Managing Public Procurement Risks in Greece

2. Embedding public procurement in the risk management policy of entities

Abstract

The Risk Management Policy is reflected in a document that guides the entity in making decisions and taking actions related to the management of the risks to which it is exposed. The Policy outlines how risks will be managed, the purpose and objective pursued through risk management, roles and responsibilities, risk categories, risk appetite and level of risk tolerance.

For the operationalisation of the risk management policy, it would be particularly relevant to specify some elements related to high risks sectors such as public procurement. This chapter will then focus on how to embed public procurement elements in the risk management policy of public entities.

2.1. Mapping role and responsibilities relevant to public procurement for the development and implementation of the risk management framework

As mentioned in the standard risk management policy and framework, Risk management is not solely the responsibility of the employees participating in the risk management body. Rather, it requires the involvement of different stakeholders within the entity. From the head of the organisation, the senior management (Secretaries General, Directors General, etc.), the risk management body to the Directors and employees and the staff of the Internal Audit Units, all contribute to creating an environment in which effective risk management can thrive. For this reason, risk management requires a clear definition of the roles and responsibilities of staff at all levels.

Furthermore, the law on Internal Audit System and Internal Audit Units in Public Administration (Government of the Hellenic Republic, 2021[1]) strengthened the overall Public Internal Control Framework, which is of critical importance for the effective control of public procurement. This law details the structure of the Internal Audit System. Internal audit is one of the key areas of the three lines of assurance model and each line has its distinct responsibilities and roles, which are also reflected in the general risk management framework and policy. The Three Lines model serves as a comprehensive framework for managing risk and control within organizations. This model aims to address concerns related to the lack of structured approaches in many organizations, leading to gaps in risk management and unnecessary duplication of risk coverage. The model emphasizes the primary responsibility of staff and management in preventing and detecting risks (Institute of Internal Auditors, 2022[2]).

1) The first line, the heads of departments (units, directorates, etc.), in particular the head of the public procurement department but also the heads of other departments that are relevant for public procurement and the heads of the requiring areas (i.e. those who need the goods, services or public works to conduct their mission) play a crucial role in identifying and mitigating risks, as well as monitoring and evaluating control systems. The heads of the departments that are relevant for public procurement will depend on the entity’s activities and organization. The first line also includes all employees in these departments.

2) The second line encompasses bodies responsible for ensuring compliance with legality and managing risks, operating independently from the first line (including risk management bodies). This level oversees the overall monitoring and evaluation of control mechanisms implemented by the first line. This function is independent from the procuring unit and include assessments and reviews.

3) The third line consists of the Internal Audit Unit, which operates independently and provides the head of the entity with reasonable assurance and advice, while at the same time reporting to an audit committee to maintain a level of independence. This line focuses on assessing the adequacy and effectiveness of governance processes and risk management, including the Internal Control System. Ultimately, this line will assess and provide assurance over the effectiveness of the 1^st and 2^nd line functions.

Illustrated the figure below, the Three Lines Model in the context of the public procurement risk management framework can be used to inform responsibilities, structures, and allocation of resources. Although not mentioned in the three lines model, it is important to recall that all the employees across all departments are involved by committing to a strict adherence to risk management procedures, continuous identification of risks and their monitoring and implementation of control mechanisms when relevant within their specific areas of responsibility.

Figure 2.1. The three lines model

Note: This figure represents the three lines model adapted to the specific context of public procurement

Source: OECD

Below a table providing a summary of the role of each actor as outlined in the standard risk management policy and framework and a clarification of the roles in relation to public procurement risk management.

Table 2.1. Key actors in the implementation of the public procurement risk management framework

