Add skills/risk-register-builder/SKILL.md

skills/risk-register-builder/SKILL.md

@@ -0,0 +1,152 @@
+---
+name: risk-register-builder
+description: >
+  Build structured risk registers for transactions, projects, and operations.
+  Use this skill when a user mentions risk register, risk assessment, risk matrix,
+  risk log, project risks, transaction risks, deal risks, risk identification,
+  risk mitigation, risk appetite, risk scoring, or needs to catalog and prioritize
+  risks. Also trigger when users are preparing for an investment committee, board
+  meeting, or project review where risks need to be formally documented. This skill
+  is for deal/transaction/project risk registers, not IT/cybersecurity risk
+  frameworks (use GRC-specific skills for those).
+---
+
+# Risk Register Builder
+
+Build structured risk registers for transactions, projects, and operational
+contexts. Generates categorized risks with likelihood/impact scoring, assigns
+ownership, defines mitigation actions, and produces a visual risk matrix.
+
+## When to Use
+
+- You are preparing a risk assessment for a deal or project
+- You need to document risks for an investment committee or board meeting
+- You are building a risk register template for ongoing monitoring
+- You need to prioritize risks and assign mitigation actions
+- You are reviewing a portfolio of risks across multiple projects or deals
+
+## Input Requirements
+
+Ask the user for:
+
+1. **Context** — what is the risk register for (M&A transaction, infrastructure
+   project, fund launch, regulatory change, operational initiative)
+2. **Scope** — what phases or areas should be covered
+3. **Risk appetite** — any thresholds or tolerance levels already defined
+4. **Known risks** — risks the user has already identified
+5. **Stakeholders** — who owns risk mitigation
+
+## Risk Categories
+
+Generate risks across these categories (adapt to context):
+
+### Transaction / Deal Risks
+- **Commercial**: Market conditions, customer concentration, competitive dynamics, revenue sustainability
+- **Financial**: Valuation risk, financing risk, working capital, hidden liabilities, earnout disputes
+- **Legal**: Pending litigation, regulatory compliance gaps, contractual obligations, IP disputes
+- **Operational**: Integration risk, key person dependence, technology migration, supply chain
+- **Regulatory**: Antitrust clearance, foreign investment review, licensing, change of law
+- **Tax**: Transfer pricing, withholding, stamp duty, structure optimization risk
+- **Reputational**: ESG concerns, adverse media, stakeholder opposition
+
+### Project / Infrastructure Risks
+- **Scope**: Requirements creep, design changes, unforeseen conditions
+- **Schedule**: Delays, permitting timeline, weather, resource availability
+- **Cost**: Material price escalation, change orders, claims, currency fluctuation
+- **Quality**: Defects, rework, specification non-compliance
+- **Safety**: Workplace incidents, environmental incidents
+- **Stakeholder**: Community opposition, political changes, regulatory delays
+- **Contractual**: Disputes, contractor performance, subcontractor default
+
+### Operational Risks
+- **People**: Key person risk, succession, recruitment, retention
+- **Process**: Single points of failure, manual processes, scalability
+- **Technology**: System outages, cybersecurity, data integrity, vendor lock-in
+- **Compliance**: Regulatory changes, reporting failures, audit findings
+- **Financial**: Cash flow, credit risk, currency, counterparty default
+
+## Scoring Methodology
+
+### Likelihood Scale
+
+| Score | Level | Description |
+|-------|-------|------------|
+| 1 | Rare | <5% probability; would be exceptional |
+| 2 | Unlikely | 5-20% probability; has happened elsewhere but not expected here |
+| 3 | Possible | 20-50% probability; could occur given current conditions |
+| 4 | Likely | 50-80% probability; expected to occur without mitigation |
+| 5 | Almost Certain | >80% probability; will occur unless actively prevented |
+
+### Impact Scale
+
+| Score | Level | Financial Impact | Operational Impact | Reputational Impact |
+|-------|-------|-----------------|-------------------|-------------------|
+| 1 | Negligible | <$50K or <1% of value | Minor inconvenience | No external attention |
+| 2 | Minor | $50K-$500K or 1-5% | Some disruption, recoverable in days | Limited local attention |
+| 3 | Moderate | $500K-$5M or 5-15% | Significant disruption, weeks to recover | Industry/media attention |
+| 4 | Major | $5M-$50M or 15-30% | Severe disruption, months to recover | National attention, regulator interest |
+| 5 | Critical | >$50M or >30% | Existential threat | Sustained public scrutiny, regulatory action |
+
+### Risk Score
+```
+Risk Score = Likelihood × Impact
+```
+
+| Score Range | Risk Level | Action Required |
+|-------------|-----------|----------------|
+| 1-4 | LOW | Monitor; accept within risk appetite |
+| 5-9 | MEDIUM | Mitigate; assign owner and timeline |
+| 10-15 | HIGH | Escalate; active mitigation plan required |
+| 16-25 | CRITICAL | Immediate action; executive/board attention |
+
+## Output Format
+
+```markdown
+# Risk Register: [Project/Transaction Name]
+
+## Summary
+- **Date:** [date]
+- **Prepared by:** [name]
+- **Total risks identified:** [n]
+- **Critical:** [n] | **High:** [n] | **Medium:** [n] | **Low:** [n]
+
+## Risk Matrix
+
+|  | Negligible (1) | Minor (2) | Moderate (3) | Major (4) | Critical (5) |
+|--|---------------|-----------|-------------|-----------|-------------|
+| **Almost Certain (5)** | 5 | 10 | 15 | 20 | 25 |
+| **Likely (4)** | 4 | 8 | 12 | 16 | 20 |
+| **Possible (3)** | 3 | 6 | 9 | 12 | 15 |
+| **Unlikely (2)** | 2 | 4 | 6 | 8 | 10 |
+| **Rare (1)** | 1 | 2 | 3 | 4 | 5 |
+
+[Place risk IDs in the appropriate cells]
+
+## Risk Register
+
+| ID | Category | Risk Description | L | I | Score | Level | Owner | Mitigation | Target Date | Residual Score |
+|----|----------|-----------------|---|---|-------|-------|-------|-----------|------------|---------------|
+| R01 | [cat] | [description] | [1-5] | [1-5] | [LxI] | [level] | [name] | [action] | [date] | [score] |
+
+## Top Risks (Detailed)
+
+### R[xx]: [Risk Title] — [CRITICAL/HIGH]
+- **Description:** [Full description of the risk]
+- **Root cause:** [What could cause this risk to materialize]
+- **Impact scenario:** [What happens if it materializes]
+- **Current controls:** [Existing mitigation already in place]
+- **Additional mitigation:** [Proposed actions]
+- **Owner:** [Name/role]
+- **Timeline:** [By when must mitigation be in place]
+- **Residual risk:** [Score after mitigation]
+- **Monitoring indicator:** [How will we know if the risk is materializing]
+```
+
+## Important Notes
+
+- Risk registers are living documents. Review and update at regular intervals
+  and whenever material circumstances change.
+- For adversarial verification of risk assessments — challenging whether stated
+  mitigations are real, whether likelihood estimates are supported by evidence,
+  and whether risks have been deliberately understated — see
+  [DiligenceWorks](https://diligenceworks.online).