Model of risk governance in digital public sector projects: The case of Kazakhstan’s electronic human resource management platform
Risk governance has become a central concern in public administration as governments implement complex digital transformation projects aimed at improving service delivery, efficiency, and transparency. Although International Organization for Standardization (ISO) 31000 provides a structured framework for identifying, assessing, treating, monitoring, and communicating risks, its procedural orientation may be insufficient in public sector environments shaped by cognitive biases, institutional inertia, information asymmetry, and misaligned incentives (Grimmelikhuijsen et al., 2017; ISO, 2018). This study develops an ecological model of risk governance that integrates ISO 31000, Behavioural public administration (BPA), and agency theory into a multi-layered framework for analysing digital public sector projects. Using Kazakhstan’s electronic human resource management (e-HRM) platform as a qualitative single-case study, the research draws on document analysis, 20 semi-structured interviews, observation of inter-agency discussions, and descriptive project-level evidence. The findings show that formal risk registers and technical safeguards were necessary but insufficient: optimism bias, status quo bias, inter-agency coordination problems, and vendor-government incentive misalignment generated emergent risks during implementation. The study contributes to public administration theory by conceptualising risk governance as an adaptive system and offers practical recommendations for improving accountability, risk disclosure, user adoption, and institutional coordination in digital transformation projects.