Applying Ten Governance and Accounting Principles to Fraud Risk in Tourism: Selected International Evidence and the Greek Case

Abstract

Tourism ranks among the world’s most economically significant sectors, yet fraud, tax evasion and undeclared work are, in many service-dominated and SME-heavy tourism economies, recurring structural features rather than isolated anomalies. Governance and fraud research, however, has developed largely around large, listed firms, and no prior work maps a consolidated set of governance, accounting and fraud principles onto tourism. This essay addresses that gap by applying the ten governance, accounting and fraud principles of Hermanson et al. to tourism at two levels—global tourism and the Greek case. Methodologically, it is a conceptual, contextual analysis drawing on secondary evidence rather than primary data. The selected evidence indicates that the ten principles are analytically relevant at both levels, and the Greek case shows them interacting most intensely where enforcement, financial pressure and pay informality coincide: a same-scope VAT gap of roughly EUR 1.8–2.4 billion in accommodation and catering (with a wider EUR 3.2 billion receipts-versus-declarations gap reported only as an indicative cross-check), roughly 28% undeclared employment in accommodation and catering, and voluntary disclosure uptake below 2%. The findings are directly relevant to forensic accountants, auditors, tourism regulators and policymakers, and connect governance failure to SDG 8 (decent work) and SDG 16 (strong institutions and curbing illicit financial flows).

1. Introduction

The study of governance failures is rarely as urgent as in the field of tourism. We are talking about an activity with a disproportionate economic footprint: [1] measurements place its contribution at close to one tenth of global GDP, a percentage that is also reproduced in employment figures. However, research on production around corporate governance, fraud detection, and financial accountability has historically relied on other subjects (heavy industry, the banking sector, and listed companies) with the result that tourism remains on the margins of empirical investigation. And yet, the terms of governance are changing drastically here. The landscape is made up, in terms of the number of units, of very small businesses; part of the turnover escapes tax supervision; and work is characterized by intense seasonality, constant staff turnover, and, as a rule, a significant percentage of undeclared employment. On top of this, the institutionalized compliance frameworks consistently deviate from what actually happens in everyday life. This opens a gap, familiar to people in the industry, but intractable for supervisory authorities.

Since the formulation of the “fraud triangle” by [2], forensic accounting has expanded rapidly, but without its empirical foundation escaping narrow limits. What we know about the functioning of audit committees, the composition of boards of directors, the adequacy of internal controls, or earnings management practices comes, for the most part, from manufacturing units and financial institutions; entities, that is, bound by the strict disclosure regime imposed by the Securities and Exchange Commission (SEC) and similar regulators [3]. In the hospitality sector, notable steps have been taken: the systematic review of fraud risks by [4] and the study by [5] on the governance–performance linkage in hotel chains. None of these projects, however, attempts to apply a coherent “governance–fraud” framework to the entire tourism sector, let alone apply it in the Greek context.

This deficit does not go unnoticed, and the following paper aims to remedy it by examining the applicability of the framework proposed in [6] to tourism. The researchers codify ten fundamental principles (governance, accounting, and fraud) distilled from a century of practice in forensic accounting, auditing, and research. The authors’ choice to keep the framework accessible and readable is not accidental; their aim was to go beyond the narrow confines of academic amphitheaters and make it a useful tool in the hands of economic advisors, regulators, and managers who manage governance crises in real time. In this light, examining the model through the Greek example offers a unique analytical advantage, as it brings together in a single jurisdiction institutional weaknesses that are usually found scattered internationally. The gap this essay addresses is specific: forensic accounting and governance research has developed largely around large, listed firms in manufacturing and finance, and hospitality studies rarely apply a unified governance–fraud framework across the whole sector; no prior work maps a consolidated set of governance, accounting, and fraud principles onto tourism at both the global and a high-intensity national level.

The macroeconomic scale is decisive here. With tourism generating 25–30% of national GDP (measured as tourism’s total contribution—direct, indirect, and induced—rather than direct value added), Greece exhibits a degree of sectoral dependence that is unique within the OECD [7,8]. When dependence is so high, a local failure in corporate governance does not remain within the boundaries of the company; it quickly escalates into a systemic, macroeconomic risk. On top of this structural dependence stands a deeply rooted shadow economy. Decades of familiarity with shadow markets, which the austerity of 2010–2018 intensified, imposed harsh adjustments: for many SMEs, income concealment ceased to be a moral deviation and became a basic survival strategy. Thus, two of the vertices of Cressey’s triangle, pressure and rationalization, were normalized and became integrated into daily operations. Against this backdrop, the mandatory implementation of myDATA by the AADE has reshaped the information environment of businesses through the real-time digital transmission of documents. Its staggered implementation also provides a potentially valuable setting for future empirical research on mandatory digital reporting and compliance. If we add the acute operational problems generated by overtourism in destinations such as Santorini or Mykonos, the picture is complete. Greece functions less as a convenient case study and more as a high-intensity field, where the theoretical dynamics described by [6] are encountered under real conditions.

The analysis runs through each of the ten principles following the same trajectory: from the theoretical proposition to the sectoral specialization, and from there to the national case. First, the underlying dynamic, whether it concerns governance or fraud, is reformulated so as to transcend the organizational context in which [6] initially placed it. It is then examined in the context of global tourism and its institutional specificities; and finally, it is confronted with the Greek data, where this same dynamic often appears more acute. Accompanying comparative tables frame each stage and are collected in Section 3.3. As for the usefulness of the findings, this does not stop at the Greek borders: it concerns any jurisdiction that is called upon to manage governance within service economies with a high rate of irregularity and the dominance of small and medium-sized firms; in other words, a large part of the developing world and a considerable part of the developed world.

Against this background, this essay pursues three questions. First, how do the ten governance, accounting, and fraud principles map onto the structural conditions of tourism, SME dominance, informality, seasonality, and self-reported performance data, and which tourism-specific mechanisms do they illuminate (RQ1)? Second, what does the Greek case, as an extreme case that combines high tourism dependence, a normalized shadow economy, and the myDATA digital reporting regime, reveal about how these principles interact to produce fraud and governance failures (RQ2)? Third, what are the implications for forensic accounting, audit risk assessment, and sustainable tourism governance, including SDG 8 and SDG 16 (RQ3)?

The structure of the work is as follows. Section 2 presents the conceptual approach and methodology. Section 3 examines how the ten principles are implemented, both internationally and nationally. Section 4 discusses the findings and their policy implications; Section 5 sets out the limitations; and Section 6 concludes with directions for further research.

2. Methodological Approach

The study is structured as a conceptual and contextual analysis based on secondary qualitative and quantitative evidence, not an empirical analysis of primary data. Instead of collecting primary data, the method relies on the application of a framework; it projects an established theoretical construct onto a sectoral and national field that its creators themselves had not considered. A conceptual lens throughout the study is the ten-part framework of [6], which condenses over a century of research in forensic accounting, corporate governance, and fraud investigation. Each principle functions as a generalizable proposition about how organizations, people, processes, and regulatory environments interact, facilitating or preventing governance failures.

The choice of the Hermanson et al. [6] framework is deliberate and central to the aim of this paper. Among the available lenses, the fraud triangle and the fraud diamond explain individual motivation but not the organizational and institutional conditions that sustain fraud; agency and stakeholder theories illuminate ownership relations but not the accounting and disclosure mechanics through which concealment occurs; and internal control frameworks of the COSO type presuppose the formal control environments that are largely absent in micro and small tourism enterprises. The Hermanson framework is, to our knowledge, the first to integrate the three pillars of interest here—governance, accounting, and fraud—into a single, practitioner-oriented set of principles spanning organizational setting, processes, people, incentives, regulation, and self-reporting. Two features make it especially suitable for tourism. First, it is profession-facing, developed for forensic accountants and auditors, which aligns it with the practical contribution sought here and with the scope of this journal. Second, and most importantly, its first principle (Organizational Setting) requires that governance tools be re-specified whenever the organizational context differs from the large, regulated firm for which they were designed; tourism—SME-dominated, informal, seasonal, and heavily self-reported—is precisely such a context, so the framework itself licenses, rather than merely permits, its transfer to this sector.

To apply the framework, the study adopts a purposive thematic synthesis of secondary evidence, without undertaking or claiming a formal systematic literature review. Given the interdisciplinary and conceptual nature of the project, intersecting accounting theory, corporate governance, and tourism economics, a formal search protocol was neither appropriate nor claimed for an essay of this kind. Instead, sources were identified through targeted searches of leading academic databases (Scopus, Web of Science) and official institutional repositories, screened against the three relevance criteria set out below, and retained where they bore directly on a specific claim rather than for the purpose of achieving comprehensive coverage.

The selection of sources and data followed three relevance criteria to limit confirmation bias:

• Conceptual relevance: sources had to relate directly to governance failure, fraud dynamics [2,9], or underground economy mechanisms;
• Source reliability: peer-reviewed literature was drawn from high-impact hospitality-management and accounting journals, while contextual and quantitative data were drawn from official national and international bodies (UNWTO, AADE, Bank of Greece, ELSTAT, SETE). These institutional sources are treated as authoritative baselines rather than as independent or methodologically equivalent evidence: several are self-reported, administratively produced, or—as this essay itself argues in Principle 5—subject to institutional and political incentives. Each source was therefore weighed by type (peer-reviewed research, administrative data, industry association reporting, regulatory enforcement records, or authors’ own calculation) and by its authority, independence, and verifiability, with convergent cross-source evidence prioritized over any single figure, and corroborating sources were cited wherever a figure would otherwise rest on a single administrative source;
• Relevant context: the focus remained on structural parameters concerning SMEs and modern digital compliance frameworks.

