Purpose: This paper aims to examine contracts in public jurisdictions to compare academic theories related to outsourcing risks and risk management strategies to current practice in order to extend and refine theory concerning what risk management strategies can, or should, be included in outsourcing contracts.

Design/methodology/approach: An automated content analysis tool is used to rigorously compare contract documents in two public jurisdictions to a comprehensive outsourcing risk framework from previous research.

Findings: The findings indicate that although IS outsourcing risk factors are widely acknowledged in the literature, they are not fully specified in the outsourcing contracts that are implemented in some public organizations. This research surfaces some of the differences in the techniques implemented through actual contracts to manage the risks inherent in IS outsourcing, including some strategies not previously identified in the literature. Also, not all risks need to be addressed in the contract to have a successful outsourcing engagement.

Practical implications: The improved framework for thinking about risk management strategies in the contracting process shown within the paper can provide important ideas and insights for managers contemplating or renewing outsourcing engagements.

Originality/value: This paper uses content analysis to rigorously compare academic theory to actual practice to extend theory. Specifically, it discovers several risk management strategies that have not been presented in previous research.