“…The formalization of risk management systems can be identified: through the introduction of dedicated risk experts such as internal auditors, chief risk officers and/or risk managers, and through the introduction of formal risk management tools, such as heat maps (Arena et al, 2010;Hall, Mikes, & Millo, 2015;Mikes, 2009Mikes, , 2011Palermo, 2014;Rocher, 2011;Vinnari & Skaerbaek, 2014, Woods, 2009. Previous research has reported on the implementation of formal risk management systems identifying a top-down design and roll out of risk management in public sector organizations (Palermo, 2014;Rocher, 2011;Vinnari & Skaerbaek, 2014;Woods, 2009).…”