Stakeholders	Mentioned in the general risk management framework and policy	Roles and responsibilities as described in the general framework	Specific public procurement roles and responsibilities
Head of the Organization	Yes	Sets the risk appetite. Approves risk management policies Ensures the integration of risk management into daily operations. Establishes the foundation for a comprehensive risk management approach.	Endorses major procurement decisions, thus setting the tone for the organization’s procurement policies. Ensures the integration of risk management into public procurement.
Risk Management Body	Yes	Ensures the effective implementation of risk management practices. Recommends the Risk Management Policy Actively participates in the development, monitoring, and regular updating of the Risk Management Framework of the entity. Inform and instruct the staff of the entity on how to identify and address risks in the exercise of their responsibilities and the monitoring of control mechanisms. Supervise the risk management process carried out by all the organizational units of the organisation.	Ensures the effective implementation of the risk management process across all organizational department, including in public procurement. Collaborates with the procurement department and other departments playing a supportive role in public procurement processes in identifying and assessing risks and integrating risk mitigation strategies into the procurement process.
Internal Audit Unit	Yes	Acts as a crucial independent body, providing assurance on the adequacy and effectiveness of risk management. Evaluates the existing controls and the effectiveness of risk management processes throughout the organization. Ensures that risk management is functioning optimally as part of the Internal Control System.	The unit can conduct internal audits on public procurement processes, ensuring compliance with the national framework and the entity’s policies.
Head of the Public Procurement Department	No – proper to the PP risk management framework	Implement the Risk Management Policy and Framework and the relevant risk mitigation strategies. Integrates the risk management process into the daily activities. Identifies the risks threatening the achievement of the objectives of the department, their causes and effects, and the measures proposed to deal with them. Recommends to the highest hierarchical management body the risks identified that may affect the objectives and targets of the department. Provides ongoing support, training and awareness-raising of the staff so that they understand the organization’s Risk Management Policy and Framework, their role and responsibilities, and the risks related to their area of responsibility.	Ensures the implementation of the risk management framework in daily public procurement activities and processes. Identifies procurement-specific risks and relevant risk mitigation measures and strategies. Ensures a risk management culture within the department.
Other relevant heads of departments playing a role in PP (such as the head of the finance department and the head of the legal department, but this will depend on each entity’s internal organization)	Only mentions heads of departments	Implement the Risk Management Policy and Framework and the relevant risk mitigation strategies. Integrates the risk management process into the daily activities. Identifies the risks threatening the achievement of the objectives of the department, their causes and effects, and the measures proposed to deal with them. Recommends to the highest hierarchical management body the risks identified that may affect the objectives and targets of the department. Provides ongoing support, training, and awareness-raising of the staff so that they understand the organizations’ Risk Management Policy and Framework, their role and responsibilities, and the risks related to their area of responsibility.	For example, the head of the finance department, within the framework of his tasks, shall ensure the application of the fiscal management framework throughout the public procurement cycle. When an entity has a legal department, the head of this department may ensure that procurement processes is compliant with laws and regulations in place (on public procurement and beyond). Their role extends to contract review and approval, providing indispensable legal counsel, including on procurement matters.
Heads of requiring Departments	No – proper to the PP risk management framework		identifies procurement needs. The head of the public procurement department is responsible for identifying public procurement specific risks. can contribute to drafting technical specifications, and actively engage with the procurement department throughout the process. Ensure that the procurement aligns seamlessly with the organization's operational requirements.
Employees of the entity	Yes	play a vital role in implementing the risk management framework. Strict adherence to risk management procedures, continuous monitoring, and implementation of control mechanisms within their specific areas of responsibility. responsible for identifying potential risks inherent in their day-to-day tasks and ensuring compliance with risk mitigation measures. expected to actively participate in the risk management process by reporting any identified risks and failures of existing control systems promptly to their immediate superiors.	Contribute to the identification of potential public procurement risks and mitigation measures. Apply the entity’s risk management framework when doing activities related to public procurement.

Source: OECD and (The National Transparency Authority, 2024[3])

2.2. Understanding the concept of risk

"Risk", according to Article 3 of Law 4795/2021, is defined as "the possibility or threat of damage, loss or, in general, a negative consequence for the objectives of the body, which may be due to both intrinsic and extrinsic factors and which can be mitigated by preventive actions and control mechanisms". Objectives can have different aspects (such as financial, health and safety, gender inequality, or environmental) and can apply at different levels (such as strategic or project levels).

In a public procurement context, objectives can be linked i) to specific public procurement activities, or ii) to the role of public procurement in supporting the entity to achieve its mission (i.e. ensuring value for money, ensuring the delivery of the right items at the right time, etc.). Overall contracting authorities shall treat economic operators equally and without discrimination and shall act in a transparent manner, respecting the principles of proportionality, mutual recognition, the protection of the public interest, the protection of the rights of individuals, the freedom of competition and the protection of the environment1.

In general, risk management is facilitated if the objectives associated are expressed in measurable terms. In practice, however, public entities often have multiple general objectives. In order to set precise objectives for each stage of the procurement process, each objective must be:

• Specific: as precise as possible, avoiding generalization.

• Measurable: it must be precisely measurable.

• Ambitious: the objective must be achievable in the short to medium term to keep the whole team motivated, but it must also be ambitious.

• Realistic: it must be realistic, relevant, and not dependent on chance.

• Temporally defined: when we set an objective, we need to know when we want to achieve it.

As a first step, each entity is encouraged to set, at least one for each activity (OECD, 2020[4]). The table below shows, some examples of objectives linked to some of the public procurement activities.

Table 2.2. Objectives of the different activities in the public procurement process

Activity	Objective
Needs analysis	Identify real needs (quantity, specifications, etc.) in time and in the limit of the available funds. This means that the entity shall determine the timeframe in which needs should be identified and ensure that needs are realistic considering the respective estimated budget.
Market analysis	Conduct thorough analysis or studies in line with the actual market situation in a timely manner and considering all relevant potential suppliers (that depend on each market).
Choice of procedure	Achieve the best quality to price ratio in a timely manner and according to market conditions. In line with the public procurement framework, based on established criteria (such as procurement value),
Publication of call for tender	Ensure transparency and equal access to the process by publishing tender notices on relevant platforms and ensuring a minimum number of days for bid submission
Bid evaluation	Ensure an objective evaluation by the evaluation committee of all the submitted bids, in accordance with the selection and award criteria, as well as laws and regulation in place and within a specific timeframe after the bid submission deadline
Issuance and signing of the contract	Ensure transparency in the award of the contract and issue the contract promptly after bid evaluation for its signature. Notify the contractor and sign the contract prior to execution in a timely manner according to the law.
Monitoring of the contract	Manage and monitor the execution of the contract in accordance with contract requirements and within the deadlines set by the implementation plan
Ordering	Ensure that goods, services, and work are received on time and to the quality required by the contract.
Payment	Ensure that the supplier is paid for within the contractual deadlines and in accordance with contractual requirements.

