Risk analysis is important for complex projects. However, systemicity makes evaluating risk in real projects difficult. Looking at the causal structure of risks is a start. But causal chains need to include management actions, motivations of project actors, and socio-political project complexities as well as intra-connectedness and feedback. Common practice based upon decomposition-type methods is shown often to point to the wrong risks. A complexity structure is used to identify systemicity and draws lessons about key risks. We describe how to analyse the systemic nature of risk, and how contractor / client can understand ramifications of their actions.