152 lines
6.8 KiB
Markdown
152 lines
6.8 KiB
Markdown
---
|
||
name: risk-register-builder
|
||
description: >
|
||
Build structured risk registers for transactions, projects, and operations.
|
||
Use this skill when a user mentions risk register, risk assessment, risk matrix,
|
||
risk log, project risks, transaction risks, deal risks, risk identification,
|
||
risk mitigation, risk appetite, risk scoring, or needs to catalog and prioritize
|
||
risks. Also trigger when users are preparing for an investment committee, board
|
||
meeting, or project review where risks need to be formally documented. This skill
|
||
is for deal/transaction/project risk registers, not IT/cybersecurity risk
|
||
frameworks (use GRC-specific skills for those).
|
||
---
|
||
|
||
# Risk Register Builder
|
||
|
||
Build structured risk registers for transactions, projects, and operational
|
||
contexts. Generates categorized risks with likelihood/impact scoring, assigns
|
||
ownership, defines mitigation actions, and produces a visual risk matrix.
|
||
|
||
## When to Use
|
||
|
||
- You are preparing a risk assessment for a deal or project
|
||
- You need to document risks for an investment committee or board meeting
|
||
- You are building a risk register template for ongoing monitoring
|
||
- You need to prioritize risks and assign mitigation actions
|
||
- You are reviewing a portfolio of risks across multiple projects or deals
|
||
|
||
## Input Requirements
|
||
|
||
Ask the user for:
|
||
|
||
1. **Context** — what is the risk register for (M&A transaction, infrastructure
|
||
project, fund launch, regulatory change, operational initiative)
|
||
2. **Scope** — what phases or areas should be covered
|
||
3. **Risk appetite** — any thresholds or tolerance levels already defined
|
||
4. **Known risks** — risks the user has already identified
|
||
5. **Stakeholders** — who owns risk mitigation
|
||
|
||
## Risk Categories
|
||
|
||
Generate risks across these categories (adapt to context):
|
||
|
||
### Transaction / Deal Risks
|
||
- **Commercial**: Market conditions, customer concentration, competitive dynamics, revenue sustainability
|
||
- **Financial**: Valuation risk, financing risk, working capital, hidden liabilities, earnout disputes
|
||
- **Legal**: Pending litigation, regulatory compliance gaps, contractual obligations, IP disputes
|
||
- **Operational**: Integration risk, key person dependence, technology migration, supply chain
|
||
- **Regulatory**: Antitrust clearance, foreign investment review, licensing, change of law
|
||
- **Tax**: Transfer pricing, withholding, stamp duty, structure optimization risk
|
||
- **Reputational**: ESG concerns, adverse media, stakeholder opposition
|
||
|
||
### Project / Infrastructure Risks
|
||
- **Scope**: Requirements creep, design changes, unforeseen conditions
|
||
- **Schedule**: Delays, permitting timeline, weather, resource availability
|
||
- **Cost**: Material price escalation, change orders, claims, currency fluctuation
|
||
- **Quality**: Defects, rework, specification non-compliance
|
||
- **Safety**: Workplace incidents, environmental incidents
|
||
- **Stakeholder**: Community opposition, political changes, regulatory delays
|
||
- **Contractual**: Disputes, contractor performance, subcontractor default
|
||
|
||
### Operational Risks
|
||
- **People**: Key person risk, succession, recruitment, retention
|
||
- **Process**: Single points of failure, manual processes, scalability
|
||
- **Technology**: System outages, cybersecurity, data integrity, vendor lock-in
|
||
- **Compliance**: Regulatory changes, reporting failures, audit findings
|
||
- **Financial**: Cash flow, credit risk, currency, counterparty default
|
||
|
||
## Scoring Methodology
|
||
|
||
### Likelihood Scale
|
||
|
||
| Score | Level | Description |