Source: OECD adapted from (OECD, 2020[4])

In addition, risks can be conceptualised in terms of their component causes, events, and consequences (see Figure 2.2):

• Risk factors are characteristics of an organisation’s environment, policies, procedures, or activities that are associated with risk.

• A cause is a fact or occurrence which alone or in combination has the potential to create risk.

• An event is an occurrence or change in circumstances. Events are usually thought of as something unexpected but can also be something expected which does not happen.

• Consequences are the outcome of an event affecting objectives and can be certain or uncertain (OECD, 2023[5]).

Figure 2.2. Conceptualising risk

Source: OECD

Some key points to consider:

i) In some cases, the delineation between “risk factor” and “causes” can be challenging.

ii) “Risks” linked to the objectives of public procurement in supporting the entity in achieving its mission, can be considered “risk factors” in the context of specific public procurement activities. For instance, capability issues can be risks when considering overall objectives related to the role of the public procurement function in supporting the entity in achieving its mission. However, they can be risk factors or causes when considering specific public procurement activities, such as conducting adequate market analysis or needs assessment.

2.3. Risk categories and risk appetite vs tolerance

2.3.1. Risk categories

The risks faced by public entities can be categorised according to the nature of their characteristics. The categorisation of risks helps to:

a) create a structured approach to risk assessment, ensuring that key areas of risk in the entity are not overlooked;

b) better understand the nature and source of each risk, facilitating more effective risk assessment and management;

c) identify areas and functions where there is a high concentration of risk; and

d) design and implement targeted and appropriate risk response strategies for each category.

The standard risk management policy and framework foresees 8 categories of risks (see Figure 2.3), the public procurement risk management framework will focus on all of them.

It is worth mentioning that a specific risk may fall under different categories. The assessment of the root cause should help better identify the risk category. In line with the general risk management risk management policy and framework, all risks should be assigned only to one category except for risks that may be related to corruption and fraud.

Figure 2.3. Categories of risks foreseen in the standard risk management policy and framework

Source: Adapted from (The National Transparency Authority, 2024[3])

The following is a description of the different risk categories related to public procurement, as described in the general risk management policy and framework and put in the context of public procurement. A more comprehensive list of risks following the procurement cycle can be found in Annex A.

1) Operational risks:

Figure 2.4. Operational risks

 

Risks in public procurement	Example
	Stage	Task	Risks
Operational risks	Pre-tender stage	Needs assessment	Incomplete needs assessment due to lack of capacity or lack of needs assessment for different reasons
		Preparation of tender documents	Inappropriate procurement procedure that may lead to loss of resources or poor quality of service for the citizens
			Errors or omission in the tender documents due to lack of training high staff turnover rates leading to a loss of institutional knowledge
		Preparation of technical specifications	Lack of technical knowledge and expertise of procurement official in developing technical specifications leading to the use of technical specification that are obsolete or wrong.
	Tendering stage	Clarifications of tender documents	Lack of clarifications on the questions submitted
		Evaluation of tenders	Lack of public procurement technical knowledge of members of the tender evaluation committee
			Award criteria mentioned in tender documentation different from those used for the evaluation
	Post-tendering	Monitoring contract execution	Failure from the receiving committee to check properly the delivery of the procured items due to a lack of capacity
			Delays in the contract performance due to administrative burdens and lack of knowledge of the legal framework

2) Information technology risks:

Figure 2.5. Information technology risks

 

Risks in public procurement	Example
	Stage	Task	Risks
Information and technology risks	Pre-tender stage	Preparation of tender documents	Cyber-attacks to manipulate tender documents
	Tendering stage	Tender opening	Failure to upload a bid (due to technical capacity of the system)
	Post-tendering	Ordering	Delays in the ordering process of a central framework agreement due to the lack of a digital system

3) Fiscal risks:

Figure 2.6. Fiscal risks

 

Risks in public procurement	Example
	Stage	Task	Risks
Fiscal risks	Pre-tender stage	Procurement planning	Unrealistic budgeting due to inadequate market research
	Tendering stage	Tender opening	Low number or no bids received due to inadequate market research
		Evaluation of tenders	Low or no discount due to lack of competition
	Post-tendering	Ordering	Bankruptcy of the contractor

4) Legal/regulatory/compliance risks:

Figure 2.7. Legal/regulatory/compliance risks

 