Through this sifting emerged a body of established theory and contemporary evidence, balancing the established literature with recent, post-pandemic data (up to 2025). As shown in Table 1, the ten principles are spread along a continuum that bridges the structural with the behavioral dimension: from systemic, institutional variables (organizational framework, regulatory constraints, and process structure) to deeply human factors such as operational pressure, pay incentives, and the tension between transparency and concealment (the “Stupid vs. Dishonest” schema). The choice of this framework is not accidental: its multidimensional character fits the heterogeneous institutional landscape of tourism much better than narrower, traditional typologies of governance. Importantly, moreover, the framework was deliberately designed to be accessible to non-specialists, an advantage for an industry with a dearth of expertise in forensic accounting and a historically low level of governance “literacy” in SMEs. These principles draw together, rather than replace, the classic fraud-theoretic lenses used throughout this paper: the [2] fraud triangle supplies the motive–opportunity–rationalization core, the [9] fraud diamond adds capability, and agency theory [10] frames the monitoring failures that recur across the principles. The framework’s contribution is to situate these mechanisms within a single governance-to-fraud continuum rather than treating them as separate diagnostics.

To ensure analytical depth, each principle is applied at two levels. Globally, tourism is approached as a distinct institutional category, defined by structural vulnerabilities documented by [1]: media dominance, pervasive underground economy, extreme seasonality, and a market increasingly mediated by platforms. Within this context, Greece was chosen as the main national case, precisely because it condenses in one jurisdiction the conditions that make governance failures analytically visible: tourism at 25–30% of GDP [7], myDATA as a regulatory milestone from 2021, and the legacy of austerity (2010–2018) that normalized the underground economy, with the pressure of survival leaving traces detectable even in today’s compliance data. In applying the framework, each principle is classified—according to the convergence and directness of the cited evidence—as strongly supported, partially supported, contradicted, or not assessable, so that its applicability is assessed rather than assumed. Applying these criteria, Principles 1, 4, 6, 7, 8, and 10 are assessed as strongly supported, Principles 3, 5, and 9 as partially supported, and Principle 2 as not assessable, since it functions as an inferential guardrail rather than an empirical proposition.

Thus, Greece functions here as an extreme, or critical, case: it is chosen not for representativeness but because it maximizes the conditions of interest, making governance failures analytically visible where elsewhere they remain latent, and a comparative design across several tourism-dependent economies is deliberately left to future work. The analysis that follows adopts this two-level design, examining the ten principles first in the macro-dynamics of global tourism and then in the Greek institutional context, with the inherent limitations of the approach discussed in the conclusions.

Table 1. The Ten Governance, Accounting, and Fraud Fundamentals. Adapted from ref. [6].

No.	Principle	Core Idea
1	Organizational Setting	What works in large, regulated organizations does not transfer to other environments.
2	Correlations	Beware the inference of causality and the assumption that findings from optional contexts apply equally to mandatory ones.
3	Processes	Formal procedures may be ceremonial; the real work is often done informally.
4	Regulation and Controls	More regulation is not always the solution; costs and unintended consequences also count.
5	Politics and Marketing	To gain support, you need to “sell” the idea with convincing storytelling and evidence.
6	People	At the core of governance, accounting, and fraud are people, not systems.
7	The Self-Graded Exam	Management prepares the very financial statements by which it is judged—an inherent conflict of interest.
8	Pressure	Some pressure motivates; too much can trigger fraud or organizational collapse.
9	Pay	Reward systems sometimes generate undesirable behaviors; designing incentives requires attention.
10	Appearing Stupid versus Dishonest	Direct admission of error (appearing “stupid”) is always preferable to cover-up (appearing “dishonest”).

Table 1. The Ten Governance, Accounting, and Fraud Fundamentals. Adapted from ref. [6].

No.	Principle	Core Idea
1	Organizational Setting	What works in large, regulated organizations does not transfer to other environments.
2	Correlations	Beware the inference of causality and the assumption that findings from optional contexts apply equally to mandatory ones.
3	Processes	Formal procedures may be ceremonial; the real work is often done informally.
4	Regulation and Controls	More regulation is not always the solution; costs and unintended consequences also count.
5	Politics and Marketing	To gain support, you need to “sell” the idea with convincing storytelling and evidence.
6	People	At the core of governance, accounting, and fraud are people, not systems.
7	The Self-Graded Exam	Management prepares the very financial statements by which it is judged—an inherent conflict of interest.
8	Pressure	Some pressure motivates; too much can trigger fraud or organizational collapse.
9	Pay	Reward systems sometimes generate undesirable behaviors; designing incentives requires attention.
10	Appearing Stupid versus Dishonest	Direct admission of error (appearing “stupid”) is always preferable to cover-up (appearing “dishonest”).

3. Conceptual Analysis

The results are mapped out systematically. Section 3.1 contextualizes the ten fundamentals within global tourism to highlight their theoretical shifts. Section 3.2 then applies this exact baseline to the Greek market, profiling the unique domestic realities of each principle. To maintain conceptual clarity and ensure a high degree of grounding in secondary evidence, each section is accompanied by a detailed institutional matrix which synthesizes the specific metrics, regulatory statutes, and case study evidence supporting each fundamental. Finally, Section 3.3 draws the comparison explicitly.

The ten principles are treated not as a flat checklist but as an interlocking architecture organized around a single explanandum—fraud and governance failure in tourism, operationalized as revenue concealment, undeclared work, and reporting manipulation. Principle 1 (Organizational Setting) is the structural antecedent that makes the tourism setting distinctive—SME dominance, informality, seasonality, and reliance on self-reported data—and thereby explains why a framework built for large, regulated entities must be re-specified here. Within that setting, Principles 3 and 7 act as organizational mechanisms and Principles 6, 8, 9, and 10 as behavioral mechanisms that jointly convert structural conditions into fraud outcomes. Principles 4 and 5 operate as institutional conditioning factors shaping whether these mechanisms escalate or are contained, while Principle 2 (Correlations) works across the whole as an inferential guardrail against reading association as causation or transferring voluntary setting evidence to mandatory regimes. These outcomes cascade into the sustainability failures examined in Section 4 (SDG 8 and SDG 16).

3.1. Global Tourism Application

3.1.1. Organizational Setting

One of the warnings of [6] is that governance tools designed for large, regulated organizations do not necessarily transfer to smaller, more informal organizations. In global tourism, this observation is clearly borne out. Numerically, the landscape is defined by very small units such as family hotels, independent restaurants, local travel agencies, and small carriers. The literature on governance in hospitality, however, was built almost entirely on research on the giants of the industry: large hotel chains (Marriott, Hilton, IHG), airline groups, and global online agencies (Booking Holdings, Expedia Group). Whatever internal control frameworks, audit committee structures, and anti-fraud programs have been developed for such entities remain, for an SME, inaccessible.

Added to this is the heterogeneity within the industry itself. Luxury resorts, budget hotels, cruise lines, and ecotourism operators carry completely different governance and fraud risk profiles, just as [3] points out for the differentiation between industries in the relevant literature. The cruise line struggles with reputational and regulatory compliance issues around the environment and passenger safety. The small inn, on the other hand, struggles with cash management and revenue reporting. No single, “one-size-fits-all” governance recipe covers both cases. The structural and financial metrics that capture this operational asymmetry are summarized in Table 2 (Fundamental 1).

3.1.2. Correlations

Stronger governance regularly correlates with better hotel performance, leading to fewer regulatory violations, less earnings management, and higher profitability [5]. Still, Ref. [6] reminds us that correlation is not causation. Crucially, behavior observed within voluntary reporting frameworks rarely translates directly to legally mandated ones. In tourism, both reservations are particularly weighty. Profitable chains, moreover, attract executives with stronger qualifications, creating a reverse causality that the hospitality literature rarely addresses.

Even more decisively, the transition from voluntary to mandatory reporting of ESG and non-financial data (CSRD, ESRS) in European hospitality may fundamentally overturn the relationships we observe. When companies are required to disclose governance characteristics for regulatory compliance reasons rather than as an indication of substantive quality, the resulting information environment may weaken, or even reverse, associations that have been identified in earlier studies of voluntary frameworks, precisely the dynamics documented by [11] in their study of audit committees. Thus, the chain that reports strong governance indicators because it actually embodies the relevant principles is a fundamentally different entity from one that simply replicates the ESRS model. This distinction is of major importance for researchers using disclosure data after 2026, as well as for analysts trying to gauge the actual quality of governance through public filings. The methodological and econometric implications of these biases are summarized in Table 2 (Fundamental 2).

3.1.3. Processes

International tourism offers a textbook example of how ceremonial compliance masks operational reality, a dynamic theorized by [6]. Large hospitality chains typically have all the governance tools in place: FCPA-compliant policies and supplier due diligence procedures. Beneath these formal structures, however, unethical practices persist. The empirical literature on fraud indicates that kickbacks and unrecorded commissions with local ground handlers and travel agents remain widespread throughout the industry [4,12].

Franchising agreements in global chains add a unique form of “ceremonial compliance.” The franchisor enforces strict, standardized quality and financial reporting standards; real-time oversight of day-to-day transactions at the franchisee level, however, remains patchy. Within this operational vacuum, the Property Management System (PMS) audit trails become a tool for abuse; instead of functioning as substantive controls that prevent fraud, they often degenerate into ritualistic records that merely record, after the fact, illegal transactions. The deep gap between formal compliance structures and the reality of procurement and data is systematically captured in Table 2 (Fundamental 3).

3.1.4. Regulation and Controls

In several jurisdictions, the regulatory response to fraud and the informal tourism economy has produced precisely the unintended consequences described by [6]. The tight regulation of short-term rental platforms (Airbnb, Vrbo) in Barcelona, Amsterdam, and New York is consistent with a reduction in declared inventory without a corresponding fall in the actual supply of accommodation, suggesting that some activity may have shifted to informal, unregulated channels. Similarly, the overregulation of hotel prices in post-pandemic recovery markets has fueled fragmented booking fraud and off-platform transactions. The quantitative and institutional outcomes of these shifts are captured in Table 2 (Fundamental 4).

