Mediating Role of Risk Acceptance in QRIS Adoption Among Microentrepreneurs: An ISO 31000 Risk Treatment Perspective

Intention to adopt

Technology adoption is a pivotal process where economic contributions are realized only through wide diffusion and utilization (Hall & Khan, 2003). This process involves a tradeoff between uncertain benefits and inherent implementation risks, which is particularly complex for MSMEs in developing countries due to digital transformation barriers and organizational challenges (Díaz-Arancibia et al., 2024).

The Unified Theory of Acceptance and Use of Technology (UTAUT) serves as a cornerstone for understanding these adoption mechanics (Williams et al., 2015). Recent evolutions of this framework emphasize “attitude” as a central mediator between technological constructs and behavioral intentions (Dwivedi et al., 2019). In the Indonesian digital finance landscape, behavioral intention remains the primary driver for QRIS integration, shaped significantly by performance expectancy and facilitating conditions (Hamzah Muchtar et al., 2024). Consequently, this study adopts the Intention to Adopt measurement scales from Hamzah Muchtar et al. (2024) for contextual relevance.

However, adoption is also constrained by uncertainty, where perceived security and trust significantly influence decision-making (Nabila et al., 2025). Perceived risk often acts as a barrier that negates positive performance expectations, leading potential adopters to cognitively evaluate how to handle threats (Dwivedi et al., 2019; Williams et al., 2015). Moving beyond mere risk perception, this research employs a Risk Treatment perspective to explore how strategies of avoidance, control, mitigation, transfer, and acceptance ultimately shape the intention to adopt QRIS.

Perceived risk

The concept of Perceived Risk is a fundamental and well-established construct within the consumer behavior and information systems literature, defining a user’s cognitive vulnerability to uncertainty and potential negative consequences associated with an adoption decision (Li, 2025; Mitchell, 1999). Risk, within this framework, is not an objectively measurable metric, but rather a subjective, probabilistic evaluation shaped by the individual’s assessment of the likelihood and magnitude of potential loss (Dowling & Staelin, 1994).

In the context of technology adoption, particularly concerning digital payment systems and FinTech, Perceived Risk manifests as a multidimensional construct that is consistently identified as a significant negative predictor of behavioral intention. Contemporary research specifically highlights several dimensions relevant to digital transactions, such as (1) Security and Privacy Risk (Bland et al., 2024; Gómez-Hurtado et al., 2025; Kumar et al., 2023), (2) Performance Risk (Sohn, 2024; Xie et al., 2021), (3) Financial Risk (Xie et al., 2021), and (4) Time and Social Risk (Habib & Hamadneh, 2021).

Empirical findings conclusively demonstrate that a high perception of risk among end-users significantly inhibits their intention to adopt the technology (Bland et al., 2024). However, despite the successful identification and measurement of these risk perceptions, a theoretical gap exists in understanding the subsequent response. According to Dowling and Staelin (1994), perceived risk acts as a central trigger that should initiate risk-handling activities by the individual. Therefore, an investigation that integrates this subjective threat assessment with a structured Risk Treatment framework is required to bridge the gap between subjective risk appraisal and rational adoption behavior.

Digital payment adoption and perceived risk dynamics

Recent empirical investigations into digital payment and financial technology acceptance have increasingly recognized the complex interplay between trust, perceived risk, and adoption behavior in emerging economies (Aljaradat & Shukla, 2025; Pandey & Kushwaha, 2025). Studies focusing on micro-enterprises and small merchants highlight that while digital payment systems like QRIS enhance income and operational efficiency (Manippi et al., 2025), adoption decisions remain heavily conditioned by usability, institutional trust, and perceived threat environments (Timur et al., 2025). Furthermore, recent work demonstrates that adverse cybersecurity experiences and perceived vulnerability act as dynamic behavioral shocks that can severely suppress usage intention, even when system features are objectively secure (Aljaradat & Shukla, 2025).