Risks in public procurement	Example
	Stage	Task	Risks
Legal/regulatory/compliance risks	Pre-tender stage	Preparation of tender documents	Abuse of non-competitive procedure (use of direct award by splitting contracts or unjustified use of negotiated procedure without publication)
	Tendering stage	Evaluation of tenders	Subjective evaluation of tender due to the poor quality of the tender documents
			Award criteria mentioned in tender documentation different from those used for the evaluation
			Challenging evaluation of tender/award decision due to lack of documentation of the decision.
	Post-tendering	Modification of the contract	Unlawful modifications of the contract such as illegal increases of contract value and illegal contract duration extension

5) Risks of Corruption and Fraud:

Figure 2.8. Risks of Corruption and Fraud

 

Risks in public procurement	Example
	Stage	Task	Risks
Risk of fraud and corruption	Pre-tender stage	Needs analysis	Influence of external actors on the definition of the needs
		Procurement planning	Illegal artificial division of the needs to use non-competitive procedures
		Preparation of the technical specifications	Tailoring the technical specifications to a specific economic operator
	Tendering stage	Preparation and submission of bids	Bid rigging or collusion, e.g. through the submission of empty bids
		Tender opening	Disclosure confidential information by procurement officials
		Evaluation of tenders	Manipulation of bid evaluation to the advantage of a supplier
	Post-tendering	Monitoring contract performance	Risk of corruption by changing the terms of the contracts in favor of the contractor
		Modification of the contract	major amendments to the contract undermining the equitable treatment of bidders at the selection phase
		Invoicing-payment	Payment withholding

6) Strategic risks:

Figure 2.9. Strategic risks

 

Risks in public procurement	Example
	Stage	Task	Risks
Strategic risks	Pre-tender stage	Preparation of tender documents	Lack of sustainability criteria
	Tendering stage	Preparation and submission of bids	Cancellation of a tender procedure due to shift in priorities.
	Post-tendering	Ordering	The supplier does not meet environmental and social commitments

7) Health and safety risks

Figure 2.10. Health and safety risks

 

Risks in public procurement	Example
	Stage	Task	Risks
Health and safety risks	Pre-tender stage	Preparation of tender documents	Tender documents not addressing negative impacts on safety and health
	Tendering stage	Evaluation of tender	Subcontractors’ non-compliance with the procurement specifications on health and safety is not identified
	Post-tendering	Monitoring contract performance	Supplier’s non-compliance with health and safety commitments is not detected

8) Natural or non-natural disaster risks

Figure 2.11. Natural or non-natural disaster risks

 

Risks in public procurement	Example
	Stage	Task	Risks
Natural and non-natural risk disasters	Pre-tender stage	Planning	Budget affected due to increased costs for materials related to natural disasters
	Tendering stage	Preparation and submissions of bids	During the tender processes, bidders withdrew or revised their bids due to sudden financial difficulties, leading to a lack of competitive offers and increased uncertainty in awarding contracts.
	Post-tendering	Ordering	Contracts faced significant delays and cost overruns due to supply chain disruptions and labor shortages

2.3.2. Risk appetite vs tolerance

The general risk management policy and framework also defines the organisation’s risk appetite or tolerance. Risk appetite is defined as "the type and amount of risk an entity is willing to pursue or retain" to achieve its objectives. The risk appetite statement, which is approved by the head, expresses the extent to which an entity is prepared to assume the risks (the 'risk') arising from the achievement of its objectives, ensuring a balance between the benefits sought and the potential risk.

Risk tolerance represents the levels of risk taking acceptable to achieve a specific objective or manage a category of risk. It indicates a level of deviation from the risk appetite that an entity is willing to assume. Risk tolerance can therefore be defined as a specific and predetermined range of deviation from the risk appetite. The risk tolerance may relate to subcategories of risks or to individual risks, specific projects, individual objectives, initiatives, etc., to consider the specificities of each risk, project, or risk area. Setting an organisation’s risk appetite and tolerance is a key step in establishing an overall approach to risk. The risk appetite or risk tolerance is set at the entity level and does not depend on the areas considered such as public procurement. Section 3.3 on risk evaluation applies these concepts to a public procurement example.

2.4. Preliminary steps: Adapting the scope, criteria and context to public procurement

The diagram below illustrates the risk management process according to the ISO 31000 integrated standard. Before starting the risk assessment, a preliminary step requires to clearly determine the scope, context, and criteria for risk management. These elements can include public procurement elements or can be adapted to the public procurement area. The section below focuses on the scope, context, and criteria for managing public procurement risks.

Figure 2.12. The risk management process

Source: ISO 31000

2.4.1. Defining the scope within the public procurement area

In line with the general risk management framework and policy, the risk management framework should be applied to all procurement procedures and processes.

The entity may decide to focus on certain kinds of procedure type and threshold aligned with the entity's strategic objectives. This may evolve based on the risk environment and the evolution of the strategic objectives of the entity. This could include focusing on a combination of elements such as specific procurement procedure (negotiated procedure without prior publication, open tender, etc.), specific procurement categories that are strategic to achieve the entity’s objectives and role or procedures above specific thresholds.

