Purpose -The purpose of the study reported in this paper is to identify, assess and explore potential risks that can affect long-term viability of Enterprise Resource Planning (ERP) systems in the post-implementation and exploitation phase. Design/methodology/approach -The research took a large Chinese private group as a case study. A theoretical ERP risk ontology, which was adopted from the literature, was used to frame the study and generate data collection tools. Two questionnaires were thus designed and used to explore ERP post-implementation risks in the case company. Findings -The study identified 37 risk events, of which seven were identified as the most critical for ERP exploitation in the case company. The findings show that organisational and human-related risks are the crucial factors for potential ERP failure and not the usually suspect technical risks. Research limitations/implications -This study contributes to the knowledge of ERP in general, and provides valuable insights into ERP post-implementation risks in large companies in particular. Practical implications -The findings will not just be useful in supporting ERP risk identification and management in the large Chinese companies, but will also be beneficial to other large companies in general, which may be confronted with similar ERP exploitation challenges. Originality/value -The majority of large companies in China and in the West have implemented ERP systems and engaged in the system post-implementation phase. Most of the existing literature in the field focuses on the process of implementation. This paper looks forward to the risks involved in the post-implementation phase. Understanding potential risks that may occur during ERP exploitation is vital for these large firms to achieve and sustain business success though their ERP systems.