In the aftermath of large company failures in the early 2000s there emerged a new wave of efforts to enhance risk management (RM) and control in enterprises. The normative management model, which urges organisations to develop a comprehensive, formal and systematic RM, was developed, and it has been promoted widely to all organisations, including public sector organisations. Using survey data, this article describes and explains the diffusion and adoption of RM innovation in local government in Finland. Our survey results support the argument that if comprehensive RM is not obligatory, it is not widely used in local government. Our analysis reveals that financial constraints explain to some extent the existence of comprehensive RM in municipalities, while structural factors such as the size of municipalities do not, even though RM is slightly more advanced in larger rather than smaller local governments. Slow adoption indicates that comprehensive RM as a managerial innovation lacks immediate benefit when assessed against the efforts and costs of its introduction and maintenance. This implies that public sector organisations may be more selective in adopting business models than is generally assumed.