Since 2021, every Greek public sector entity has been legally required to establish an internal audit unit. Five years on, the latest report by the Hellenic Court of Audit, Greece’s supreme financial court and supreme audit institution, documents a persistent and widespread accountability gap.
The figures are stark. Some 81% of public entities still lack a fully operational internal control system. Only 19% meet the basic criteria. Across the board, 90% of public entities outsourced their internal audit function to private firms, and of the 8.9 million euros spent on those contracts, 85% was awarded without a competitive tender process.
Units that exist only on paper
Of the entities that have technically established an internal audit unit, 32% have no staff. The unit appears on the organizational chart but no one works in it. In public law legal entities, half of all audit units are unstaffed. In municipalities, the figure reaches 43%.
Where staff do exist, they are leaving. In 2025 alone, 70 of the 260 employees serving in these units were transferred out, nearly one in four, most by administrative decision and without adequate justification.
Procedures mapped, but not followed
For an internal audit system to function, an entity must first have documented its own operations: who approves expenditures, how procurement works, who is accountable for what. Some 68% of entities have documented fewer than half of their own procedures. Only 9.4% have completed a full mapping. Central government bodies record the worst performance. Universities and hospitals perform best.
Of the entities that have documented at least some procedures, 43% cannot confirm whether those procedures are actually followed. The Court identifies the reason directly: many organizations copied template texts from generic models or other entities without adapting them to their own operations.
Some signs of improvement
The report is not without some more encouraging findings. The share of entities compiling internal audit reports and submitting them to the relevant authorities has risen from 20% in 2024 to 50% in 2025. The share that had taken no steps toward compliance at all fell from 53.8% to 41% over the same period. Hospitals, regional authorities and universities record the strongest overall performance.
Some 90% of public entities outsourced their internal audit function to private firms. Of the 8.9 million euros spent on those contracts, 85%, approximately 7.6 million euros, was awarded without a competitive tender process. The top eight contractors captured 65.5% of all contracts by both number and value, taking on work across the entire country.
The quality of that work also draws scrutiny from the Court. Of the 152 audit reports produced by external contractors, not one contained a negative opinion on the overall adequacy of an entity’s internal control system. The Court notes that this includes cases where no procedure mapping existed and no fiscal officer had been designated.
No one checking the checkers
Three quarters of public entities assign the task of receiving and evaluating contractor deliverables to staff outside their internal audit unit. In more than 90% of those cases, none of the staff involved holds a certified internal auditor qualification. The Court concludes that this raises legitimate questions about whether public entities are equipped to monitor contractor work or assess whether deliverables meet an acceptable standard.
The Court’s overall assessment is that the picture “remains discouraging, creating significant operational and fiscal risks.”
Source: in.gr
