suggesting that professional role and career stage intersect with gender in shaping attitudes toward risk governance.

Table 39. To what extent do you think risk management processes are currently being developed or improved in your employment organisation? * How many people work in your Employment Organization? * What is your gender?

Education and training also influence perceptions, with postgraduate degree holders and National School of Public Administration graduates more likely to recognize advancements in risk-related practices. Seminar attendance correlates with more positive evaluations of institutional procedures, while organizational size and role level affect how respondents rate risk management use and progress. These relational findings underscore that the adoption of risk management is shaped not only by organizational structures but also by the professional and educational profiles of public servants. Prior research similarly highlights how perceptions of uncertainty and reliance on external consultants can significantly influence organizational risk management outcomes ( Subramaniam et al., 2011 ).

The empirical data presented in this study reveal both the challenges and emerging potential in institutionalizing risk management within the Greek public sector. While formal adoption remains fragmented and uneven across institutions, there is a discernible trend toward growing awareness and moderate integration of risk-related practices among civil servants. Respondents’ evaluations, particularly across strategic, operational, and financial domains, suggest that although formal frameworks are still at an early stage, procedural development is gaining traction.

Crucially, progress appears more advanced in areas subject to stronger regulatory oversight, such as financial risk management. This highlights a pattern of compliance-driven implementation, where external mandates, rather than internal governance priorities, serve as the primary catalyst. In contrast, domains requiring anticipatory planning and strategic coordination (e.g., strategic and operational risks) remain comparatively underdeveloped. This indicates a gap in the governance-oriented dimension of risk management, which involves embedding risk awareness into institutional culture, leadership behaviour, and long-term planning processes.

Factors such as years of service, educational background, and organizational size influence perceptions of maturity and effectiveness, underscoring the importance of targeted training and leadership engagement. Overall, the findings suggest that risk governance in Greece is not yet embedded as a cultural or strategic norm, but is instead evolving under external and procedural pressures. Bridging this gap will require sustained institutional support, capacity building, and a shift from rule-based compliance to holistic, leadership-led risk governance aligned with public administration reform.

This study offers a systematic, data-driven analysis of how risk management is emerging within Greece’s public sector, with a focus on the perceptions, experiences, and institutional positioning of civil servants across ministries and agencies. We undertook this research to address a critical gap in the literature regarding the early-stage institutionalization of risk frameworks in Southern European contexts, where governance reform is often externally motivated but domestically implemented. Greece is especially significant in this regard: it has been both a laboratory and a stress test for public sector transformation under extreme fiscal and administrative pressure.

The findings hold practical implications for a wide range of stakeholders. For policymakers and public managers, the study provides diagnostic insight into the level of readiness, cultural resistance, and training needs that influence the success of risk governance initiatives. For international bodies such as the OECD (2005, 2014) , IMF (2023) and EU institutions, the Greek case offers a real-time assessment of reform traction in a member state undergoing recovery and modernization. Most importantly, the study informs stakeholders within the Greek administration, particularly those in leadership roles, about where targeted interventions, capacity-building efforts, and communication strategies could enhance the legitimacy and functionality of risk-based management systems. In this way, the study not only contributes to academic knowledge, but also serves as a practical resource for guiding implementation and institutional design.

The author gratefully acknowledges the financial support provided by the University of West Attica, which made this research possible.