However, a synthesized review of this contemporary literature reveals a predominant reliance on static risk and trust constructs. Most existing models evaluate Perceived Risk or Security as exogenous antecedents rather than exploring the specific behavioral procedures users employ to modify or neutralize those threats. While these studies effectively establish that high risk reduces adoption, they offer limited theoretical insight into how non-adopting micro-entrepreneurs systematically process and respond to risk. By integrating ISO 31000-based Risk Treatment strategies that consist of Avoidance, Control, Mitigation, Transfer, and Acceptance into the technology adoption framework, this study addresses this critical literature gap, advancing from passive threat evaluation to active risk-handling behavior.

ISO 31000 risk treatment

Enterprise Risk Management (ERM) is guided by the international standard ISO 31000:2018 Risk Management Guidelines, which provides principles, a framework, and a process for managing risk across all organizational levels and activities. ISO 31000 is applicable to any organization, regardless of size, sector, or type, and aims to embed risk management into governance, strategy, operations, and culture (International Organization for Standardization, 2018). The 2018 edition is the latest and currently valid version, having replaced ISO 31000:2009 in February 2018. The revision was introduced to simplify language, reduce the number of guiding principles from eleven to eight, and emphasize leadership, integration, and continuous feedback through an open systems model (Makajić-Nikolić, 2020). ISO 31000:2018 also reinforces the role of risk management not only in minimizing threats but also in recognizing opportunities, with a strong focus on value creation and protection (International Organization for Standardization, 2018).

In the context of this study, the focus is placed on the Risk Treatment component of ISO 31000:2018, which refers to the process of selecting and implementing measures to modify risk (International Organization for Standardization, 2018). ISO 31000:2018 outlines four primary categories of risk treatment: Risk Avoidance, Risk Reduction, Risk Transfer, and Risk Acceptance. However, in practice, Risk Reduction can be further divided into two distinct approaches: Risk Control, which aims to reduce the likelihood of risk occurrence, and Risk Mitigation, which focuses on reducing the impact of risk once it occurs (Becker, 2025; International Organization for Standardization, 2018; Roselius, 1971). Therefore, this study adopts a five-construct model derived from ISO 31000:2018’s risk treatment framework, namely Risk Avoidance, Risk Control, Risk Mitigation, Risk Transfer, and Risk Acceptance.

Risk Avoidance refers to the decision not to engage in an activity that carries risk, thereby eliminating the possibility of exposure. Risk Control involves proactive measures to reduce the likelihood of risk occurrence, such as implementing safeguards or monitoring systems. Risk Mitigation focuses on reducing the impact of risks that do occur, through contingency planning or resource allocation. Risk Transfer is the shifting of risk to another party, typically through contracts or insurance mechanisms. Lastly, Risk Acceptance is the conscious decision to retain a risk after evaluating its potential consequences and determining it to be tolerable, thus it is an expected state after a user has implemented Risk Control, Risk Mitigation, and/or Risk Transfer to the risk. The definitions form the theoretical foundation for the study’s measurement items, which were adapted from 25 academic sources (2017–2025). Each item was contextually modified to reflect QRIS adoption behaviors among microentrepreneurs, with the full synthesis of constructs and literature presented in Table 1.

Beyond reducing objective exposure to uncertainty, risk treatment strategies may also function as psychological coping mechanisms that increase an individual’s tolerance for residual risk. Drawing upon coping and adaptive behavioral perspectives, individuals are more likely to accept risk when they perceive that appropriate preventive, mitigative, or risk-sharing arrangements are available. In this sense, Risk Control, Risk Mitigation, and Risk Transfer do not simply reduce risk exposure. They also facilitate Risk Acceptance by enhancing perceptions of manageability, preparedness, and support. Prior technology adoption research further suggests that factors such as age, digital literacy, and social influence may shape these cognitive evaluations, although such effects are beyond the scope of the present study.

