It quickly became apparent during our work that the environments analysed and the risk management problems they present, display many of the characteristics of complex systems. A complex system, like the weather, is one where even if you know everything there is to know about the system it is not sufficient to predict precisely what will happen, although it is possible to discern a range of outcomes. When simple systems are put under stress they can start displaying many of the attributes of complex systems.

When a system is complex, it can achieve increased efficiency and performance, as well as increased capacity to adapt to its external environment. Unfortunately, these systems are also more sensitive to instabilities (sometimes catastrophic) and rather fragile when central elements are affected, especially multiple events in a short timescale.

This can lead to cascades of failure, for example:

• A fragile economy that is tipped into a recession by relatively small perturbations
• The power grid that collapses due to a single sub-station failure
• Relatively minor technical failures that result in huge consequent disasters at many levels, ranging from economic to environmental.

GOVERNANCE IN COMPLEX ORGANISATIONS
In a simple organisation, as seen in the diagram at Figure 4, the board directly controls manufacturing, sales and the back office. Communicating instructions and feedback also fall directly within the same span of control. In the complex organisation, or extended enterprise, manufacturing, sales and back office may now be outsourced to third parties. Many brand-based organizations operate in this way, and it is common for banks and other financial institutions to outsource many aspects of their businesses.

The difficulty this creates for risk management is that it breaks the communication lines. Those who carry out the detailed activities of manufacturing, sales and the back office are reporting to different managers who sit outside the direct control of the central board.

The different components may operate in different geographical and regulatory environments and have different risk cultures, risk appetites and tolerances. In extended enterprises the role of the board must change from one of ‘command and control’ to one of leadership, co-ordination and influence. Relationship management and collaborative working across the extended enterprise become essential. Boards need to develop a clear understanding of their extended enterprise. This includes an appreciation of the relative power, incentives, motivations, culture and ethics and operating conditions of the key participants.