Ref. [12] notes that hospitality fraud is shaped by the regulatory environment: where reporting obligations are simpler and clearer, under-reporting of income declines; where tax regimes become complex and multi-layered, opportunities for interpretive manipulation open up. Reference [13] provides the conceptual background to a dynamic that tourism regulators rarely consider in policymaking; in services, the shadow economy is not born so much from regulatory weakness as from regulatory complexity. Poorly calibrated rules push activity into the background, rather than driving it towards compliance. For SDG 16, which aims to curb illicit financial flows and build effective, accountable institutions, the conclusion is crucial; strict but unevenly calibrated regulation can accelerate the informal economy rather than curb it. A similar logic applies to the decent work goals of SDG 8; undeclared employment in tourism is directly exacerbated by the disproportionate compliance costs that formal employment frameworks impose on seasonal, very small businesses.

3.1.5. Politics and Marketing

Few economic figures in national accounts are as politically charged as tourism statistics. UNWTO arrivals, national tourism satellite accounts, destination marketing data—all are regularly shaped by political considerations. Sustainability certifications, however, such as Green Key and Travelife Gold, require independent on-site audits for initial award; the problem of self-reporting lies elsewhere. RevPAR and occupancy data voluntarily submitted to CoStar’s benchmarking services are not subject to any audit requirements yet feed directly into CMBS and acquisition valuations [14]. Similarly, UNWTO arrivals and receipts data are compiled from member state submissions using heterogeneous methodologies, without independent cross-referencing [1]. ESG assurance practitioners entering the tourism sector should be skeptical of these unverified data streams, not of certified sustainability metrics. The structural constraints and institutional dependencies of these metrics are discussed in Table 2 (Fundamental 5).

The political economy of tourism regulation who—controls licensing, what standards are applied, and how revenues are distributed—is largely determined by the pressure exerted by hotel associations, airlines, and travel agencies. Forensic accountants in the industry therefore need, as [6] advises, to cultivate political literacy alongside their technical proficiency.

3.1.6. People

The fraud diamond of Ref. [9]—opportunity, pressure, rationalization, and ability—captures the tourism labor landscape with remarkable accuracy. The industry’s reliance on seasonal, low-wage, high-turnover labor constantly opens the door to professional fraud at every level: cash theft at the front desk, overcharging for food and beverages, kickbacks to doormen, and manipulation of revenue by management. According to [12], the average loss per professional fraud incident is close to USD 145,000, and hospitality consistently ranks among the industries with above-average exposure. Ref. [4], for his part, documents an increase in losses during the pandemic as internal controls were weakened and oversight relaxed at partially operating properties.

The human dimension, however, does not stop at the operational staff; it runs all the way up the hierarchy. Reference [4] identifies reception and food service staff as the main perpetrators in terms of number of incidents; however, in terms of value, the vast majority of losses are due to fraud at the management level, just as the “competence” element in the fraud diamond predicts. And this risk is exacerbated by short tenures. The US Bureau of Labor Statistics reports a turnover rate of around 74% in the leisure and hospitality sector, the highest of any industry, which can undermine the accumulation of institutional knowledge required to detect organized fraud. Even the top is not spared; short CEO and CFO tenures (on average four to five years) limit the depth of oversight that boards and audit committees can exercise, while the whistleblowing culture remains chronically underdeveloped across the industry. Behavioral metrics and tenure indicators that illuminate this human risk factor are summarized in Table 2 (Fundamental 6).

3.1.7. The Self-Graded Exam

Tourism faces a severe challenge regarding self-reported data, an accounting vulnerability heavily emphasized by [6]. The industry relies on metrics like occupancy, ADR, and RevPAR, which hotels report directly to benchmarking platforms such as CoStar without independent audits. This lack of verification creates major risks; fabricating these figures distorts competitive standings, facilitates fraudulent loan applications, and warps corporate acquisition values. These benchmarking risks and structural scales are detailed further in Table 2 (Fundamental 7).

The lack of mandatory digital oversight in multiple jurisdictions creates a structural blind spot, enabling the systematic under-declaration of cash revenues in lodging, food and beverage, and ancillary operations. This dynamic reshapes the conventional agency problem [10]; in family-controlled tourism firms, identity fusion between ownership and management eliminates the external monitoring mechanisms that agency models rely upon. Enforced ESG reporting via the CSRD/ESRS framework mitigates this by institutionalizing third-party verification, a sharp departure from the unverified self-reporting long tolerated by benchmarking entities like CoStar. Real progress, however, raises a parallel risk profile. Because sustainability-linked financial instruments peg credit terms to ESG benchmarks, they generate the exact same manipulative incentives that historically plagued RevPAR reporting. Practitioners entering the ESG assurance domain must therefore approach non-financial datasets with a highly refined framework of professional skepticism.

3.1.8. Pressure

In the fraud triangle of Ref. [2], pressure is the primary driver of professional fraud. And tourism is, by nature, a high-pressure industry. Acute seasonality squeezes the generation of annual internals into a narrow time window; post-pandemic recovery targets imposed by banks and investors often prove unrealistic; and overtourism in popular destinations intensifies competition in pricing and capacity management. The early warning sign of ethical strain, according to [15], is the pressure to “make the numbers”, which may be embedded in many tourism business models. The geographic and macroeconomic dimensions that capture this structural pressure, along with its link to default risks, are presented in Table 2 (Fundamental 8).

The pandemic and the subsequent recovery periods have left behind a well-documented trail of pressure-induced fraud: fraudulent applications for government support, inflated insurance claims for canceled reservations, and manipulation of occupancy data to trigger lenders’ forbearance clauses [4]. These failures are consistent with [16], who finds that financial executives resort to accounting manipulation primarily when they are under intense pressure to meet externally imposed targets. A similar pattern appears in [12], which documents hospitality’s above-average exposure to occupational fraud—a risk amplified during the pandemic by an explosive combination of aggressive targets for lifting loan moratoriums and weakened supervision of semi-operational accommodations.

3.1.9. Pay

The design of compensation in global tourism embodies many of the pathologies identified by [6]. Commission-based compensation for travel agencies, OTAs, and booking platforms typically rewards volume over quality, often resulting in misrepresentation of accommodations and fraudulent upselling. At the same time, bonuses tied closely to occupancy rates have historically fuelled fraudulent booking inflation: accommodations themselves make “fake bookings” in their own inventory, through third-party channels, to artificially inflate their reported rates. The precise commission structures of the dominant digital distribution platforms, along with the operating mechanisms of this incentive-driven fraud, are captured in Table 2 (Fundamental 9).

At the management level, short-term incentive programs linked to RevPAR or EBITDA reproduce exactly the perverse structure that [17] has identified in short-term stock options: a suffocating pressure to maximize short-term financials, at the cost of potentially tolerating, or even facilitating, accounting manipulation. Multidimensional compensation schemes that integrate customer satisfaction, compliance metrics, and long-term performance, as [6] suggests, are rare in tourism SMEs; they are found almost exclusively in listed hotel real estate investment trusts (REITs).

3.1.10. Appearing Stupid Versus Dishonest

Tourism offers some of the most telling illustrations of the cost of choosing dishonesty over admitted “foolishness.” The collapse of Thomas Cook in September 2019 is the industry’s case in point. Management, with the complicity of EY, which failed to write down GBP 1.1 billion in goodwill in its 2017 and 2018 audits despite deteriorating business conditions, an omission for which the FRC imposed an initial GBP 6.5 million sanction, reduced to GBP 4.875 million (≈GBP 4.9 million) after a 25% settlement discount [18], hid the company’s deep financial distress from regulators, investors, and customers. When it finally needed an emergency GBP 200 m credit line that it failed to secure, the collapse left 600,000 tourists stranded around the world and cost 21,000 jobs, causing damage far greater than would have been caused by early disclosure, and even triggering Operation Matterhorn at a total cost of GBP 100 m [19]. In the cruise subsector, Carnival Corporation reflects the same dynamic: a USD 40 million criminal fine in 2017 for environmental pollution and intentional concealment, and a further USD 20 million fine in 2019 for six violations of the terms of suspension, a total that far exceeded what a timely disclosure and compliance program would have cost [20,21]. The exact financial figures, impairments, and regulatory penalties surrounding these corporate cover-ups are summarized in Table 2 (Fundamental 10).

At the SME level, the same behavioral pattern is seen in independent tour operators and local hoteliers who conceal their structural insolvency from customer protection funds and local authorities. The desperate attempt to avoid immediate reputational damage, through opaque accounting and off-the-books borrowing, turns into multiple operational and legal disasters once the inevitable shutdown sets in. In contrast, early recognition of a liquidity crisis, even when it costs professional embarrassment or formal exclusion in the short term, consistently leads to better restructuring outcomes and shields the systemic reputation of the destination itself.

Table 2. The 10 Fundamentals Applied to Global Tourism.

