In the aftermath of large company failures in the early 2000s, there emerged a new wave of efforts to enhance risk management (RM) and control in enterprises. The normative RM model has been promoted widely to all organisations, including public sector organisations. Using survey data, this article describes and explains the diffusion and adoption of RM innovation in local government in Finland. Our survey results support the argument that if comprehensive RM is not obligatory, it is not widely used in local government. Our analysis reveals that financial constraints explain to some extent the existence of comprehensive RM in municipalities, while structural factors such as the size of municipalities do not, even though RM is slightly more advanced in larger rather than smaller local governments. Slow adoption indicates that comprehensive RM as a managerial innovation lacks immediate benefit when assessed against the efforts and costs of its introduction and maintenance.