Most organisations still govern risk as if the boundary of the firm were clear. Responsibilities are mapped to internal functions. Controls are designed around owned processes. Assurance focuses on activities that sit within formal organisational lines.
Yet an increasing share of operational, financial, and reputational risk now sits outside those lines.
Outsourcing, platform models, complex supply chains, shared infrastructure, and technology dependence have created extended enterprises that are economically integrated but governance-fragmented. Value is produced across organisational boundaries, while accountability remains stubbornly internal.
This gap is now one of the most persistent sources of surprise.
Boards are usually aware that third-party and supplier risk matters. There are policies, registers, and onboarding processes. Critical suppliers are identified. Due diligence is performed. Contracts contain risk clauses. On paper, the issue is recognised.
What is less clear is who is actually responsible for understanding how risk accumulates across the system as a whole.
Extended-enterprise risk does not behave like traditional operational risk. It is emergent. It builds through interaction, dependency, and pressure. Small weaknesses compound silently because no single organisation has full visibility or incentive to intervene early.
When failure occurs, it is often described as a supplier issue, a systems problem, or an external shock. What is rarely acknowledged is that governance itself was misaligned with how the organisation actually operated.
The collapse of Carillion exposed this vividly. Risk was distributed across subcontractors, financing structures, and long-term public contracts. Each component was governed in isolation. No single board had a complete picture of how fragility was building across the extended enterprise. By the time stress became visible, the system had already passed the point where incremental intervention could work.
A different but related pattern was evident in the UK Post Office Horizon scandal. Responsibility for the technology, its operation, and its consequences was fragmented across organisational and contractual boundaries. Governance mechanisms treated these as discrete domains. The lived reality for sub-postmasters sat in the gaps between them.
In both cases, the issue was not the absence of oversight, but the absence of integrated oversight.
Traditional governance assumes that risk can be owned. Extended-enterprise risk resists ownership. It sits between organisations, across contracts, and within relationships. It is shaped by power asymmetries, commercial pressure, and mutual dependence. No amount of internal control can fully compensate for this.
This creates a structural blind spot. Boards receive assurance that internal processes are operating effectively, while the most consequential risks sit elsewhere. Third-party risk frameworks exist, but they tend to focus on compliance and entry conditions rather than ongoing system behaviour.
The result is a form of false comfort. The organisation appears well governed, even as its resilience depends on actors it does not control and relationships it does not actively interrogate.
Extended-enterprise risk also challenges escalation. When concerns arise, they often lack a natural home. Is the issue operational, contractual, strategic, or cultural? Who has the authority to act when the risk is diffuse and responsibility is shared? In many cases, the safest option is to monitor and defer.
This is how risk becomes normalised.
Importantly, this is not simply a private-sector problem. Public services, infrastructure, healthcare, and financial systems are all increasingly delivered through complex ecosystems. Accountability remains formally clear, but practically diluted. When failure occurs, inquiries struggle to reconstruct how decisions were made across organisational seams.
Boards often respond by tightening contracts, strengthening supplier assurance, or reducing concentration risk. These steps have value. But they rarely address the core issue: governance mechanisms have not evolved to match the structure of modern organisations.
What is missing is not diligence, but perspective.
Governing the extended enterprise requires boards to ask different questions. Not only “is the supplier compliant?”, but “how does pressure travel through this system?”. Not only “who owns this risk?”, but “who experiences it first?”. Not only “what does the contract say?”, but “what happens when incentives collide?”.
These are not questions that can be answered by one function or one line of defence. They require integration across strategy, operations, risk, and culture. They require curiosity about how the organisation actually creates value, not just how it reports risk.
Until governance catches up with organisational reality, extended-enterprise risk will remain under-priced and under-understood. Controls will continue to operate internally, while fragility builds externally.
The challenge is not to extend existing frameworks further outward, but to recognise that the boundary they rely on no longer holds.
Richard Anderson
Founder, AndersonRisk
This essay was first published on 19 February 2026 on my Substack.