Outsourcing decisions, and contractual arrangements of the type required by an IT outsourcing deal, entail risks. This is not to say that outsourcing is bad in itself. It only means that, as in other risky business ventures such as new product development, capital investments, and IS projects, risk assessment and risk management are important contributors to the success of an IT outsourcing venture. This paper focuses on risk assessment. After providing a brief conceptual definition of risk, the paper reviews the empirical literature in order to identify the0501n undesirable outcomes that may result from an IT outsourcing deal. It then uses transaction cost and agency theory as a primary theoretical basis, and proposes a framework for categorizing risk factors which have been identified in the literature. Finally, the paper discusses the dynamics of risk, by examining how the various risk factors are linked to the undesirable outcomes