Principle	Key Evidence/Metric	Source	Governance Implication
1. Organizational Setting	Over 90% of EU accommodation and food-service enterprises are micro-firms (<10 staff) (a), yet norms are benchmarked to SOX-grade listed chains.	[22,23]	A governance asymmetry between the firms that set industry standards and the micro-enterprises that constitute the sector.
2. Correlations	Hospitality governance–performance links are cross-sectional and selection-biased; mandatory ESRS (post-2026) may break voluntary setting correlations.	[5,11]	A regulatory shift that mirrors documented audit committee dynamics and undermines inference drawn from voluntary setting data.
3. Processes	Kickbacks/unrecorded commissions dominate despite FCPA/Bribery-Act policies; procurement is the most-litigated failure.	[4,12]	Formal compliance documentation and actual procurement practice diverge structurally where informal supplier relationships predate written frameworks.
4. Regulation and Controls	STR crackdowns displace, not end, informality—Barcelona fell only after platform data-sharing; NYC LL18 cut listings ~90%, hotel prices ~7% (a), no affordability gain.	[13,14,24,25]	Poorly calibrated rules displace activity into informal channels rather than producing compliance.
5. Politics and Marketing	UNWTO arrivals non-comparable; RevPAR/occupancy to CoStar unaudited yet feed CMBS and M&A valuation.	[1,14]	A systemic self-reporting gap in tourism performance governance.
6. People	Above-average occupational fraud exposure; front desk/F&B led by volume, management by value; ~74% turnover (highest of any sector) (a).	[26]	Extreme turnover structurally prevents the institutional knowledge accumulation that effective fraud detection requires.
7. Self-Graded Exam	CoStar aggregates voluntary, unaudited data (85,000+ hotels) (a); derived RevPAR/ADR drive lending, valuation, bonuses (2021 whistleblower complaint).	[14,27]	Self-reported benchmarking constitutes a material audit risk in hotel valuation.
8. Pressure	Seasonality + fixed debt forces covenant-bound operators into off-season fraud-or-default choices; pandemic control breakdowns raised exposure.	[8,12,15]	Forbearance-linked recovery targets produced documented accounting manipulation under weakened oversight.
9. Pay	High OTA dependence; commissions commonly cited at ~15–25% of room revenue (b); short-vesting equity (occupancy-based GM bonus) raises restatement risk; multi-metric plans rare below listed-REIT level.	[6,17,28]	Volume- and occupancy-based incentives parallel the structures that drive earnings manipulation in listed firms.
10. Appearing Stupid vs. Dishonest	Thomas Cook (2019): EY fined GBP 4.9 m (a) over goodwill/going concern; concealment preceded a GBP 200 m gap, ~600,000 stranded, ~21,000 jobs lost. Carnival/Princess: USD 40 m + USD 20 m environmental cover-up fines.	[18,19,20,21]	Concealment multiplied losses far beyond what timely disclosure would have cost.

Note. Figures draw on (a) official/institutional data (e.g., Eurostat, U.S. BLS, UNWTO), (b) industry or survey-based estimates; the source column indicates the origin of each item.

Table 2. The 10 Fundamentals Applied to Global Tourism.

Principle	Key Evidence/Metric	Source	Governance Implication
1. Organizational Setting	Over 90% of EU accommodation and food-service enterprises are micro-firms (<10 staff) (a), yet norms are benchmarked to SOX-grade listed chains.	[22,23]	A governance asymmetry between the firms that set industry standards and the micro-enterprises that constitute the sector.
2. Correlations	Hospitality governance–performance links are cross-sectional and selection-biased; mandatory ESRS (post-2026) may break voluntary setting correlations.	[5,11]	A regulatory shift that mirrors documented audit committee dynamics and undermines inference drawn from voluntary setting data.
3. Processes	Kickbacks/unrecorded commissions dominate despite FCPA/Bribery-Act policies; procurement is the most-litigated failure.	[4,12]	Formal compliance documentation and actual procurement practice diverge structurally where informal supplier relationships predate written frameworks.
4. Regulation and Controls	STR crackdowns displace, not end, informality—Barcelona fell only after platform data-sharing; NYC LL18 cut listings ~90%, hotel prices ~7% (a), no affordability gain.	[13,14,24,25]	Poorly calibrated rules displace activity into informal channels rather than producing compliance.
5. Politics and Marketing	UNWTO arrivals non-comparable; RevPAR/occupancy to CoStar unaudited yet feed CMBS and M&A valuation.	[1,14]	A systemic self-reporting gap in tourism performance governance.
6. People	Above-average occupational fraud exposure; front desk/F&B led by volume, management by value; ~74% turnover (highest of any sector) (a).	[26]	Extreme turnover structurally prevents the institutional knowledge accumulation that effective fraud detection requires.
7. Self-Graded Exam	CoStar aggregates voluntary, unaudited data (85,000+ hotels) (a); derived RevPAR/ADR drive lending, valuation, bonuses (2021 whistleblower complaint).	[14,27]	Self-reported benchmarking constitutes a material audit risk in hotel valuation.
8. Pressure	Seasonality + fixed debt forces covenant-bound operators into off-season fraud-or-default choices; pandemic control breakdowns raised exposure.	[8,12,15]	Forbearance-linked recovery targets produced documented accounting manipulation under weakened oversight.
9. Pay	High OTA dependence; commissions commonly cited at ~15–25% of room revenue (b); short-vesting equity (occupancy-based GM bonus) raises restatement risk; multi-metric plans rare below listed-REIT level.	[6,17,28]	Volume- and occupancy-based incentives parallel the structures that drive earnings manipulation in listed firms.
10. Appearing Stupid vs. Dishonest	Thomas Cook (2019): EY fined GBP 4.9 m (a) over goodwill/going concern; concealment preceded a GBP 200 m gap, ~600,000 stranded, ~21,000 jobs lost. Carnival/Princess: USD 40 m + USD 20 m environmental cover-up fines.	[18,19,20,21]	Concealment multiplied losses far beyond what timely disclosure would have cost.

Note. Figures draw on (a) official/institutional data (e.g., Eurostat, U.S. BLS, UNWTO), (b) industry or survey-based estimates; the source column indicates the origin of each item.

3.2. The Greek National Case

Turning from the global macro-perspective to a specific national context, the ten fundamentals formulated by [6] are applied to the Greek tourism sector. Greece serves as a particularly suitable domestic case for analytical purposes, characterized by an extreme structural reliance on seasonal tourism, an economy dominated by micro-SMEs, and a rapidly evolving digital regulatory environment designed to combat informal financial flows. To facilitate a rigorous and direct comparison, the analytical structure of this section strictly mirrors that of the global analysis in Section 3.1. The localized institutional findings, empirical anomalies, and structural metrics are systematically summarized in Table 3.

3.2.1. Organizational Setting

The backbone of Greek tourism is the very small, family-run unit. According to [7], accommodations with fewer than ten rooms cover over 75% of the national bed capacity, operating most often as informal family partnerships or sole proprietorships. However, the European frameworks—the CSRD Directive and the ESRS standards—are aimed at large, listed companies, and thus barely reach this segment of the market. Based on strict size thresholds, they cover only 0.5% of active Greek tourism businesses; the vast majority of seasonal businesses remain outside regulation. From this structural bottleneck arises a strong compliance gap, where the official rhetoric of governance is disconnected from the daily operational reality (see Table 3 for sizes and regulatory thresholds) (Fundamental 1).

3.2.2. Correlations

The Greek hospitality governance literature remains exceptionally thin relative to its international counterparts, with existing studies severely constrained by data availability and small sample sizes. Empirical efforts to examine Greek hotel financial performance —primarily utilizing observational ICAP data frequently identify positive correlations between professionalized management structures and expanded EBITDA margins. However, as noted by [6] in voluntary settings, correlation does not imply causation; these findings are heavily distorted by selection bias, as highly profitable Aegean resort properties naturally attract external professional management rather than vice versa. Methodologically, the literature has historically failed to deploy instrumental variable or difference-in-differences designs to isolate true causal effects. In this context, the ongoing transition to mandatory myDATA reporting since 2021 constitutes a potentially valuable quasi-experimental setting for future research, echoing the regulatory shifts documented by [11]. Because myDATA introduces a staggered rollout across different enterprise size classes, it offers a rare opportunity to assess, in future empirical work, how a mandatory digital disclosure mechanism may affect direct financial outcomes, such as revenue declaration rates, rather than relying on voluntary setting correlations. The specific econometric limitations and empirical opportunities characterizing these hospitality correlation models are synthesized in Table 3 (Fundamental 2).

3.2.3. Processes

A similar divergence is also evident at the sectoral level. SETE, HATTA, FEDHATTA, and POX regularly publish extensive codes of conduct, model contracts, and complaints procedures—but in practice, informal practices define day-to-day decisions. Pricing, supplier procurement, and relations with local authorities are typically settled through unwritten agreements. AADE’s myDATA has brought several cash flows into the digital spotlight, but off-platform transactions and undocumented transfers remain widespread. Nowhere is this more evident than in island destinations; available evidence indicates that around 30–40% of audited commission payments to local transport agencies and tour operators are not accompanied by valid documents. In essence, the formal compliance framework functions as a formal overlay on a largely informal transaction culture (further analysis in Table 3) (Fundamental 3).

3.2.4. Regulation and Controls

Greece’s regulatory environment for tourism has historically been characterized by chronic policy volatility, multi-layered licensing requirements, and systemic enforcement constraints. The unintended consequences of regulatory over-saturation outlined by [6] are vividly reflected in recent domestic enforcement campaigns. Specifically, AADE’s intensified enforcement campaigns targeting accommodation and F&B operators in high-density destinations—with 48,000 on-the-spot inspections planned for summer 2022 alone across Santorini, Mykonos, Crete, and Rhodes [29]—indicate that roughly one in three inspected tourism businesses is found in violation of tax laws. While this aggressive oversight expanded declared tourism VAT revenues by 14%, a substantial structural compliance gap of an estimated 20–25% remains unresolved, consistent with a partial displacement of transaction processing toward sophisticated, off-platform mechanisms that bypass myDATA reporting ecosystems.

A parallel dynamic of displacement and informal substitution is visible in the short-term rental subsector. The institutional implementation of the mandatory short-term rental registry successfully brought 113,000 properties into the official system by late 2022. However, reinforcing the patterns identified by [13], stringent enforcement appears not to have eradicated informality and may instead be associated with its migration into less visible layers of the shadow economy. This regulatory leakage is empirically confirmed by the tourism receipt data in [8], which imply that actual short-term rental revenues exceeded officially reported figures by an estimated EUR 1.1 billion. Applied clumsily, high-intensity regulatory controls in the Greek tourism model may have altered the channels of informality rather than establishing substantive governance compliance. The detailed audit outcomes, penalty metrics, and estimated revenue discrepancies are systematically synthesized in Table 3 (Fundamental 4).

