Controlling risk in software projects is a major contributor to successful outcomes, in both the private and public sectors. Few studies investigate risk management in the public sector. This paper reports a study of risk practices in government agencies in an Australian State. It finds that risk management practices lag behind project management practices and that there is scope for improvement in both. Ten major risk factors are identified. Also, some conventional conceptions of project and risk management are challenged. The paper concludes by discussing implications of the findings for research and practice in the public sector.