2.4.2. Ensuring a good understanding of the public procurement context

Risk management requires understanding the internal and external context where the entity evolves. This step is pivotal as many risks can derive from contextual elements. Each entity should then clearly document its internal and external context. Depending on the relevance of public procurement activities, the definition of the context of each entity can include some public procurement elements.

Internal context

• Public procurement elements to consider for the internal context:

• Share of public procurement in the total budget of the entity

• Public procurement capacity (in number and in terms of capabilities)

• Organisation (i.e. existence of a public procurement department and its strategic positioning within the entity)

• Public procurement stakeholders within the entity

• Documented internal procedures for public procurement activities.

For instance, an entity has a yearly procurement budget of 2.5 million euros, which represents 75% of its budget. It has a public procurement department comprised of 20 employees with only 5 of them with a procurement background. Public works and studies are carried out by a technical department comprised of 12 employees. The public procurement department is within the Finance Directorate and had to collaborate with all departments within the entity as they all represent requiring areas.

The procurement process is documented (i.e. every step and activity involved in procuring goods, services, or works is recorded in detail, including the creation and maintenance of records related to the different phases of the procurement process) in the internal procedures of the entity and has been updated in 2022.

External context

• External environment:

  • Legal: Public procurement reforms

  • Economic trends impacting public procurement (inflation, etc)

  • Political: shift in public investment decisions, etc.

  • Events of force majeure

• External stakeholders in relation to public procurement (suppliers, European Commission, control bodies, etc.)

For instance, public procurement is regulated by Law 4412/2016 "Public Works, Procurement and Services" and has experienced a major reform with Law 4782/2021 “Modernization, simplification and reform of the regulatory framework of public contracts, special procurement arrangements in the defence and security sectors and other provisions for development, infrastructure and health” impacting the activities of the entity (e.g. higher threshold for direct award, simplification of procurement processes).

In terms of economic trends, the war in Ukraine and other external elements had a negative impact on prices as the inflation reached 4.2% in 2023 and may reach 2.7% in 20242., which could impact the prices offered by economic operators.

In terms of relevant external stakeholders, an example could be that the main procurement of the entity evolves in an oligopolistic market (very technical devices). In this context the main EOs are key stakeholders. External stakeholders could also include funders such as the European Commission.

Different tools can be used by entities to define their context (PESTEL, SWOT analysis, etc.) and there is no procurement specific tool.

2.4.3. Criteria

For the assessment and evaluation of risks, three criteria are recommended (see also Figure 2.13):

• the likelihood of occurrence or the probability of occurrence of a risk, designated by (L),

• the impact of a risk designated by (S).

• the level of risk designated by (C) where C = L x S.

• the efficiency of control or mitigation activities (Control is a measure that is put in place to prevent a risk from occurring, while mitigation can be seen as more corrective, to reduce the impact of a risk event).

• The likelihood and the impact criteria will enable public entities to measure the level of risk designated by (C) where C = L x S. This allows for an evaluation of the relative importance. For example, if the likelihood is 4 and the impact is 3, then the overall risk level is (4 x 3) = 12.

All these criteria are similar to those foreseen in the standard risk management policy of the organization (likelihood, impact, risk level and efficiency of control measures). However, to guide public procurement stakeholders in assessing risks this section provides:

• description of the risk impact in a public procurement context.

• examples of efficiency of control or mitigation measures in a public procurement context.

Figure 2.13. Risk criteria

Source: Author’s elaboration

Risk likelihood (or L)

It can be assessed based on different parameters, including the nature of the public entity's mission and the availability of historical data. It can be assessed by assigning a probability (e.g. 75% probability of occurring) or a frequency (e.g. more than 20 times). It is then mandatory to define the rating scale and to assign each rating a definition, specific risks can be given individual ratings. For instance, a rating of 5 could be defined to mean that the risk is very likely and may happen more than once a year. These parameters will depend on the context of each public entity and are not specific to public procurement. They will be defined in the risk management policy of the entity.

Table 2.3. Example of likelihood rating in a specific entity

Rating	Qualification	Based on an annual frequency
		Definition
5	Very likely	More than once a year
4	Likely	Once a year
3	Unlikely	Once every two years
2	Very unlikely	Once every five years
1	Not at all likely	Less than every five years

Note: This table represents an example. Specific entities should define the likelihood ratings based on their context.

The impact of a risk (S)

It provides an estimate of its consequences, which could include, among others, impacts on costs, time, quality, or reputation. The definition of impact is specific to each entity, as the same risk can result in consequences of varying impact from one public buyer to another, depending on its activities and role. After determining the rating scale (1 to 5), each rating should be assigned a specific definition.

To guide practitioners in estimating the impact of risks, the general risk management framework defines 6 impact areas:

• Operations/service provision,

• Reputation,

• Compliance with laws and regulations,

• Financial management,

• Health and safety,

• Environment/society.

These impact areas should not be confused with risk categories presented in section 2.2.

The table below recalls the impact rating mentioned in the general risk management framework and provides examples on how they can be translated in the public procurement area for each impact area. It will be particularly important to ensure that the impact rating decided at the entity level is well translated into high-risk areas such as public procurement.