3.2.5. Politics and Marketing

Greek tourism statistics—co-produced by the Hellenic Statistical Authority (ELSTAT), the Bank of Greece, and SETE—are among the most frequently cited and politically contested economic data in national accounts. While these metrics are routinely deployed in parliamentary debates and election campaigns as evidence of macroeconomic competence, they suffer from acute structural vulnerabilities. As noted by [6] regarding data distortion under political imperatives, the Bank of Greece’s reliance on formal banking transaction data systematically misses cash-based, cryptocurrency, and informally channeled revenue streams, while ELSTAT’s border crossing data face severe operational and sampling constraints during peak seasonal flows. The precise methodological limitations, institutional biases, and structural vulnerabilities embedded in these national tracking systems are synthesized in Table 3 (Fundamental 5).

The political economy of Greek tourism promotion further reinforces this blur between rigorous governance and communication marketing. The Ministry of Tourism’s annual promotional campaigns function significantly as instruments of political communication rather than pure market development tools. This operational ambiguity is underscored by procurement processes, such as the allocation of the Ministry’s annual marketing budget, which frequently trigger institutional friction and parliamentary inquiries regarding tender transparency. Ultimately, the systemic practice of politically appointing the leadership of key tourism regulatory and promotional agencies ensures that statistical reporting and marketing budgets remain highly sensitive to governmental interests, compounding the transparency risks identified in forensic accounting frameworks.

3.2.6. People

The Greek tourism workforce is characterized by extreme seasonality, widespread informality, and a structural dependence on seasonal labor. According to [30], accommodation and food service account for 9.1% of total employment in Greece—the highest Horeca share in the EU—with peak-season employment reaching 445,000 in Q3 2023 [31]. This fragmentation drives systemic informality; [32] estimates that 28% of employment in these subsectors is entirely undeclared. The contract metrics and macroeconomic impacts of these labor dynamics are synthesized in Table 3 (Fundamental 6).

This acute labor informality serves as a dual catalyst for occupational fraud. It directly facilitates micro-level infractions (wage theft, tip skimming, unrecorded bonuses) and indirectly functions as a powerful fraud enabler. Employees trapped in precarious, informal labor arrangements are structurally disincentivized from reporting observed corporate or financial manipulations by management, completely undermining internal whistleblower mechanisms. This structural disconnect is underscored by SEPE data, which documented compliance violation rates of 54% for minimum wage standards and 71% for working-hour records.

3.2.7. The Self-Graded Exam

In Greek tourism, the weaknesses of self-reporting are most starkly evident. Even after the activation of myDATA to record invoices in real time, ref. [29] shows that accommodation and catering revenues yield only 75–80% of the expected VAT, an annual tax gap of around EUR 1.8–2.4 billion. The picture of systematic under-declaration is completed when the macroeconomic figures are compared: against total sectoral revenues of EUR 20.4 billion for 2023 according to [8], the declared turnover of accommodation and catering reached only EUR 17.2 billion, a deviation of EUR 3.2 billion (see Table 3, Fundamental 7, for macroeconomic deviations and tax evasion profiles). On a day-to-day basis, the findings of the AADE audits are dominated by split invoicing, the division of a transaction into multiple documents, so that it remains below regulatory and tax thresholds. Added to this is the dependence of tourism SMEs on external accountants, who are often under commercial pressure to prioritize aggressive tax optimization over compliance, effectively neutralizing the latter external control.

3.2.8. Pressure

The decade of austerity (2010–2018) subjected Greek tourism to prolonged economic pressure, coinciding with the normalization of non-compliance as a survival tool. Businesses unable to repay bank debts or cover payroll used tax evasion directly as a means of liquidity management. The footprint of the crisis remains structurally visible: according to [8], the non-performing loan ratio in hospitality and catering stood at 38.4% at the end of 2023, well above the national average of 24.1% and the highest concentration of “red” loans in the entire domestic banking system (see Table 3, Fundamental 8, for stress indicators and capacity limits). This prolonged pressure opened a deep rift between official data and actual operations. For example, while [7] records a typical loss of approximately 1200 classified hotel units through closures or license revocations in the period 2010–2018, ELSTAT data show a much smaller decline in actual capacity, as much of it was absorbed by informal, unregistered short-term rentals rather than exiting the market; many operators kept running physically while stepping outside the formal licensing framework. After 2023, overtourism in major destinations added a new type of operational pressure. Faced with proposed daily visitor limits (8000 for Santorini, 5000 for Mykonos), businesses squeezed between capacity caps and rising operating costs have a strong incentive to falsify room counts and occupancy figures to circumvent local rules.

3.2.9. Pay

Compensation structures in Greek tourism combine rigid formal wages with systematic, unrecorded cash supplements (“envelope wages”). Data from [32] reveal that 60% of seasonal hospitality workers receive such informal supplements, averaging EUR 180–250 per month. This dual model compromises governance: because employees depend on informal income controlled by management, their independence as potential whistleblowers or internal monitors is effectively neutralized. The transaction metrics, regulatory decrees, and audited commission discrepancies defining this risk are synthesized in Table 3 (Fundamental 9).

A parallel opaqueness characterizes travel agency commission structures. Despite existing regulatory obligations, minimal enforcement allows actual package holiday commissions to diverge from declared arrangements by 5–12 percentage points in AADE audits. While the market’s consolidation around dominant international digital platforms [7] has standardized primary bookings, it has merely displaced these opaque, informal financial flows toward secondary, locally processed destination services and tours.

3.2.10. Appearing Stupid Versus Dishonest

The myDATA framework offers a stark illustration of the stupid-versus-dishonest dilemma in Greece. Under Article 18 of Law 4987/2022, the state’s voluntary disclosure program offers 40–70% penalty reductions for operators who self-identify and correct compliance gaps before an audit begins. However, Ref. [29] metrics show that tourism sector uptake has been lower than 2%, even though post-audit penalties average approximately 2.3 times the original tax shortfall. The quantitative penalty ratios and institutional disclosure compliance rates are synthesized in Table 3 (Fundamental 10).

This paradox reinforces the principle in [6]: operators who would appear “stupid” by self-disclosing pay 57% less than those who appear “dishonest” by concealing non-compliance until audited. The broader Greek corporate culture, shaped by a historical lack of institutional trust between taxpayers and the state, routinely discourages early error admission. Consequently, some tourism operators may face substantially higher post-audit penalties rather than pursue voluntary rectification, a pattern consistent with the continued concealment of non-compliance.

Table 3. The 10 Fundamentals Applied to Greek Tourism.

Principle	Key Evidence/Metric	Source	Governance Implication
1. Organizational Setting	33,000 classified units, 75%+ with <10 rooms (sole-proprietor/family); 170,000+ seasonal AADE filers, almost all outside CSRD/ESRS (a)	[7]	EU standards reach ~0.5% of Greek tourism firms
2. Correlations	Greek hospitality governance studies are sparse, rarely use IV/DiD for selection bias (profitable Aegean resorts self-select into pro management); myDATA provides a potential quasi-experimental opening	[5,33,34]	Link unidentifiable from observational data alone
3. Processes	SETE/HATTA/POX codes and standard contracts exist, yet commission payment invoice trails lack documentary support in ~30–40% of audited cases (b)	[7,29]	Ceremonial compliance exists; substance beneath is thinner
4. Regulation and Controls	AADE ~48,000 spot inspections (summer 2022), ~1 in 3 in violation (a); declared tourism VAT +14% (2021–23) yet 20–25% gap (c); STR registry 113,000 properties (December 2022), actual STR revenue exceeded declared revenue by ~EUR 1.1 bn (c)	[8,29]	Enforcement displaced informality rather than ending it
5. Politics and Marketing	BoG receipts (card/wire only) miss cash/crypto/informal flows; ELSTAT border sampling strained at peak; arrival/revenue used as competence evidence in campaigns	[8]	Incentives favor optimistic figures; key streams escape verification
6. People	Accommodation and food = 9.1% of Greek employment (EU’s highest Horeca share); peak 445,000 (Q3 2023) (a); ~28% undeclared (b) (~EUR 890 m/yr lost contributions) (c); SEPE 2022: 54% min-wage and 71% working hour violations (a)	[30,32,35,36]	Formal standards and practice structurally disconnected
7. Self-Graded Exam	Declared accom/F&B ≈75–80% of expected VAT yield (a same-scope EUR 1.8–2.4 bn gap, the primary measure here) (c); Bank of Greece receipts imply ~EUR 20.4 bn total tourism revenue (2023) vs. ~EUR 17.2 bn declared (a)—an indicative upper-bound gap (~EUR 3.2 bn) (c) that reflects differing sectoral boundaries rather than a direct measure of evasion; split invoicing most-cited 2022–23 technique.	[8,29]	Self-reported figures diverge materially from independent macroeconomic cross-checks.
8. Pressure	Hospitality NPL 38.4% (end-2023) vs. 24.1% economy-wide (highest sectoral) (a); ~1200 units lost 2010–18, capacity absorbed by informal STRs; Santorini cruise cap 8000/day (2025), Mykonos EUR 20 levy (768 ships, 1.29 m pax 2024)	[7,8,35,37]	A decade of existential pressure reshaped compliance norms that persist after revenue recovery.
9. Pay	“Envelope wages” (fakelaki) standard: ~60% of surveyed workers get unrecorded cash (~EUR 180–250/mo) (b); package commission structures diverge from declared by 5–12 pp in audits	[29,32,36]	Workers dependent on informal income cannot act as monitors
10. Appearing Stupid vs. Dishonest	VDP (Art. 18, L.4987/2022) gives 40–70% penalty cuts for pre-audit self-reporting (a), yet tourism uptake <2% over two years despite post-audit penalties ~2.3× the shortfall (c)	[29,38]	Early disclosure would cost ~57% less, yet operators rarely use it

Note. Figures draw on (a) official administrative data (ELSTAT, AADE, SEPE, Bank of Greece), (b) survey-based empirical estimates, and (c) the authors’ own calculations from the cited sources; approximate estimates are not presented as exact official statistics.

