Enterprise Resource Planning (ERP) systems have been in existence for over 2 decades yet businesses are still losing billions of dollars annually in the implementation of software designed to reduce costs and increase profitability. The inability to manage risks is an area that contributes to these losses, specifically due to uncertain outcomes when dealing with an interconnected construct such as risk, and a research gap at the tactical and operational levels between risks and controls. A comparative case study approach, encompassing 12 different organisations was adopted to explore emerging patterns at the project implementation level, and from this three contributions emerged. After observing risks behaving in a hierarchical fashion with predictable results, Hierarchy of Risk models representing different implementation stages were constructed. Although these models are still in their formative stages, it may prove useful in furthering our understanding of the close inter-relationship between different risks, where they occur in ERP implementations and the implications of managerial choice when determining risk prioritisation. A second finding is that no direct linear relationship appears to exist between risks and controls. Rather, this counter-intuitive finding suggests that it is additional factors including risk categories, implementation stages, prior control decision making and the hierarchical flow-on effect of impacts as a consequence of identified risks. Finally, by combining the Hierarchy of Risk models and the risk-to-impact-to-control relationship, a method of reverse engineering portfolios of control was discovered. This potentially offers an explanation as to how portfolios of control can be constructed, and why they are essential in ERP implementations.