Hypotheses development

Risk control employs proactive safeguards and monitoring to minimize the probability of negative events (Taherdoost, 2021). Through structured planning and early threat identification, individuals reduce the uncertainty of technology adoption (Chen et al., 2024; Osei-Kyei et al., 2022). When microentrepreneurs possess the infrastructure to oversee digital transactions, their sense of security and systemic mastery increases (Ferrara et al., 2024; Hiebl, 2024). These robust mechanisms act as a psychological safety net, transforming perceived threats into tolerable operational risks (Marhavilas & Koulouriotis, 2021). Consequently, effective control measures foster a higher disposition toward risk acceptance in digital payment adoption.

H1: Risk Control has a significant effect on Risk Acceptance.

Risk mitigation reduces the severity of negative impacts once a risk materializes (Sapountzaki, 2022). Effective strategies, such as financial buffers or redundant systems, foster resilience among microentrepreneurs (Akomea-Frimpong et al., 2024; Hosseini Shekarabi et al., 2025). Possessing clear contingency plans and backup solutions enhances preparedness for uncertainty (Rezvani et al., 2023) and lowers anxiety regarding technology failures (Balea-Stanciu et al., 2025). By cushioning the adverse effects of QRIS adoption, these mitigative actions make inherent risks more tolerable, allowing entrepreneurs to consciously accept risk as a manageable part of their business operations.

H2: Risk Mitigation has a significant effect on Risk Acceptance.

Risk transfer is a strategic behavior where individuals shift the potential financial or operational burden of a risk to another party, such as insurance providers, technical experts, or social networks (Feng & Liu, 2025; Leng et al., 2017). In the context of technology adoption, transferring risk, either through contractual allocations or by delegating the management of digital tools to trusted entities, serves as a mechanism to reduce personal accountability for potential failures (Ashmawi et al., 2018; Feng, 2023). When microentrepreneurs believe they can rely on their community, experts, or official parties to handle the complexities and complications of QRIS, the perceived weight of the risk is diminished (Franco et al., 2024). This delegation of responsibility creates a buffer that allows the entrepreneur to feel more comfortable with the innovation. By offloading the most daunting aspects of digital risk to more capable or responsible parties, the remaining risk becomes much more tolerable. Consequently, the ability to transfer risk acts as a catalyst for risk acceptance, as the adopter no longer views themselves as the sole bearer of potential negative consequences.

H3: Risk Transfer has a significant effect on Risk Acceptance.

Risk acceptance represents the conscious decision to tolerate the residual risks of a technology after considering its potential benefits and the effectiveness of current treatment strategies (Marhavilas & Koulouriotis, 2021). In the context of digital financial tools, an individual’s willingness to embrace uncertainty is a critical precursor to actual behavior (Jain et al., 2023). When microentrepreneurs reach a state of risk acceptance, they acknowledge that while technical or financial issues may occur, these risks are manageable and outweighed by the advantages of digital integration (Barraza de la Paz et al., 2023; Panos & Wilson, 2020). This psychological readiness directly facilitates the formation of a positive behavioral intent. As established in the Indonesian QRIS ecosystem, the transition toward e-payment adoption is heavily dependent on how users perceive and internalize the security-risk trade-off (Hamzah Muchtar et al., 2024). Therefore, a higher level of risk acceptance significantly boosts the intention to adopt, as it removes the psychological barriers that typically hinder the adoption of new technology in the MSME sector (Díaz-Arancibia et al., 2024; Hall & Khan, 2003).

H4: Risk Acceptance has a significant effect on Intention to Adopt.

