Projects are important to society, and yet they often fail. This is despite the application of widely accepted project management standards, training, and processes. In this context, there is growing awareness that projects are often highly complex and therefore cannot be managed effectively solely by using process-based project management techniques. An alternative approach is now emerging, and that is recognising and dealing with the dynamic complexity, feedback and uncertainty inherent in most large projects today. When a project does fail, it follows that there has also been a failure in the management of risks to the project. Given this, it is possible to obtain insight into failures in complex projects by investigating how risk is managed. During this research, the management of internally generated risks in projects was of particular interest. These are the risks that projects create for themselves by the way they are set up or operate. If it is established that such risks are common, important and not well managed, it could provide valuable insight into why projects fail. Nine complex projects were investigated to identify, document and analyse internally generated risks to their success. Using data gathered from workshops and confidential interviews, five hypotheses were tested to understand the role played by internally generated risks in projects. A key part of the research method was the use of risk maps, an adapted form of cause-and-effect diagrams, as the basis for the dialogue necessary to create a shared understanding of each risk. Statistically significant results were obtained to support the conclusion that internally generated risks are common in complex projects, have the potential to significantly impact upon project success, and yet are generally poorly managed. It was also concluded that internally generated risks are important as a class of project risk, with potentially large impacts upon the success or otherwise of complex projects. Given this, further research to better understand how such risks arise and how they can be recognised and managed is appropriate.