Table 3. The 10 Fundamentals Applied to Greek Tourism.

Principle	Key Evidence/Metric	Source	Governance Implication
1. Organizational Setting	33,000 classified units, 75%+ with <10 rooms (sole-proprietor/family); 170,000+ seasonal AADE filers, almost all outside CSRD/ESRS (a)	[7]	EU standards reach ~0.5% of Greek tourism firms
2. Correlations	Greek hospitality governance studies are sparse, rarely use IV/DiD for selection bias (profitable Aegean resorts self-select into pro management); myDATA provides a potential quasi-experimental opening	[5,33,34]	Link unidentifiable from observational data alone
3. Processes	SETE/HATTA/POX codes and standard contracts exist, yet commission payment invoice trails lack documentary support in ~30–40% of audited cases (b)	[7,29]	Ceremonial compliance exists; substance beneath is thinner
4. Regulation and Controls	AADE ~48,000 spot inspections (summer 2022), ~1 in 3 in violation (a); declared tourism VAT +14% (2021–23) yet 20–25% gap (c); STR registry 113,000 properties (December 2022), actual STR revenue exceeded declared revenue by ~EUR 1.1 bn (c)	[8,29]	Enforcement displaced informality rather than ending it
5. Politics and Marketing	BoG receipts (card/wire only) miss cash/crypto/informal flows; ELSTAT border sampling strained at peak; arrival/revenue used as competence evidence in campaigns	[8]	Incentives favor optimistic figures; key streams escape verification
6. People	Accommodation and food = 9.1% of Greek employment (EU’s highest Horeca share); peak 445,000 (Q3 2023) (a); ~28% undeclared (b) (~EUR 890 m/yr lost contributions) (c); SEPE 2022: 54% min-wage and 71% working hour violations (a)	[30,32,35,36]	Formal standards and practice structurally disconnected
7. Self-Graded Exam	Declared accom/F&B ≈75–80% of expected VAT yield (a same-scope EUR 1.8–2.4 bn gap, the primary measure here) (c); Bank of Greece receipts imply ~EUR 20.4 bn total tourism revenue (2023) vs. ~EUR 17.2 bn declared (a)—an indicative upper-bound gap (~EUR 3.2 bn) (c) that reflects differing sectoral boundaries rather than a direct measure of evasion; split invoicing most-cited 2022–23 technique.	[8,29]	Self-reported figures diverge materially from independent macroeconomic cross-checks.
8. Pressure	Hospitality NPL 38.4% (end-2023) vs. 24.1% economy-wide (highest sectoral) (a); ~1200 units lost 2010–18, capacity absorbed by informal STRs; Santorini cruise cap 8000/day (2025), Mykonos EUR 20 levy (768 ships, 1.29 m pax 2024)	[7,8,35,37]	A decade of existential pressure reshaped compliance norms that persist after revenue recovery.
9. Pay	“Envelope wages” (fakelaki) standard: ~60% of surveyed workers get unrecorded cash (~EUR 180–250/mo) (b); package commission structures diverge from declared by 5–12 pp in audits	[29,32,36]	Workers dependent on informal income cannot act as monitors
10. Appearing Stupid vs. Dishonest	VDP (Art. 18, L.4987/2022) gives 40–70% penalty cuts for pre-audit self-reporting (a), yet tourism uptake <2% over two years despite post-audit penalties ~2.3× the shortfall (c)	[29,38]	Early disclosure would cost ~57% less, yet operators rarely use it

Note. Figures draw on (a) official administrative data (ELSTAT, AADE, SEPE, Bank of Greece), (b) survey-based empirical estimates, and (c) the authors’ own calculations from the cited sources; approximate estimates are not presented as exact official statistics.

3.3. Comparative Synthesis

The combined reading of the two implementation modules highlights that the ten principles show analytical relevance across both examined contexts, while displaying a differentiated institutional intensity. In fact, the transition from one level to another does not change which principles are activated, but how acutely each one manifests itself in practice, as is characteristically reflected in the comparison in Table 4.

3.3.1. Key Similarities and Cross-Context Alignment

The most consistent finding concerns the governance deficit in SMEs (Principle 1): whether it is a local business in Naxos or a franchised accommodation in the Maldives, the regulatory frameworks designed for listed chains fail to penetrate this level. The same applies to the gap between formal and substantive compliance in procedures (Principle 3), where theory diverges from everyday practice for exactly the same reasons internationally and in Greece—supervision entails high costs, informal channels prove to be functional, and the price of potential disclosure remains negotiable.

On the human dimension (Principle 6), the factors of the “fraud diamond”—pressure, opportunity, rationalization, and ability—are exacerbated not by domestic specificities, but by the structural characteristics of seasonal, low-paid work with high rates of mobility, regardless of geographical location. Principle 10 requires special mention; although the collapse of Thomas Cook is the global case in point, the underlying dynamics are not limited to large companies. The small Greek businessman who conceals VAT debts from the AADE, only to later find himself faced with fines and surcharges that exceed the initial capital, is making the exact same calculation on a smaller scale. The instinct to cover up cuts across sectors and jurisdictions.

3.3.2. Key Differences and Greek Amplifications

Greek tensions are not evenly distributed; instead, they peak in Principles 4, 8, and 9, which bear the institutional legacy of long-term austerity.

In the field of regulation (Principle 4), the crowding-out phenomenon appears measurably stronger. The targeted audit campaigns of [29,39], following the myDATA rollout, revealed a shift in transactions outside its visible digital channels—not only towards cash, but also towards alternative, informal payment systems that exploit gaps in the systemic architecture [8]. The limit here is structural: with around 11,000 employees compared with 170,000 seasonal businesses, universal audit coverage is numerically unfeasible.

In terms of pressure (Principle 8), the differentiation is primarily temporal. In contrast to the cyclical pressure faced by global tourism, Greek businesses experienced a decade of existential crisis that permanently reshaped compliance standards. The non-performing loan ratio in hospitality remained close to 38%, compared to 24% in the economy as a whole [8], providing evidence that the typical financial picture diverged from operational reality even after revenue recovery.

In remuneration (Principle 9), the most distinct Greek specificity is found in the practice of the “implied salary”. According to [32], approximately 28% of employment in accommodation and catering remains undeclared, a figure that translates into approximately 890 million euros in uncollected annual contributions. However, an employee who depends on income outside of official accounting records may be constrained from functioning as an independent control mechanism against fraud.

Table 4. Comparative Analysis—Global vs. Greek Tourism.

Principle	Global Tourism	Greek Tourism	Key Difference/Similarity
1. Organizational Setting	[1]: governance models built for listed multinationals; SME exclusion documented across all tourism markets.	[7]: the same exclusion, far wider—CSRD/ESRS reache only a tiny fraction of the micro-SME base.	≈
2. Correlations	[5,11]: governance–performance link observed but causally unresolved; mandatory ESRS may dissolve voluntary setting correlations.	Greek literature thin and selection-biased; the staggered myDATA rollout offers a potential quasi-experimental (difference-in-differences) setting whose identification assumptions would first need to be established.	Δ
3. Processes	[4,12]: formal FCPA/anti-corruption architecture coexists with persistent procurement kickbacks.	[29]: member codes of conduct (SETE, HATTA, POX) in place; substantive compliance markedly thinner beneath them.	≈
4. Regulation	[14,24]: tight STR and price regulation displaces activity to informal channels rather than ending it.	[8,29]: the same displacement, sharper—enforcement lifts declared VAT, yet a large structural gap persists.	≈+
5. Politics	[31]: unaudited benchmarking and non-comparable arrivals data feed valuation and policy.	Tourism statistics are politically charged; promotional budgets and political appointments raise transparency concerns [5,31].	Δ+
6. People	[9,12]: high occupational fraud exposure; extreme turnover blocks institutional fraud detection knowledge.	The EU’s highest informal employment share in the sector heightens labor-side fraud exposure [10,19,26].	≈+
7. Self-Graded Exam	RevPAR/occupancy submitted to CoStar carry no audit requirement yet feed CMBS underwriting and valuation [8,25].	[14,27]: voluntary, unaudited self-reported KPIs feed lending and valuation—a systemic integrity risk.	Δ+
8. Pressure	Extreme seasonality and fixed debt push covenant-bound operators toward off-season fraud-or-default choices [8,12,15].	[8,12]: seasonal concentration plus fixed debt creates binary fraud-or-default incentives [8,37]: decade-long existential pressure; sector NPLs far above the national average even after recovery.	Δ+
9. Pay	[17]: volume-based commissions and short-vesting equity reward short-term metrics over integrity.	[29,32]: the envelope wage norm structurally disables employees as internal monitors.	Δ+
10. Appearing Stupid versus Dishonest	Thomas Cook (2019); Carnival [19,20,21]: concealment of insolvency and environmental breaches multiplied losses far beyond what timely disclosure would have cost.	[29]: voluntary disclosure program (Law 4987/2022) offers large penalty cuts pre-audit, yet uptake stays near zero—the same cover-up logic at SME scale.	≈+

Note. Symbols in the final column: ≈ = pattern broadly comparable across both settings; Δ = pattern differs in kind; + = markedly more intense in the Greek case. Comparisons are qualitative and made on common dimensions (prevalence, enforcement capacity, labor informality, financial pressure, and data verifiability). Legend: ≈ = Similar; Δ = Different; + = More intense in Greek context.

Table 4. Comparative Analysis—Global vs. Greek Tourism.