Risk avoidance is a defensive strategy characterized by the decision to withdraw from or completely bypass activities that involve perceived threats (Taherdoost, 2021). In the realm of digital innovation, avoidance often stems from a lack of digital literacy or deep-seated anxiety regarding financial loss and cyber-attacks (Díaz-Arancibia et al., 2024). When microentrepreneurs perceive the risks of QRIS, such as transaction errors or fraudulent activities, as being beyond their capacity to manage, they may choose to postpone or reject the technology altogether to maintain business stability (Hall & Khan, 2003). As noted by Hamzah Muchtar et al. (2024), the Indonesian e-payment landscape is still sensitive to security concerns, where a high disposition toward avoiding risk can lead to a significant decrease in adoption intention. Therefore, risk avoidance acts as a critical psychological filter. If the inclination to avoid potential pitfalls is stronger than the perceived functional benefits of the system, the intention to adopt will be severely constrained (Williams et al., 2015).

H5: Risk Avoidance has a significant effect on Intention to Adopt.

The relationship between risk control and the intention to adopt QRIS is not merely direct but is significantly facilitated by the cognitive process of risk acceptance. Risk control mechanisms, such as encrypted security protocols and transaction monitoring, serve as the structural foundation that reduces the objective probability of technical failure (Taherdoost, 2021). However, the presence of these controls only leads to adoption when the user perceives them as sufficient to make the remaining risks tolerable (Hiebl, 2024). In this context, risk acceptance acts as a psychological bridge. It transforms the technical assurance provided by control measures into a behavioral readiness to use the technology (Marhavilas & Koulouriotis, 2021). Without this mediation, even the most robust control systems might fail to trigger adoption if the user has not yet consciously accepted the residual uncertainty (Jain et al., 2023). This is particularly relevant in the Indonesian MSME sector, where the transition from perceiving a secure environment to forming an adoption intent requires a formalized acceptance of the digital ecosystem’s inherent risks (Hamzah Muchtar et al., 2024). Therefore, risk acceptance is essential in translating the efficacy of risk control into a proactive intention to adopt QRIS.

H6: Risk Acceptance significantly mediates the effect of Risk Control on Intention to Adopt.

The impact of risk mitigation on the intention to adopt QRIS is significantly mediated by the internal state of risk acceptance. While risk mitigation strategies provide the objective means to cushion potential losses (Akomea-Frimpong et al., 2024; Sapountzaki, 2022), these measures primarily influence adoption by shifting the user’s psychological threshold. By having a safety net in place, microentrepreneurs experience a reduction in perceived vulnerability, which allows them to consciously decide that the remaining risks are tolerable (Balea-Stanciu et al., 2025; Rezvani et al., 2023). This mediation process suggests that mitigation does not lead to adoption solely through its functional utility, but rather by fostering a state of risk acceptance that bridges the gap between “being prepared” and “being willing to adopt” (Marhavilas & Koulouriotis, 2021). In the Indonesian digital payment landscape, where uncertainty remains a primary deterrent, the ability to mitigate risks provides the mental security necessary for entrepreneurs to internalize and accept the risk-benefit trade-off (Hamzah Muchtar et al., 2024). Consequently, risk acceptance is the critical psychological mechanism through which mitigative efforts are translated into a firm intention to utilize QRIS.

H7: Risk Acceptance significantly mediates the effect of Risk Mitigation on Intention to Adopt.

The relationship between risk transfer and the intention to adopt QRIS is fundamentally governed by the mediating role of risk acceptance. Risk transfer strategies function as a mechanism to offload the most daunting aspects of digital threats (Ashmawi et al., 2018; Feng & Liu, 2025). However, the mere act of transferring risk does not automatically lead to adoption, as it must first lower the entrepreneur’s internal resistance and foster a willingness to embrace the remaining operational uncertainties (Leng et al., 2017). In this context, risk acceptance acts as the vital link that translates external support and shared responsibility into a personal behavioral commitment (Marhavilas & Koulouriotis, 2021). When microentrepreneurs feel that they are not the sole bearers of potential failure, they reach a psychological state of acceptance that effectively removes the “fear barrier” (Díaz-Arancibia et al., 2024; Jain et al., 2023). Especially within the Indonesian e-payment ecosystem, the perception of being protected by an institution or system allows users to internalize the risk-benefit trade-off more positively (Hamzah Muchtar et al., 2024). Therefore, risk acceptance serves as the psychological gateway through which risk transfer efforts are converted into a robust intention to adopt QRIS.

