Increasing pressure for quick delivery of IS based business solutions must be seen against increasing evidence that achieving timely value from IS solutions depends on organisational context and is often difficult to achieve. Project and value management methodologies use risk management and governance as the tools to control the relationship between the project and its organisational environment. However, these tools are not informed by the literature on organisational theory, and so only allow an ad hoc treatment of problems. In particular, there is no conceptualisation of the dynamics of risk removal or containment, and limited opportunity to understand how the same risks might impact different projects within an organisation. The contribution of this paper, therefore, is to provide a model of the dynamics between a project and the organisation in which it takes place. Six cases illustrate how the model could be used.