Principle	Global Tourism	Greek Tourism	Key Difference/Similarity
1. Organizational Setting	[1]: governance models built for listed multinationals; SME exclusion documented across all tourism markets.	[7]: the same exclusion, far wider—CSRD/ESRS reache only a tiny fraction of the micro-SME base.	≈
2. Correlations	[5,11]: governance–performance link observed but causally unresolved; mandatory ESRS may dissolve voluntary setting correlations.	Greek literature thin and selection-biased; the staggered myDATA rollout offers a potential quasi-experimental (difference-in-differences) setting whose identification assumptions would first need to be established.	Δ
3. Processes	[4,12]: formal FCPA/anti-corruption architecture coexists with persistent procurement kickbacks.	[29]: member codes of conduct (SETE, HATTA, POX) in place; substantive compliance markedly thinner beneath them.	≈
4. Regulation	[14,24]: tight STR and price regulation displaces activity to informal channels rather than ending it.	[8,29]: the same displacement, sharper—enforcement lifts declared VAT, yet a large structural gap persists.	≈+
5. Politics	[31]: unaudited benchmarking and non-comparable arrivals data feed valuation and policy.	Tourism statistics are politically charged; promotional budgets and political appointments raise transparency concerns [5,31].	Δ+
6. People	[9,12]: high occupational fraud exposure; extreme turnover blocks institutional fraud detection knowledge.	The EU’s highest informal employment share in the sector heightens labor-side fraud exposure [10,19,26].	≈+
7. Self-Graded Exam	RevPAR/occupancy submitted to CoStar carry no audit requirement yet feed CMBS underwriting and valuation [8,25].	[14,27]: voluntary, unaudited self-reported KPIs feed lending and valuation—a systemic integrity risk.	Δ+
8. Pressure	Extreme seasonality and fixed debt push covenant-bound operators toward off-season fraud-or-default choices [8,12,15].	[8,12]: seasonal concentration plus fixed debt creates binary fraud-or-default incentives [8,37]: decade-long existential pressure; sector NPLs far above the national average even after recovery.	Δ+
9. Pay	[17]: volume-based commissions and short-vesting equity reward short-term metrics over integrity.	[29,32]: the envelope wage norm structurally disables employees as internal monitors.	Δ+
10. Appearing Stupid versus Dishonest	Thomas Cook (2019); Carnival [19,20,21]: concealment of insolvency and environmental breaches multiplied losses far beyond what timely disclosure would have cost.	[29]: voluntary disclosure program (Law 4987/2022) offers large penalty cuts pre-audit, yet uptake stays near zero—the same cover-up logic at SME scale.	≈+

Note. Symbols in the final column: ≈ = pattern broadly comparable across both settings; Δ = pattern differs in kind; + = markedly more intense in the Greek case. Comparisons are qualitative and made on common dimensions (prevalence, enforcement capacity, labor informality, financial pressure, and data verifiability). Legend: ≈ = Similar; Δ = Different; + = More intense in Greek context.

4. Discussion

Returning to the three questions posed at the outset: the analysis indicates that the ten principles do map onto the structural conditions of tourism (RQ1)—SME dominance, informality, seasonality, and reliance on self-reported data recur as the mechanisms that convert governance weakness into fraud; that the Greek case (RQ2) shows these principles interacting most intensely where enforcement, financial pressure, and pay informality coincide (Principles 4, 8, and 9); and that the implications for practice (RQ3) fall into forensic audit, regulatory, and sustainability domains, developed below and operationalized in Table 5 and Table 6. This also locates the findings within a literature that has documented each mechanism in isolation but rarely as an interacting governance–fraud system specific to tourism.

The intersection of the ten principles with sustainability accounting is structural, not just thematic. The mandatory third-party assurance under the CSRD/ESRS directly addresses the weaknesses of self-assessment control (Principle 7), where self-reported indicators have historically escaped independent verification. However, this change creates a parallel risk: pressure to embellish sustainability disclosures—greenwashing—could easily complement or exacerbate conventional financial manipulation. In ESG-oriented tourism businesses, forensic accountants should expect these two dynamics to operate in parallel.

Sustainability-linked financing adds a further dimension to the pressure (Principle 8): because green bonds and ESG-linked loans directly tie credit terms to non-financial targets, non-financial misrepresentation now falls within the realm of fraud itself. At an operational level, the widespread informal employment in Greek tourism simultaneously condenses a governance failure, a risk of fraud, and a deficit of accountability in the social pillar of ESG—a gap that mandatory ESRS disclosure will increasingly render measurable and auditable.

At a macroeconomic level, the myDATA architecture functions as a national implementation mechanism for SDG 16, and in particular for targets 16.4 (reduce illicit financial flows) and 16.6 (transparent, accountable institutions). In practice, Greek tourism auditors and forensic accountants promote global sustainability goals through their daily compliance work—whether they realize it or not. Making this connection explicit gives tourism governance advocates exactly the analytical basis they need to build resilient political coalitions so that implementation survives changing electoral and audit cycles. From a methodological perspective, the implementation of myDATA in Greece is an unexpected gift to the researcher. The staggered inclusion—large enterprises from January 2021, medium-sized enterprises from April 2021, and small enterprises and the self-employed from January 2022—created a quasi-experimental design that lends itself to difference-in-differences estimation—a design this essay proposes for future empirical work rather than executing here. The “intervention” is the mandatory digital transmission of invoices; the variable of interest is the rate of income declarations and VAT declarations from tourism, measured against the Bank of Greece series of international tourism receipts—a measure estimated independently of the AADE data and thus providing an independently produced comparison series. Whether, and to what extent, myDATA narrows the same-scope EUR 1.8–2.4 billion VAT gap documented in Section 3.2 (Principle 7), with the wider EUR 3.2 billion figure used only as an indicative cross-check, is a fully testable empirical question. The analytical difficulty lies in isolating concurrent disruptions—most notably the strong recovery of 2021–2023, which independently changed income levels and may have inflated apparent benefits of compliance. Getting it right is important beyond Greece; Portugal, Croatia, Italy, and Spain are considering similar mandatory e-invoicing architectures for their tourism sectors.

A balanced reading must also register evidence that cuts the other way. Mandatory digital reporting has, in several settings, raised rather than merely displaced compliance; more intensive regulation and greater involvement of qualified accountants are associated in parts of the literature with stronger monitoring and lower fraud; and well-designed incentive pay can support, rather than undermine, long-term performance. These findings temper any deterministic reading: the mechanisms identified here elevate fraud risk under the structural conditions typical of tourism, but they are contingent rather than inevitable, and their net effect in any given jurisdiction remains an empirical question.

Two summary tools make the framework operational. Table 5 translates each principle into a forensic audit risk profile for tourism entities, and Table 6 maps each principle to the sustainable development targets it most directly affects.

Table 5. Forensic audit risk matrix for tourism entities.

Principle	Likely Fraud Scheme	Vulnerable Accounts/Cycle	Red Flags	Audit Evidence/Digital Source	Forensic Procedure
1. Organizational Setting	Off-book cash sales; owner override	Revenue/cash receipts; related-party	Owner is also manager and bookkeeper; no segregation of duties	myDATA e-invoices vs. POS/PMS vs. bank deposits	Entity-level control review scaled to SMEs; cash reconciliation
2. Correlations	Governance quality misjudged from disclosure-only data	Management/ESG reporting	KPIs improve only post-CSRD without substantive change	ESRS disclosures vs. substantive controls	Skepticism toward disclosure-derived quality; substance sampling
3. Processes	Procurement kickbacks; unrecorded commissions	Purchasing/payables; F&B and transport	PMS trail records transactions only after the fact; round-sum payments	PMS audit trail; supplier master; bank account ownership logs; e-invoice matching	Three-way match; supplier due diligence; log analytics
4. Regulation and Controls	Displacement to cash/off-platform; STR under-registration	Revenue; VAT	Declared inventory falls without a fall in supply; persistent VAT gap	myDATA vs. platform data; STR registry cross-check	Channel reconciliation; VAT-gap analysis
5. Politics and Marketing	Manipulation of self-reported KPIs (RevPAR/occupancy)	Revenue recognition; management reporting	Unaudited KPI feeds; KPIs linked to covenants	Benchmarking submissions (e.g., CoStar) vs. source records	KPI substantiation; independent recomputation
6. People	Occupational fraud (skimming; management override)	Cash; payroll	High turnover/short tenure; weak whistleblowing	HR/tenure data; exception reports; ERGANI system logs	Behavioral red-flag analytics; surprise cash counts
7. The Self-Graded Exam	Revenue under-declaration; split invoicing	Revenue; VAT	Invoices split below thresholds; declared-vs-macro gap	myDATA line items; VAT returns vs. Bank of Greece receipts	Threshold/Benford analytics; split-invoice detection
8. Pressure	Covenant-driven inflation; fraudulent aid claims	Revenue; borrowings	Results cluster just above covenant thresholds	Loan covenants; occupancy vs. utility consumption proxies	Covenant threshold analytics; consumption cross-checks
9. Pay	Fake bookings; commission misrepresentation; envelope wages	Revenue; payroll	Post-period cancellation spikes; cash top-ups	Booking/cancelation logs; payroll vs. bank	Booking–cancellation analysis; payroll-to-bank reconciliation; cashflow to payroll variance analysis
10. Appearing Stupid vs. Dishonest	Concealment of insolvency/impairment; non-use of the voluntary disclosure program	Going concern; provisions/impairment	No impairment despite distress; VDP uptake below 2%	Impairment tests; VDP records; NPL data	Going-concern and impairment review; disclosure-timeliness testing

Table 5. Forensic audit risk matrix for tourism entities.

