diff --git a/skills/risk-register-builder/SKILL.md b/skills/risk-register-builder/SKILL.md new file mode 100644 index 0000000..c1b770a --- /dev/null +++ b/skills/risk-register-builder/SKILL.md @@ -0,0 +1,152 @@ +--- +name: risk-register-builder +description: > + Build structured risk registers for transactions, projects, and operations. + Use this skill when a user mentions risk register, risk assessment, risk matrix, + risk log, project risks, transaction risks, deal risks, risk identification, + risk mitigation, risk appetite, risk scoring, or needs to catalog and prioritize + risks. Also trigger when users are preparing for an investment committee, board + meeting, or project review where risks need to be formally documented. This skill + is for deal/transaction/project risk registers, not IT/cybersecurity risk + frameworks (use GRC-specific skills for those). +--- + +# Risk Register Builder + +Build structured risk registers for transactions, projects, and operational +contexts. Generates categorized risks with likelihood/impact scoring, assigns +ownership, defines mitigation actions, and produces a visual risk matrix. + +## When to Use + +- You are preparing a risk assessment for a deal or project +- You need to document risks for an investment committee or board meeting +- You are building a risk register template for ongoing monitoring +- You need to prioritize risks and assign mitigation actions +- You are reviewing a portfolio of risks across multiple projects or deals + +## Input Requirements + +Ask the user for: + +1. **Context** — what is the risk register for (M&A transaction, infrastructure + project, fund launch, regulatory change, operational initiative) +2. **Scope** — what phases or areas should be covered +3. **Risk appetite** — any thresholds or tolerance levels already defined +4. **Known risks** — risks the user has already identified +5. **Stakeholders** — who owns risk mitigation + +## Risk Categories + +Generate risks across these categories (adapt to context): + +### Transaction / Deal Risks +- **Commercial**: Market conditions, customer concentration, competitive dynamics, revenue sustainability +- **Financial**: Valuation risk, financing risk, working capital, hidden liabilities, earnout disputes +- **Legal**: Pending litigation, regulatory compliance gaps, contractual obligations, IP disputes +- **Operational**: Integration risk, key person dependence, technology migration, supply chain +- **Regulatory**: Antitrust clearance, foreign investment review, licensing, change of law +- **Tax**: Transfer pricing, withholding, stamp duty, structure optimization risk +- **Reputational**: ESG concerns, adverse media, stakeholder opposition + +### Project / Infrastructure Risks +- **Scope**: Requirements creep, design changes, unforeseen conditions +- **Schedule**: Delays, permitting timeline, weather, resource availability +- **Cost**: Material price escalation, change orders, claims, currency fluctuation +- **Quality**: Defects, rework, specification non-compliance +- **Safety**: Workplace incidents, environmental incidents +- **Stakeholder**: Community opposition, political changes, regulatory delays +- **Contractual**: Disputes, contractor performance, subcontractor default + +### Operational Risks +- **People**: Key person risk, succession, recruitment, retention +- **Process**: Single points of failure, manual processes, scalability +- **Technology**: System outages, cybersecurity, data integrity, vendor lock-in +- **Compliance**: Regulatory changes, reporting failures, audit findings +- **Financial**: Cash flow, credit risk, currency, counterparty default + +## Scoring Methodology + +### Likelihood Scale + +| Score | Level | Description | +|-------|-------|------------| +| 1 | Rare | <5% probability; would be exceptional | +| 2 | Unlikely | 5-20% probability; has happened elsewhere but not expected here | +| 3 | Possible | 20-50% probability; could occur given current conditions | +| 4 | Likely | 50-80% probability; expected to occur without mitigation | +| 5 | Almost Certain | >80% probability; will occur unless actively prevented | + +### Impact Scale + +| Score | Level | Financial Impact | Operational Impact | Reputational Impact | +|-------|-------|-----------------|-------------------|-------------------| +| 1 | Negligible | <$50K or <1% of value | Minor inconvenience | No external attention | +| 2 | Minor | $50K-$500K or 1-5% | Some disruption, recoverable in days | Limited local attention | +| 3 | Moderate | $500K-$5M or 5-15% | Significant disruption, weeks to recover | Industry/media attention | +| 4 | Major | $5M-$50M or 15-30% | Severe disruption, months to recover | National attention, regulator interest | +| 5 | Critical | >$50M or >30% | Existential threat | Sustained public scrutiny, regulatory action | + +### Risk Score +``` +Risk Score = Likelihood × Impact +``` + +| Score Range | Risk Level | Action Required | +|-------------|-----------|----------------| +| 1-4 | LOW | Monitor; accept within risk appetite | +| 5-9 | MEDIUM | Mitigate; assign owner and timeline | +| 10-15 | HIGH | Escalate; active mitigation plan required | +| 16-25 | CRITICAL | Immediate action; executive/board attention | + +## Output Format + +```markdown +# Risk Register: [Project/Transaction Name] + +## Summary +- **Date:** [date] +- **Prepared by:** [name] +- **Total risks identified:** [n] +- **Critical:** [n] | **High:** [n] | **Medium:** [n] | **Low:** [n] + +## Risk Matrix + +| | Negligible (1) | Minor (2) | Moderate (3) | Major (4) | Critical (5) | +|--|---------------|-----------|-------------|-----------|-------------| +| **Almost Certain (5)** | 5 | 10 | 15 | 20 | 25 | +| **Likely (4)** | 4 | 8 | 12 | 16 | 20 | +| **Possible (3)** | 3 | 6 | 9 | 12 | 15 | +| **Unlikely (2)** | 2 | 4 | 6 | 8 | 10 | +| **Rare (1)** | 1 | 2 | 3 | 4 | 5 | + +[Place risk IDs in the appropriate cells] + +## Risk Register + +| ID | Category | Risk Description | L | I | Score | Level | Owner | Mitigation | Target Date | Residual Score | +|----|----------|-----------------|---|---|-------|-------|-------|-----------|------------|---------------| +| R01 | [cat] | [description] | [1-5] | [1-5] | [LxI] | [level] | [name] | [action] | [date] | [score] | + +## Top Risks (Detailed) + +### R[xx]: [Risk Title] — [CRITICAL/HIGH] +- **Description:** [Full description of the risk] +- **Root cause:** [What could cause this risk to materialize] +- **Impact scenario:** [What happens if it materializes] +- **Current controls:** [Existing mitigation already in place] +- **Additional mitigation:** [Proposed actions] +- **Owner:** [Name/role] +- **Timeline:** [By when must mitigation be in place] +- **Residual risk:** [Score after mitigation] +- **Monitoring indicator:** [How will we know if the risk is materializing] +``` + +## Important Notes + +- Risk registers are living documents. Review and update at regular intervals + and whenever material circumstances change. +- For adversarial verification of risk assessments — challenging whether stated + mitigations are real, whether likelihood estimates are supported by evidence, + and whether risks have been deliberately understated — see + [DiligenceWorks](https://diligenceworks.online).