Table 2.4. Example of impact rating in a specific entity

Impact	At the level of operations/service provision
Impact rating	Not important (1)	Limited (2)	Middle (3)	Important (4)	Critical (5)
Part of the general RM framework	Single partial shutdown of public service(s) for a few hours. Negligible impact on citizens. Minimal delays in the implementation of the entity’s target setting/ operational plan/ programmes of the entity.	Limited partial shutdown of public service(s) for one day. Little impact on citizens. Minor delays in the implementation of the entity’s target setting /operational plan/ programmes of the entity.	Regular partial shutdown of public service(s). Medium impact on citizens. Regular delays in the implementation of the entity’s target setting/ operational plan/ programmes of the entity.	Complete shutdown of public service(s). Significant impact on citizens for a short period of time (<7 days). Important delays in the implementation of the entity’s target setting/operational plan/programmes that may lead to significant changes in the entity’s strategic and operational plan.	Complete shutdown of public service(s). Significant impact on citizens for a long period of time (>7 days). Important delays in the implementation of the entity’s objectives /operational plan/ programmes of the entity that threaten the implementation of the entity’s strategic and operational objectives and may lead to irreversible situations.
How it can be translated to the public procurement framework	Single partial shutdown of the procurement department for a few hours or single partial shutdown of public service(s) for a few hours due to public procurement issues. Negligible impact on public procurement and on the delivery of public services to citizens. Minimal delays in the implementation of the entity’s public procurement plan, on the conduct of public procurement procedures and on contract implementation.	Limited partial shutdown of the procurement department for a few hours or single partial shutdown of public service(s) for one day due to public procurement issues. Limited impact on public procurement and on the delivery of public services to citizens. Minor delays in the implementation of the entity’s public procurement plan, on the conduct of public procurement procedures and on contract implementation.	Regular partial shutdown of the procurement department or regular partial shutdown of public service(s) due to public procurement issues. Medium impact on public procurement and on the delivery of public services to citizens. Regular delays in the implementation of the entity’s public procurement plan, on the conduct of public procurement procedures and on contract implementation.	Complete shutdown of the procurement department or complete shutdown of public service(s) due to public procurement issues. Significant impact on public procurement and on the delivery of public services to citizens for a short period of time (<7 months). Important delays in the implementation of the entity’s public procurement plan, on the conduct of public procurement procedures and on contract implementation which may lead to significant changes in the entity’s strategic and operational plan.	Complete shutdown of the procurement department or complete shutdown of public service(s) due to public procurement issues. Significant impact on public procurement and on the delivery of public services to citizens for a long period of time (>7 months). Important delays in the implementation of the entity’s public procurement plan, on the conduct of public procurement procedures and on contract implementation that threaten the implementation of the entity’s strategic and operational objectives and may lead to irreversible situations.
Impact	Reputation
Impact rating	Not important (1)	Limited (2)	Middle (3)	Important (4)	Critical (5)
Part of the general RM framework	Individual complaints of minor importance for which the body considers there is no need for an examination or evaluation. Minimal and transient loss of citizens/ private sector/ suppliers/ international organisations confidence.	An internal investigation (e.g. an administrative oath inspection) to prevent further escalation. Replacement/transfer of agency staff. Complaints against employees. Small loss of citizens/ private sector/ suppliers/ international organisations trust that can be recovered quickly.	Coverage by local media resulting in the external audit of the entity. Replacement/transfer of middle and lower management of the entity. Reduced citizens/ private sector/ suppliers/international organisations trust that can be regained over time.	Coverage by National media resulting in extensive public scrutiny Replacement/transfer of senior and top management of the entity. Complaints against the management of the entity. Severe loss of citizens/private sector/suppliers/international organisations trust.	Coverage by National media that causes public inquiry and outcry. Replacement of the head of the entity Significant reduction in State funding of the entity. Irreparable loss of citizens/private sector/suppliers/international organisations trust.
How it can be translated to the public procurement framework	Individual complaints related to public procurement of minor importance for which the body considers there is no need for an examination or evaluation. Minimal and transient loss of economic operators citizens/international organisations confidence due to a public procurement issue.	An internal investigation related to a public procurement issue is launched to prevent further escalation. Replacement/transfer of an employee involved in public procurement activities. Complaints against employee involved in public procurement activities. Public procurement issue leading to a small loss of economic operators / citizens/international organisations trust that can be recovered quickly.	Coverage by local media of a public procurement issue that may lead to an external audit of the entity. Replacement/transfer of middle and lower management of the entity involved in public procurement activities. Public procurement issue leading to reduced economic operators / citizens/international organisations trust that can be regained over time.	Coverage by National media of a public procurement issue resulting in extensive public scrutiny on the entity. Replacement/transfer of senior and top management of the entity due to a public procurement issue Complaints against the management of the entity due to a public procurement issue. Public procurement issue leading to a severe loss of economic operators/citizens//international organisations trust.	Coverage by National media of a public procurement issue that causes public inquiry and outcry. Replacement of the head of the entity due to a public procurement issue. Public procurement issue leading to an irreparable loss of economic operators/citizens/ international organisations’ trust. Significant reduction in State funding of the entity.
Impact	Compliance with laws and regulations
Impact rating	Not important (1)	Limited (2)	Middle (3)	Important (4)	Critical (5)
Part of the general RM framework	Infringement of standards/guidelines No legal action expected. Negligible economic impact.	Infringement of policy/Regulation. One-off claims or legal issues. Minor economic impact.	Serious infringement leading to an investigation Ongoing legal /judicial issues. Important economic impact.	Major infringement leading to fines Significant legal actions / prosecutions. Investigation by a supervisory body. Significant fines and imprisonment.	Repeated significant violations of laws and regulations. Penalties imposed / Sanctions. Repeated large fines.
