This paper reports the results of a study of three successive IT outsourcing contracts at British Petroleum (BP). We offer an operational definition of IT outsourcing risk and use it to assess the risk exposure associated with each contract. We then examine how the management at BP dealt with outsourcing risk. Our results show that careful and deliberate risk management can substantially attenuate the level of risk exposure, and that IT outsourcing risks can be managed.