H8: Risk Acceptance significantly mediates the effect of Risk Transfer on Intention to Adopt.

The following model results from the corroboration of the hypotheses (Figure 1).

Figure 1.

Respondents’ profile

The demographic and operational characteristics of the surveyed micro-enterprises in Bandung are summarized in Table 2. This profile provides context for understanding the risk management behaviors of these small-scale business owners.

The age distribution of the respondents reveals a significant concentration of mature entrepreneurs. The largest group consists of individuals aged 50–59 years, representing 30.7% (35 respondents) of the total sample, followed by those older than 59 years at 23.3% (13 respondents). Combined, more than half of the participants are over 50 years old. In contrast, younger entrepreneurs aged below 30 years only make up a small fraction (14.7%). This age demographic is particularly noteworthy for this study, as it highlights that the majority of microentrepreneurs currently navigating digital payment risks in Bandung are from the older generation. This profile provides a unique perspective on technology adoption, suggesting that the risk treatments being analyzed are those practiced by “digital immigrants” who may perceive and manage the risks of QRIS differently compared to the tech-savvy younger generation.

The majority of respondents are engaged in the Food and Beverage (F&B) sector, accounting for 52% (78 respondents). This is followed by the Trade/Retail sector with 42.7% (64 respondents). The Services sector represents a smaller portion of the sample. This distribution aligns with Bandung’s economic structure, where small-scale retail and culinary ventures serve as the primary drivers of local commerce.

In terms of financial scale, the survey results show that the majority of respondents operate on a very small scale, with 84% (126 respondents) reporting monthly sales of less than IDR 5,000,000. This is followed by 12.7% (19 respondents) earning between IDR 5,000,001 and IDR 10,000,000, while a small fraction of the sample (3.3%) earns between IDR 10,000,001 and IDR 20,000,000. These figures confirm that the participants strictly align with the classic definition of micro-enterprises under the 2008 Law (Law of the Republic of Indonesia Number 20 of 2008 concerning micro, small, and medium enterprises, 2008), where the IDR 25,000,000 monthly sales limit represents a much lower benchmark compared to current regulatory standards. While the newer regulation of 2021 (Government Regulation Number 7 Year 2021 regarding the ease, protection, and empowerment of cooperatives and micro, small, and medium enterprises, 2021) has significantly increased the threshold for micro-enterprises to annual sales of up to IDR 2,000,000,000 to facilitate broader developmental support, the respondents in this study represent microentrepreneurs at the grass-roots level. By focusing on this specific group, the study provides a more representative and accurate analysis of the digital payment risk vulnerabilities faced by the smallest economic actors in Indonesia, who often lack the financial cushions of larger enterprises.

Regarding the duration of business operation, the data reveals that the majority of respondents are highly experienced entrepreneurs, with 51.3% (77 respondents) having been operating their businesses for more than 5 years. In contrast, newer businesses with less than 1 year of experience represent only a small fraction of the sample at 14% (21 respondents). This profile suggests that the findings of this study are predominantly shaped by established microentrepreneurs who have long-term operational experience, providing a solid basis for evaluating how seasoned microentrepreneurs perceive and treat risks associated with digital payment adoption.

Regarding QRIS System Implementation, this study utilized a purposive sampling method to specifically target microentrepreneurs in Bandung who have not yet implemented QRIS, resulting in a sample where 100% of the respondents are currently non-adopters of the platform. Selecting Bandung City as the research location provides a strategic urban context: despite the city’s status as a tourism and creative hub, these entrepreneurs remain reliant on conventional transaction methods. This deliberate focus is essential to accurately identify the situations that hinder QRIS integration amidst national efforts.

