Abstract: This is an empirical study of industry practice in the management of software development risks. As we know, the revolution in information technology (IT) has ushered in significant changes to software engineering practices, as well as IT business models. These happenings have resulted in changes to software risk perception and risk management. While there are numerous studies on software risk, we need a thorough investigation of contemporary Industry practices to build a software risk management model that is practically useful. Based on an investigation of 145 software projects, we propose a model for risk management applicable to non-inhouse projects. We explain the distinctive features of our model in comparison with the existing literature on software risk. The model identifies the key focus areas of software risk management in offshored or outsourced projects in order to achieve the best outcome.