Michel Patry

Outsourcing decisions and contractual arrangements of the type required by an IT outsourcing deal entail risks. This is not to say that outsourcing is bad in itself. It only means that, as in other risky business ventures, such as new product development, capital investments and IS projects, risk assessment and risk management are important contributors to the success of an IT outsourcing venture. This paper focuses on risk assessment. After providing a brief conceptual definition of risk, the paper reviews the empirical literature in order to identify the main undesirable outcomes that may result from an IT outsourcing deal. It then uses transaction cost and agency theory as a primary theoretical basis, and proposes a framework for categorizing risk factors which have been identified in the literature. Finally, the paper discusses the dynamics of risk by examining how the various risk factors are linked to the undesirable outcomes.

This paper takes stock from several studies on Information Technology outsourcing risk. A definition of risk is offered, and an illustration from five case studies is used to show how risk can be managed. Results show that an active risk management approach can reduce risk exposure substantially while enabling the organizations to still reap the benefits associated with outsourcing.