This paper proposes a research model for defining and measuring information technology outsourcing risks. The model is based on transaction cost and agency theory as well as on IT outsourcing literature. Risk is defined here as a set of triplets composed of scenarios, their likelihood and consequences. It draws on the behavioral perspective, which associates risk with the magnitude of a negative consequence of a decision. A survey is being conducted to test the model.