Measurement model evaluation

In this research, the measurement model is evaluated as a reflective construct, encompassing variables such as IA, RAC, RAV, RC, RM, and RT (Table 3). The assessment of this reflective model relies on several key metrics: outer loadings and composite reliability (including Cronbach’s alpha) must exceed the 0.70 threshold, while the Average Variance Extracted (AVE) is required to be at least 0.50.

Additionally, discriminant validity is verified through the application of the Fornell-Larcker criterion (Hair et al., 2022). Furthermore, to mitigate the risk of Common Method Bias (CMB) as highlighted by Podsakoff et al. (2024), a CFA-based single-factor test was performed. The analysis yielded a Chi-square value of 704.734, which significantly exceeds the critical threshold of 25.188 (p < 0.001). This result confirms that a single-factor model fails to fit the data, thereby demonstrating that common method variance does not pose a significant threat to the integrity of the structural relationships in this study.

The measurement model in this study was evaluated as a reflective construct, encompassing six primary variables: IA, RAC, RAV, RC, RM, and RT. To ensure the integrity of the model, an initial screening of factor loadings was conducted. During the measurement model assessment, four indicators (RAV04, RAV05, RM05, and RT05) exhibited relatively lower outer loadings of 0.633, 0.685, 0.680, and 0.641, respectively. A closer examination of the removed indicators suggests that several items reflected contextual conditions that may not have been uniformly relevant to all respondents. For example, RM05 (accepting traditional cash alongside QRIS) may represent a routine operational practice rather than a distinct risk-mitigation strategy, while RT05 (asking official parties to handle technical complications) may not reflect the actual support mechanisms typically relied upon by microentrepreneurs.

Following the recommendations of Hair et al. (2022), indicators with loadings between 0.40 and 0.70 may be considered for removal when their exclusion improves construct reliability and convergent validity. Consequently, these indicators were removed, and the model was re-estimated. The exclusion of RAV04, RAV05, RM05, and RT05 resulted in improved construct reliability and convergent validity. At the same time, the retained indicators continued to capture the core dimensions of the respective constructs, indicating that the measurement refinement enhanced model quality while preserving the theoretical integrity of the constructs.

As shown in the analysis, the reliability coefficients (Composite Reliability) for all constructs exceeded the 0.70 benchmark, while the Average Variance Extracted (AVE) values for each variable consistently remained above the 0.50 threshold. These metrics collectively verify that the measurement instruments are statistically sound and possess adequate explanatory power for the latent variables.

To evaluate the discriminant validity of the constructs, the Fornell-Larcker criterion was employed. As shown in Table 4, the square root of the Average Variance Extracted (AVE) for each construct, which is represented by the diagonal values, is consistently higher than the correlation coefficients between that construct and any other latent variables. For instance, the construct IA has a square root of AVE of 0.855, which is greater than its correlation with other variables, such as 0.562 with RAC, 0.248 with RAV, among others.

These results demonstrate that each variable shares more variance with its own indicators than with other constructs in the model. Therefore, the measurement model satisfies the requirements for discriminant validity, confirming that the constructs are empirically distinct from one another.

Structural model evaluation

The evaluation of the structural model in this study follows a systematic four-stage procedure. First, potential multicollinearity issues among the constructs were examined through the Inner Variance Inflation Factor (VIF), where values must remain below the 5.0 threshold to ensure stable parameter estimates (Hair et al., 2022). Second, the research hypotheses were tested by analyzing Path Coefficients, focusing on T-statistics (>1.96), P-values (<0.05), and 95% confidence intervals. Third, the F Square was measured to determine the substantive impact or effect size of each relationship. Finally, the mediation effects were assessed using the upsilon (υ) statistic as suggested by (Lachowicz et al., 2018) to provide a robust estimation of the indirect paths.