Principle	Likely Fraud Scheme	Vulnerable Accounts/Cycle	Red Flags	Audit Evidence/Digital Source	Forensic Procedure
1. Organizational Setting	Off-book cash sales; owner override	Revenue/cash receipts; related-party	Owner is also manager and bookkeeper; no segregation of duties	myDATA e-invoices vs. POS/PMS vs. bank deposits	Entity-level control review scaled to SMEs; cash reconciliation
2. Correlations	Governance quality misjudged from disclosure-only data	Management/ESG reporting	KPIs improve only post-CSRD without substantive change	ESRS disclosures vs. substantive controls	Skepticism toward disclosure-derived quality; substance sampling
3. Processes	Procurement kickbacks; unrecorded commissions	Purchasing/payables; F&B and transport	PMS trail records transactions only after the fact; round-sum payments	PMS audit trail; supplier master; bank account ownership logs; e-invoice matching	Three-way match; supplier due diligence; log analytics
4. Regulation and Controls	Displacement to cash/off-platform; STR under-registration	Revenue; VAT	Declared inventory falls without a fall in supply; persistent VAT gap	myDATA vs. platform data; STR registry cross-check	Channel reconciliation; VAT-gap analysis
5. Politics and Marketing	Manipulation of self-reported KPIs (RevPAR/occupancy)	Revenue recognition; management reporting	Unaudited KPI feeds; KPIs linked to covenants	Benchmarking submissions (e.g., CoStar) vs. source records	KPI substantiation; independent recomputation
6. People	Occupational fraud (skimming; management override)	Cash; payroll	High turnover/short tenure; weak whistleblowing	HR/tenure data; exception reports; ERGANI system logs	Behavioral red-flag analytics; surprise cash counts
7. The Self-Graded Exam	Revenue under-declaration; split invoicing	Revenue; VAT	Invoices split below thresholds; declared-vs-macro gap	myDATA line items; VAT returns vs. Bank of Greece receipts	Threshold/Benford analytics; split-invoice detection
8. Pressure	Covenant-driven inflation; fraudulent aid claims	Revenue; borrowings	Results cluster just above covenant thresholds	Loan covenants; occupancy vs. utility consumption proxies	Covenant threshold analytics; consumption cross-checks
9. Pay	Fake bookings; commission misrepresentation; envelope wages	Revenue; payroll	Post-period cancellation spikes; cash top-ups	Booking/cancelation logs; payroll vs. bank	Booking–cancellation analysis; payroll-to-bank reconciliation; cashflow to payroll variance analysis
10. Appearing Stupid vs. Dishonest	Concealment of insolvency/impairment; non-use of the voluntary disclosure program	Going concern; provisions/impairment	No impairment despite distress; VDP uptake below 2%	Impairment tests; VDP records; NPL data	Going-concern and impairment review; disclosure-timeliness testing

Read as an audit tool, Table 5 turns the framework’s diagnostic claims into concrete engagement guidance. It links each principle to the fraud schemes it predicts, the accounts and transaction cycles most exposed, the red flags that signal elevated risk, the digital evidence now available under myDATA and property-management systems, and the forensic procedures that address them. The matrix is deliberately scaled to the sector’s micro-enterprise majority: several procedures—myDATA-to-POS reconciliation, threshold and Benford analytics on split invoicing, and occupancy-to-utility cross-checks—exploit precisely the digital reporting infrastructure that distinguishes the Greek case. In this form, the ten principles function less as a checklist than as a tourism-specific forensic risk map for auditors, regulators, and forensic accountants.

Table 6. Mapping the ten principles to SDG targets and governance consequences.

Principle	SDG Target	Measurable Indicator	Tourism Governance Consequence
1. Organizational Setting	16.6/8.3	Share of SMEs within reporting scope (~0.5%)	Governance rhetoric fails to reach the micro-SME base
2. Correlations	16.6	Reliability of disclosure-based metrics	Mismeasured governance quality distorts policy
3. Processes	16.5	Share of undocumented commissions (30–40%)	Procurement corruption beneath formal codes
4. Regulation and Controls	16.4/8.3	VAT gap; off-platform share	Poorly calibrated rules push activity into the shadow economy
5. Politics and Marketing	16.6	Audit coverage of KPIs/statistics	Politically shaped, unverified data
6. People	8.5/8.8	Undeclared employment (28%); turnover (74%)	Labor informality plus collapse of whistleblowing
7. The Self-Graded Exam	16.4	Declared-vs-independent revenue gap	Revenue concealment reduces fiscal capacity
8. Pressure	8.3	Sector NPLs (38.4%)	Existential pressure normalizes non-compliance
9. Pay	8.8	Envelope wage prevalence (60%)	Informal pay disables internal monitors
10. Appearing Stupid vs. Dishonest	16.4/16.6	VDP uptake (below 2%)	Concealment over correction erodes institutional trust

Table 6. Mapping the ten principles to SDG targets and governance consequences.

Principle	SDG Target	Measurable Indicator	Tourism Governance Consequence
1. Organizational Setting	16.6/8.3	Share of SMEs within reporting scope (~0.5%)	Governance rhetoric fails to reach the micro-SME base
2. Correlations	16.6	Reliability of disclosure-based metrics	Mismeasured governance quality distorts policy
3. Processes	16.5	Share of undocumented commissions (30–40%)	Procurement corruption beneath formal codes
4. Regulation and Controls	16.4/8.3	VAT gap; off-platform share	Poorly calibrated rules push activity into the shadow economy
5. Politics and Marketing	16.6	Audit coverage of KPIs/statistics	Politically shaped, unverified data
6. People	8.5/8.8	Undeclared employment (28%); turnover (74%)	Labor informality plus collapse of whistleblowing
7. The Self-Graded Exam	16.4	Declared-vs-independent revenue gap	Revenue concealment reduces fiscal capacity
8. Pressure	8.3	Sector NPLs (38.4%)	Existential pressure normalizes non-compliance
9. Pay	8.8	Envelope wage prevalence (60%)	Informal pay disables internal monitors
10. Appearing Stupid vs. Dishonest	16.4/16.6	VDP uptake (below 2%)	Concealment over correction erodes institutional trust

Table 6 extends the same logic to sustainable development outcomes, so that the governance failures analyzed above are not left as fiscal or audit problems alone. Each principle is mapped to the SDG target it most directly implicates, a measurable indicator drawn from the evidence in Section 3.1 and Section 3.2, and the tourism governance consequence that follows. The mapping concentrates on SDG 8 (decent work and undeclared employment) and SDG 16 (illicit financial flows and institutional transparency), making explicit how revenue concealment, envelope wages, and low voluntary disclosure uptake translate into weaker fiscal capacity, precarious labor, and eroded institutional trust rather than remaining abstract compliance concerns.

5. Limitations

The limits of the analysis should be explicitly acknowledged. The framework of [6] itself is based primarily on the North American experience, where enforcement is more consistent and corporate governance is more institutionally established than in the post-Memorandum Greek context; whether its predictions generalize to environments of lower institutional quality remains an open empirical question. Added to this is the nature of the case selection; the examples were chosen for analytical clarity, not representativeness; a different selection (e.g., from the Caribbean or Southeast Asia) may or may not reproduce the pattern; whether the architecture transfers to such institutional settings remains an empirical question, and the findings should therefore be taken as indicative. Most crucial of all, however, remains the issue of data: the allegations of undeclared work, VAT non-compliance, and income concealment are based on authoritative but not independent sources (AADE, Bank of Greece, INE-GSEE, SETE), with the official estimates of the gap based on macroeconomic imputation and the sectoral data reflecting the interests of the members. The gap of EUR 3.2 billion and 28% undeclared employment are the best available approximations; however, access to AADE audit microdata would allow them to be verified, rather than simply formulated. A further methodological caveat concerns publication bias: as a conceptual essay drawing on published sources, the analysis sees documented governance failures and prosecuted fraud cases more readily than cases where controls worked, which may tilt the evidence toward confirming the framework.

A further, framework-level limitation concerns what this approach does not capture. The Hermanson principles are organization-centric and therefore under-weight dimensions that are distinctive to tourism: the destination as a shared, multi-actor governance commons; platform intermediation (online travel agencies and short-term rental platforms) that relocates transactions and records outside the individual firm; the transient, largely cash-paying and non-repeat tourist, who weakens the customer-side controls on which detection often relies; and extreme seasonality as a structural driver of financial pressure. A fully tourism-native framework would incorporate this destination-, platform-, and seasonality-level dimension; mapping it onto—or extending—the ten principles is a promising direction for future research.

6. Conclusions

The application of the ten principles of [6] to tourism indicates that each has analytical relevance in light of the selected international evidence, while the Greek case illustrates several of these mechanisms under particularly high-intensity conditions. From this transition, from theory to the field, three practical consequences arise, each for a different recipient.

A forensic accountant working in a tourism SME will quickly find that the framework imposes a hierarchy rather than a checklist. In tourism SMEs, where typical internal control systems are under-functioning and board oversight is structurally absent, the human dimension (Principle 6) is not one parameter among others; it is the main, and often the only, inhibiting factor. The factors of the fraud diamond do not remain abstract concepts here; they are directly read in seasonal staff turnover rates, “by the file” remuneration, and self-reported indicators that benchmarking services have historically accepted without scrutiny.

For anyone designing policy, by contrast, the binding constraint is not regulatory design but enforcement capacity. With approximately 11,000 AADE employees against over 170,000 seasonal tourism businesses, universal audit coverage is numerically unfeasible, and that is why targeting counts more than scope. The detection of anomalies in myDATA based on risk, the wider use of the voluntary disclosure program (Law 4987/2022) and the proportional reform of labor compliance constitute the three most applicable interventions.

The largest share of the work, in the end, remains a research task. The ten principles have demonstrated their analytical reach; however, their predictive power remains to be tested against hard, sector-specific data—and the staggered myDATA rollout offers a potential quasi-experimental setting for that purpose, once its identification assumptions are established. Ultimately, tourism governance failures are, to a significant degree, sustainability failures as well. Undeclared work, tax evasion, and revenue manipulation are not just issues of forensic accounting; they are among the mechanisms through which SDG 8 and SDG 16 remain unfulfilled in one of the world’s largest employment sectors. This framework bridges forensic accounting with the sustainability governance agenda. The bridge has been built; empirical research remains to be done.