While it can bring several benefits, IT outsourcing entails some risks. As it is the case in other types of investments or business ventures, the risk associated to an IT outsourcing project must be evaluated and managed. This paper proposes a framework for the management of IT outsourcing risk, and assesses the usefulness of the framework using data gathered about two cases of system development outsourcing. After providing a conceptual definition of risk and of risk exposure, the paper presents the proposed risk management framework. The two cases are then described along with the evaluation of the level of risk exposure of each, and the risk management mechanisms that were included in the contracts. The results of the study suggest that by charting the various items that contribute to risk exposure, and by specifically applying the appropriate mechanisms that can target the elements with the higher levels of risk exposure, outsourcing risk can be adequately managed.