Before proceeding to hypothesis testing, the inner VIF values were scrutinized to ensure the absence of collinearity. The analysis revealed that the highest inner VIF value was only 2.550, which is well below the recommended limit. These results indicate a negligible level of multicollinearity, thereby confirming that the structural model is robust and the subsequent parameter estimates are unbiased and reliable for interpreting the relationship between risk perceptions and QRIS adoption barriers.

As seen in Table 5, the structural model assessment provides a detailed look at how various risk treatment strategies influence the level of Risk Acceptance (RAC) and the subsequent Intention to Adopt (IA) QRIS. The empirical results reveal that Risk Mitigation (RM) and Risk Transfer (RT) are significant drivers of Risk Acceptance. Specifically, RM shows a strong positive impact on RAC (H2: β = 0.409, p < 0.001, f² = 0.138), and RT also contributes significantly (H3: β = 0.357, p < 0.001, f² = 0.221), with upper confidence intervals reaching 0.568 and 0.503, respectively. From an effect-size perspective, RT demonstrates a stronger substantive contribution to Risk Acceptance than RM. These findings suggest that when entrepreneurs have solid mitigation and transfer mechanisms, their willingness to accept residual risks increases. Furthermore, Risk Acceptance (RAC) itself emerged as the most critical determinant of Intention to Adopt (IA) (H4: β = 0.546, p < 0.001, f² = 0.461), indicating that the decision to embrace digital payment risks is a fundamental precursor to technology adoption.

Risk Avoidance (RAV) demonstrated a significant positive influence on Intention to Adopt (IA) (H5: β = 0.204, p = 0.006, f² = 0.065). Although statistically significant, the effect size is relatively small, suggesting that its practical contribution is substantially weaker than that of Risk Acceptance. This suggests paradoxical behavior among microentrepreneurs. Although they are highly aware of the risks and express a desire to avoid them, this awareness does not deter their adoption intent. This may be attributed to the necessity-driven adoption factor, where entrepreneurs feel they must adopt technology to remain competitive, despite their concerns and avoidance tendencies toward its inherent risks. On the other hand, the path from Risk Control (RC) to Risk Acceptance (RAC) was statistically insignificant (H1: β = 0.117, p = 0.203, f² = 0.013). With a confidence interval that crosses zero (−0.064 to 0.291), the data suggests that existing risk control measures do not necessarily lead to higher levels of risk acceptance among the surveyed microentrepreneurs. The negligible effect size further suggests that formal control mechanisms contribute very little to explaining variations in Risk Acceptance among the surveyed microentrepreneurs. This highlights a potential gap where formal controls may not be perceived as sufficient to shift the entrepreneurs’ stance on accepting the digital transition’s inherent risks.

The mediation effects in this study were evaluated using both bootstrapping results and the Upsilon (υ) statistic as a measure of effect size (Lachowicz et al., 2018) (Table 6 and Figure 2).

Figure 2.

Based on the analysis, two out of three mediation hypotheses were statistically supported. H7, which examines the indirect effect of Risk Mitigation (RM) on IA through Risk Acceptance (RAC), was accepted with the highest effect size (H7: β = 0.223, p < 0.001, υ = 0.049). Similarly, H8 was accepted, confirming that Risk Transfer (RT) significantly influences adoption intent via RAC (H8: β = 0.195, p < 0.001, υ = 0.038). The 95% confidence intervals for both paths do not include zero, further solidifying the robustness of these mediation roles.

In contrast, H6 was rejected, as the indirect effect of Risk Control (RC) on IA through RAC was found to be statistically insignificant (H6: β = 0.064, p = 0.223, υ = 0.004). The confidence interval for this path ranges from −0.031 to 0.172, crossing zero and indicating a lack of a mediation relationship. These results demonstrate that while RM and RT successfully foster adoption intent by increasing risk acceptance, formal risk controls do not yield the same indirect impact within the structural model.

