PurposeThis paper reviews and classifies research connecting supply chain risk management (SCRM) and information technology (IT) and derives a structured proposal for fruitful research directions.Design/methodology/approachThe authors conducted a systematic literature review of the interplay of SCRM and IT, drawing from major journals in the relevant fields. These findings are enriched by experiences from a three-year international research project.FindingsCurrent research focuses on the role of IT for risk reduction, rather than for risk identification, analysis and monitoring. While much research has investigated operational supply chain risk, fewer insights into disruption risk are available. There is little research on the role of IT in SCRM beyond its potential to enhance information sharing among supply chain partners. To address these gaps, the paper proposes a two-dimensional framework to categorize IT potential for SCRM according to the source and impact of disruption risk on physical supply chain flows, which suggests promising directions for future research.Originality/valueThe paper offers a systematic review to further our understanding of the relationship of SCRM and IT. In addition, it presents and discusses nine areas for further research aimed at mitigating the gaps identified at the intersection of SCRM and IT.