6.8 KiB
6.8 KiB
| name | description |
|---|---|
| risk-register-builder | Build structured risk registers for transactions, projects, and operations. Use this skill when a user mentions risk register, risk assessment, risk matrix, risk log, project risks, transaction risks, deal risks, risk identification, risk mitigation, risk appetite, risk scoring, or needs to catalog and prioritize risks. Also trigger when users are preparing for an investment committee, board meeting, or project review where risks need to be formally documented. This skill is for deal/transaction/project risk registers, not IT/cybersecurity risk frameworks (use GRC-specific skills for those). |
Risk Register Builder
Build structured risk registers for transactions, projects, and operational contexts. Generates categorized risks with likelihood/impact scoring, assigns ownership, defines mitigation actions, and produces a visual risk matrix.
When to Use
- You are preparing a risk assessment for a deal or project
- You need to document risks for an investment committee or board meeting
- You are building a risk register template for ongoing monitoring
- You need to prioritize risks and assign mitigation actions
- You are reviewing a portfolio of risks across multiple projects or deals
Input Requirements
Ask the user for:
- Context — what is the risk register for (M&A transaction, infrastructure project, fund launch, regulatory change, operational initiative)
- Scope — what phases or areas should be covered
- Risk appetite — any thresholds or tolerance levels already defined
- Known risks — risks the user has already identified
- Stakeholders — who owns risk mitigation
Risk Categories
Generate risks across these categories (adapt to context):
Transaction / Deal Risks
- Commercial: Market conditions, customer concentration, competitive dynamics, revenue sustainability
- Financial: Valuation risk, financing risk, working capital, hidden liabilities, earnout disputes
- Legal: Pending litigation, regulatory compliance gaps, contractual obligations, IP disputes
- Operational: Integration risk, key person dependence, technology migration, supply chain
- Regulatory: Antitrust clearance, foreign investment review, licensing, change of law
- Tax: Transfer pricing, withholding, stamp duty, structure optimization risk
- Reputational: ESG concerns, adverse media, stakeholder opposition
Project / Infrastructure Risks
- Scope: Requirements creep, design changes, unforeseen conditions
- Schedule: Delays, permitting timeline, weather, resource availability
- Cost: Material price escalation, change orders, claims, currency fluctuation
- Quality: Defects, rework, specification non-compliance
- Safety: Workplace incidents, environmental incidents
- Stakeholder: Community opposition, political changes, regulatory delays
- Contractual: Disputes, contractor performance, subcontractor default
Operational Risks
- People: Key person risk, succession, recruitment, retention
- Process: Single points of failure, manual processes, scalability
- Technology: System outages, cybersecurity, data integrity, vendor lock-in
- Compliance: Regulatory changes, reporting failures, audit findings
- Financial: Cash flow, credit risk, currency, counterparty default
Scoring Methodology
Likelihood Scale
| Score | Level | Description |
|---|---|---|
| 1 | Rare | <5% probability; would be exceptional |
| 2 | Unlikely | 5-20% probability; has happened elsewhere but not expected here |
| 3 | Possible | 20-50% probability; could occur given current conditions |
| 4 | Likely | 50-80% probability; expected to occur without mitigation |
| 5 | Almost Certain | >80% probability; will occur unless actively prevented |
Impact Scale
| Score | Level | Financial Impact | Operational Impact | Reputational Impact |
|---|---|---|---|---|
| 1 | Negligible | <$50K or <1% of value | Minor inconvenience | No external attention |
| 2 | Minor | $50K-$500K or 1-5% | Some disruption, recoverable in days | Limited local attention |
| 3 | Moderate | $500K-$5M or 5-15% | Significant disruption, weeks to recover | Industry/media attention |
| 4 | Major | $5M-$50M or 15-30% | Severe disruption, months to recover | National attention, regulator interest |
| 5 | Critical | >$50M or >30% | Existential threat | Sustained public scrutiny, regulatory action |
Risk Score
Risk Score = Likelihood × Impact
| Score Range | Risk Level | Action Required |
|---|---|---|
| 1-4 | LOW | Monitor; accept within risk appetite |
| 5-9 | MEDIUM | Mitigate; assign owner and timeline |
| 10-15 | HIGH | Escalate; active mitigation plan required |
| 16-25 | CRITICAL | Immediate action; executive/board attention |
Output Format
# Risk Register: [Project/Transaction Name]
## Summary
- **Date:** [date]
- **Prepared by:** [name]
- **Total risks identified:** [n]
- **Critical:** [n] | **High:** [n] | **Medium:** [n] | **Low:** [n]
## Risk Matrix
| | Negligible (1) | Minor (2) | Moderate (3) | Major (4) | Critical (5) |
|--|---------------|-----------|-------------|-----------|-------------|
| **Almost Certain (5)** | 5 | 10 | 15 | 20 | 25 |
| **Likely (4)** | 4 | 8 | 12 | 16 | 20 |
| **Possible (3)** | 3 | 6 | 9 | 12 | 15 |
| **Unlikely (2)** | 2 | 4 | 6 | 8 | 10 |
| **Rare (1)** | 1 | 2 | 3 | 4 | 5 |
[Place risk IDs in the appropriate cells]
## Risk Register
| ID | Category | Risk Description | L | I | Score | Level | Owner | Mitigation | Target Date | Residual Score |
|----|----------|-----------------|---|---|-------|-------|-------|-----------|------------|---------------|
| R01 | [cat] | [description] | [1-5] | [1-5] | [LxI] | [level] | [name] | [action] | [date] | [score] |
## Top Risks (Detailed)
### R[xx]: [Risk Title] — [CRITICAL/HIGH]
- **Description:** [Full description of the risk]
- **Root cause:** [What could cause this risk to materialize]
- **Impact scenario:** [What happens if it materializes]
- **Current controls:** [Existing mitigation already in place]
- **Additional mitigation:** [Proposed actions]
- **Owner:** [Name/role]
- **Timeline:** [By when must mitigation be in place]
- **Residual risk:** [Score after mitigation]
- **Monitoring indicator:** [How will we know if the risk is materializing]
Important Notes
- Risk registers are living documents. Review and update at regular intervals and whenever material circumstances change.
- For adversarial verification of risk assessments — challenging whether stated mitigations are real, whether likelihood estimates are supported by evidence, and whether risks have been deliberately understated — see DiligenceWorks.