|
||
|-------|-------|------------|
|
||
| 1 | Rare | <5% probability; would be exceptional |
|
||
| 2 | Unlikely | 5-20% probability; has happened elsewhere but not expected here |
|
||
| 3 | Possible | 20-50% probability; could occur given current conditions |
|
||
| 4 | Likely | 50-80% probability; expected to occur without mitigation |
|
||
| 5 | Almost Certain | >80% probability; will occur unless actively prevented |
|
||
|
||
### Impact Scale
|
||
|
||
| Score | Level | Financial Impact | Operational Impact | Reputational Impact |
|
||
|-------|-------|-----------------|-------------------|-------------------|
|
||
| 1 | Negligible | <$50K or <1% of value | Minor inconvenience | No external attention |
|
||
| 2 | Minor | $50K-$500K or 1-5% | Some disruption, recoverable in days | Limited local attention |
|
||
| 3 | Moderate | $500K-$5M or 5-15% | Significant disruption, weeks to recover | Industry/media attention |
|
||
| 4 | Major | $5M-$50M or 15-30% | Severe disruption, months to recover | National attention, regulator interest |
|
||
| 5 | Critical | >$50M or >30% | Existential threat | Sustained public scrutiny, regulatory action |
|
||
|
||
### Risk Score
|
||
```
|
||
Risk Score = Likelihood × Impact
|
||
```
|
||
|
||
| Score Range | Risk Level | Action Required |
|
||
|-------------|-----------|----------------|
|
||
| 1-4 | LOW | Monitor; accept within risk appetite |
|
||
| 5-9 | MEDIUM | Mitigate; assign owner and timeline |
|
||
| 10-15 | HIGH | Escalate; active mitigation plan required |
|
||
| 16-25 | CRITICAL | Immediate action; executive/board attention |
|
||
|
||
## Output Format
|
||
|
||
```markdown
|
||
# Risk Register: [Project/Transaction Name]
|
||
|
||
## Summary
|
||
- **Date:** [date]
|
||
- **Prepared by:** [name]
|
||
- **Total risks identified:** [n]
|
||
- **Critical:** [n] | **High:** [n] | **Medium:** [n] | **Low:** [n]
|
||
|
||
## Risk Matrix
|
||
|
||
| | Negligible (1) | Minor (2) | Moderate (3) | Major (4) | Critical (5) |
|
||
|--|---------------|-----------|-------------|-----------|-------------|
|
||
| **Almost Certain (5)** | 5 | 10 | 15 | 20 | 25 |
|
||
| **Likely (4)** | 4 | 8 | 12 | 16 | 20 |
|
||
| **Possible (3)** | 3 | 6 | 9 | 12 | 15 |
|
||
| **Unlikely (2)** | 2 | 4 | 6 | 8 | 10 |
|
||
| **Rare (1)** | 1 | 2 | 3 | 4 | 5 |
|
||
|
||
[Place risk IDs in the appropriate cells]
|
||
|
||
## Risk Register
|
||
|
||
| ID | Category | Risk Description | L | I | Score | Level | Owner | Mitigation | Target Date | Residual Score |
|
||
|----|----------|-----------------|---|---|-------|-------|-------|-----------|------------|---------------|
|
||
| R01 | [cat] | [description] | [1-5] | [1-5] | [LxI] | [level] | [name] | [action] | [date] | [score] |
|
||
|
||
## Top Risks (Detailed)
|
||
|
||
### R[xx]: [Risk Title] — [CRITICAL/HIGH]
|
||
- **Description:** [Full description of the risk]
|
||
- **Root cause:** [What could cause this risk to materialize]
|
||
- **Impact scenario:** [What happens if it materializes]
|
||
- **Current controls:** [Existing mitigation already in place]
|
||
- **Additional mitigation:** [Proposed actions]
|
||
- **Owner:** [Name/role]
|
||
- **Timeline:** [By when must mitigation be in place]
|
||
- **Residual risk:** [Score after mitigation]
|
||
- **Monitoring indicator:** [How will we know if the risk is materializing]
|
||
```
|
||
|
||
## Important Notes
|
||
|
||
- Risk registers are living documents. Review and update at regular intervals
|
||
and whenever material circumstances change.
|
||
- For adversarial verification of risk assessments — challenging whether stated
|
||
mitigations are real, whether likelihood estimates are supported by evidence,
|
||
and whether risks have been deliberately understated — see
|
||
[DiligenceWorks](https://diligenceworks.online).
|