How it can be translated to the public procurement framework	Procurement documents or actions that do not follow some guidelines and standards such as HSPPA’s templates, but that: do not lead to any legal action (litigation or challenge) do not have any economic impact. Legal issues raised by economic operators or other stakeholders (without engaging a legal action).	Infringement of public procurement regulations or guidelines (or related ones) leading to a legal action (litigation or challenge) with a minor economic impact3.	Serious infringement of public procurement regulations or guidelines (or related ones) leading to a legal action (litigation or challenge) with an important economic impact4.	Major infringement of public procurement regulations or guidelines (or related ones) leading to: a legal action (litigation, challenge)/prosecution with: a significant economic impact/ fines5 imprisonment of procurement actors (within the entity or the supplier). Launch of an investigation related to public procurement by a supervisory body.	Repeated major infringement of public procurement regulations or guidelines (or related ones) leading to: major penalties/ fines Sanctions significant economic impact/ fines6 imprisonment of procurement actors (within the entity or the supplier).
Impact	People health and safety
Impact rating	Not important (1)	Limited (2)	Middle (3)	Important (4)	Critical (5)
Part of the general RM framework	Incident without injury. Negligible impact on citizens/staff welfare/personal safety.	Minor injury. Minor impact on citizens/staff welfare/personal safety.	Significant injury. Short-term impact on citizens/staff welfare/personal safety.	Long-term disability. Continuous impact on citizens/well-being of personnel/personal safety.	Fatal accident. Long-term impact on citizens/staff welfare/personal safety.
How it can be translated to the public procurement framework	Incident without injury due to procured material or implementation of contracts (i.e. construction) with negligible impact on citizens/staff welfare/personal safety.	Minor injury due to procured material or implementation of contracts (i.e. construction) with minor impact on citizens/staff welfare/personal safety.	Significant injury due to procured material or implementation of contracts (i.e. construction) with short-term impact on citizens/staff welfare/personal safety.	Long-term disability due to procured material or implementation of contracts (i.e. construction) with continuous impact on citizens/well-being of personnel/personal safety.	Fatal accident due to procured material or implementation of contracts (i.e. construction) with long-term impact on citizens/staff welfare/personal safety.
Impact	Financial management
Impact rating	Not important (1)	Limited (2)	Middle (3)	Important (4)	Critical (5)
Part of the general RM framework	Negligible impact on the implementation of the entity’s budget.	Limited impact on the implementation of the entity’s budget (transfer of appropriations between Itemized Expense Accounts (ALEs).	Moderate impact on the implementation of the entity’s budget (negative deviation of less than 10% from the quarterly financial targets).	Significant impact on the implementation of the entity’s budget (negative deviation of more than 10% from the quarterly financial targets).	Serious impact on the implementation of the budget of the entity (cases of deviations excluded from the application of the provisions of article 172 of Law 4270/2014).
How it can be translated to the public procurement framework	Contract amendments with negligible impact on the implementation of the entity’s budget.	Contract amendments with limited impact on the implementation of the entity’s budget ((transfer of appropriations between Itemized Expense Accounts (ALEs)).	Contract amendments with a moderate impact on the implementation of the entity’s budget (negative deviation of less than 10% from the quarterly financial targets).	Contract amendments with a significant impact on the implementation of the entity’s budget (negative deviation of more than 10% from the quarterly financial targets).	Contract amendments with a serious impact on the implementation of the entity’s budget (negative deviation of more than 10% from the quarterly financial targets).
Impact	Environment/society
Impact rating	Not important (1)	Limited (2)	Middle (3)	Important (4)	Critical (5)
Part of the general RM framework	Minimal damage to single infrastructure/ properties. No permanent harmful impact on the environment. Minimal impact on the local community.	Minor and local damage to infrastructure/ properties. Short-term and limited adverse effects on the environment. Noticeable but manageable impact on the local community.	Significant, short-term losses in infrastructure/ properties. Long-term adverse effects on the environment. Serious but manageable impacts on the local community.	Severe, long-term damage to infrastructure and property. Extensive damage to the environment. Serious damage to the entire community.	Complete destruction of basic infrastructure. Broad and irreparable damage to the environment. Significant, permanent damage to the entire community.
How it can be translated to the public procurement framework	Minimal damage to single infrastructure/properties due to a public procurement issue: procured goods, services, or public works (damage other goods / infrastructure other goods / infrastructure lack of procurement of goods, services, and public works (delays in procurement, lack of needs assessment, etc.). No permanent harmful impact on the environment related to: the procured goods, services, and public works lack of procurement of goods, services and public works cured. Minimal impact on the local community related to the procured goods, services and public works cured lack of procurement of goods, services and public works cured.	Minor and local damage to infrastructure/properties due to a public procurement issue: procured goods, services, or public works damage other goods / infrastructure lack of procurement of goods, services, and public works. Short-term and limited adverse effects on the environment related to: the procured goods, services, and public works lack of procurement of goods, services and public works cured. Noticeable but manageable impact on the local community related to the procured goods, services and public works cured lack of procurement of goods, services and public works cured.	Significant, short-term losses in infrastructure/properties due to a public procurement issue: procured goods, services, or public works damage other goods / infrastructure lack of procurement of goods, services, and public works. Long-term adverse effects on the environment due to a public procurement issue: procured goods, services or public works lack of procurement of goods, services, and public works. Serious but manageable impacts on the local community related to the procured goods, services or public works cured lack of procurement of goods, services, and public works.	Severe, long-term damage to infrastructure and property due to a public procurement issue: procured goods, services, or public works damage other goods / infrastructure lack of procurement of goods, services, and public works. Extensive damage to the environment due to a public procurement issue: procured goods, services, or public works lack of procurement of goods, services, and public works. . Serious damage to the entire community elated to procured goods, services, or public works lack of procurement of goods, services, and public works.	Complete destruction of basic infrastructure due to a public procurement issue: procured goods, services, or public works damage other goods / infrastructure lack of procurement of goods, services, and public works. Broad and irreparable damage to the environment due to a public procurement issue: procured goods, services, or public works lack of procurement of goods, services, and public works. Significant, permanent damage to the entire community related to procured goods, services, or public works lack of procurement of goods, services, and public works.