Model goodness and fit evaluation

The final stage of the structural model evaluation involves assessing the model’s explanatory power and its predictive relevance for the endogenous constructs. The analysis reveals that the combined influence of Risk Control (RC), Risk Mitigation (RM), and Risk Transfer (RT) explains 52.7% of the variance in Risk Acceptance (RAC) (R² = 0.527), indicating a moderate to strong explanatory effect. Furthermore, the model accounts for 35.8% of the variance in Intention to Adopt (IA) (R² = 0.358), which falls within the moderate category. These results suggest that while Risk Acceptance is heavily influenced by RC, RM, and RT, the intention to adopt is also shaped by other external factors not fully captured in the current framework.

To evaluate the model’s predictive capabilities, the Stone-Geisser Q² values were examined (Table 7). The results show that Risk Acceptance possesses a high level of predictive relevance (Q² = 0.487), while Intention to Adopt demonstrates a moderate predictive accuracy (Q² = 0.261). Since all Q² values are consistently above zero, the model confirms its adequacy in predicting the adoption behavior and risk perceptions of microentrepreneurs toward QRIS technology.

To evaluate the out-of-sample predictive power of the model, a PLSpredict procedure was performed using a 10-fold cross-validation approach. Following the criteria established by Hair et al. (2022), the predictive performance of the PLS-SEM model is assessed by comparing its Root Mean Square Error (RMSE) or Mean Absolute Error (MAE) against a naive Linear Regression (LM) model. A model is considered to have high predictive power if all its indicators yield lower error values in PLS-SEM than in LM. If most of the indicators show lower errors, the model is categorized as having medium predictive power (Table 8).

The analysis of the measurement items revealed that most indicators, specifically IA01, IA02, IA03, RAC01, and RAC02, demonstrated lower RMSE and MAE values in the PLSSEM model compared to the LM benchmarks. Although a few items, such as IA04 and IA05, exhibited slightly higher error margins in the PLS estimation, the overall results show that the majority of the indicators favor the PLS-SEM approach. Consequently, it can be concluded that the proposed model possesses a medium predictive power, confirming its reliability in predicting future adoption intentions and risk acceptance behaviors among microentrepreneurs.

Theoretical contributions

This study contributes to the technology adoption literature in three important ways. First, it extends UTAUT by incorporating ISO 31000 risk treatment strategies as behavioral antecedents of technology adoption. While most prior studies conceptualize risk as a passive perception that inhibits adoption, the present study shifts the focus toward active risk-management responses undertaken by potential adopters. Second, the findings identify Risk Acceptance as an important psychological mechanism that translates risk treatment behaviors into technology adoption intentions. This finding helps explain why entrepreneurs may remain willing to adopt digital technologies despite recognizing the existence of residual risks. Third, the positive relationship between Risk Avoidance and Intention to Adopt challenges the conventional assumption that avoidance always suppresses adoption behavior. Among non-adopting microentrepreneurs, risk avoidance may reflect cautious postponement and conditional evaluation rather than outright rejection of a technology. This finding suggests that avoidance and adoption intention may coexist during the transition from non-adoption to future adoption.

Practical implications

The practical implications of this study are informed by the relative strength of the observed effects. Risk Acceptance emerged as the strongest predictor of Intention to Adopt (β = 0.546; f² = 0.461), suggesting that interventions focused solely on promoting awareness of QRIS may be insufficient unless they also increase entrepreneurs’ willingness to tolerate manageable residual risks. Risk Mitigation (β = 0.409) and Risk Transfer (β = 0.357) significantly influenced Risk Acceptance, indicating that policymakers and payment providers should prioritize mitigation-oriented education, contingency planning support, technical assistance, peer mentoring, and community-based support mechanisms. Conversely, the non-significant effect of Risk Control suggests that highly formalized control procedures may not always be suitable for micro-scale businesses operating with limited time, financial resources, and technological capabilities.