Universities are under pressure to justify the time and expense expended by students in obtaining a degree which has stimulated interest in measuring more formally how learning outcomes have been met by students. The 1997 NCHE (Dearing) Report called for improvements in higher education (HE) assessment practice and while assessment is widely regarded as the critical catalyst for student learning it is often in practice relegated to an afterthought. The potential for information and communications technology (ICT) to automate aspects of learning and teaching is widely acknowledged although promised productivity benefits have been slow to appear. Computer-assisted assessment (CAA) is seen by many as one way of meeting these conflicting demands. CAA has considerable potential both to ease the assessment load and to provide innovative and powerful modes of assessment. Moreover, as the use of ICT increases there may be ‘inherent difficulties in teaching and learning online and assessing on paper’. Given the importance of assessment activities in higher education, the level of current interest in CAA and widespread disagreement about how it should be implemented, there is a clear need for rigorous, grounded models of good practice. A national survey of CAA practice was conducted using online tools and interviews with enthusiast and early adopting CAA experts and practitioners throughout the UK which explored the critical factors associated with the uptake and embedding of CAA. A grounded theory analysis of the interview and survey data was carried out and a theory of dual path CAA uptake in universities emerged from which three models of uptake were derived. These were validated against qualitative data obtained from a final set of interviews and by triangulation with survey data from the 2003/4 UK CAA survey. Tutors’ motivations and perceptions of risk influence the way they use CAA and this is significant in credit-bearing applications where non-optimal outcomes have long lasting effects on uptake. Institutions can benefit from using project risk management techniques to manage these risks.