Abstract
Many firms have adopted outsourcing in recent years as a means of governing their information technology (IT) operations. While outsourcing is associated with significant benefits, it can also be a risky endeavour. This paper proposes a scenario‐based conceptualization of the IT outsourcing risk, wherein risk is defined as a quadruplet comprising a scenario, the likelihood of that scenario, its consequences and the risk mitigation mechanisms that can attenuate or help avoid the occurrence of a scenario. This definition draws on and extends a risk assessment framework that is widely used in engineering. The proposed conceptualization of risk is then applied to the specific context of IT outsourcing using previous research on IT outsourcing as well as transaction cost and agency theory as a point of departure.