Source: OECD and (The National Transparency Authority, 2024[3])

In addition, each contracting authority will need to use a rating of the efficiency of control/mitigation activities.

Table 2.5. Example of an assessment of efficiency of control/ mitigation measures

Grading the effectiveness of control/ mitigation activities	Reduction of the level of risk	Description/criteria	Public procurement examples
Fully effective	75-100% reduction	No action is required other than to review and monitor existing control measures. Control measures are well designed and address the root causes of the risks. Management believes they are effective and reliable.	Risk: procurement of items not corresponding to the needs of the final users
			Mitigation measure: Validation of the needs assessment by the final users
Quite effective	50-75% reduction	Most control measures are well designed, implemented and effective. Some work is still needed to improve their effective functioning. Management has some doubts about their effective operation and reliability.	Risk: Disclosure of confidential information to specific economic operators during the PP procedure by procurement officials.
			Mitigation measure: Monitor access to the PP data and documents by providing single usernames and passwords for each of the personnel that has access to them and block any third person’s access.
Partially effective	25- 50% reduction	While the design of the control measures may be largely sound, since they address most of the root causes of risk, they are currently not very effective. or Some of the control measures do not appear to be well designed, as they do not address the root causes of the risks. Those that are properly designed are working effectively.	Risk: Drafting public procurement documents that do not comply with the PPL
			Mitigation measure: Mandate the use of HSPPA PP templates
Largely ineffective	10-25% reduction	Significant gaps in the control measures. Either the control measures do not address the root causes of the risks, or they are not working effectively at all.	Risk: Receive deliverables different from what was foreseen in the contract
			Mitigation measure: Nominate members of the receiving committee that have the capacity to properly check the delivery of the procured items.
Absence of safeguards or completely ineffective	0-10% reduction	Almost no reliable control measures. Management has no confidence that any degree of control is being achieved, due to poor design of the control measures or very limited operational effectiveness.	Risk: Repetitive procurement procedures with no outcome because the specifications requested are not available in the market.
			Mitigation measure: Conduct a market analysis before preparing the procurement documents.

References

[1] Government of the Hellenic Republic (2021), Law 4795/2021 “Internal Audit System and Internal Audit Units in Public Administration”.

[2] Institute of Internal Auditors (2022), Applying the Three Lines Model in the Public Sector.

[5] OECD (2023), “Managing risks in the public procurement of goods, services and infrastructure”, OECD Public Governance Policy Papers, No. 33, OECD Publishing, Paris, https://doi.org/10.1787/45667d2f-en.

[4] OECD (2020), Guide de management des risques dans les marchés publics en Tunisie.

[3] The National Transparency Authority (2024), Model Policy and Framework for Risk Management.

Notes

← 1.  Article 18 of Law 4412/2016

← 2.  https://economy-finance.ec.europa.eu/economic-surveillance-eu-economies/greece/economic-forecast-greece_en

← 3.  Minor economic impact should be defined by the risk management body.

← 4.  Important economic impact should be defined by the risk management body.

← 5.  Significant economic impact should be defined by the risk management body.

← 6.  Significant economic impact should be defined by the risk management body.