---
name: risk-assessment
description: "Conducts business risk assessments with likelihood and impact scoring, mitigation strategies, and monitoring plans for proactive risk management."
allowed-tools: Read Write Glob
metadata:
  author: matthewhitcham
  version: "1.0"
---

# Risk Assessment

## When to Use This Skill

Use this skill when you need to:
- Identify and score business risks by likelihood and impact
- Create mitigation strategies for high-priority risks
- Build a risk monitoring plan with early warning indicators
- Prepare for a new venture, product launch, or major business change

**DO NOT** use this skill for financial risk modeling, insurance assessments, or cybersecurity threat analysis. This is for general business risk identification and planning.

---

## Core Principle

RISK MANAGEMENT IS NOT ABOUT ELIMINATING RISK — IT IS ABOUT KNOWING WHICH RISKS ARE WORTH TAKING AND HAVING A PLAN FOR THE ONES THAT COULD KILL YOUR BUSINESS.

---

## Phase 1: Identify

Surface all relevant risks before scoring them.

### Required Inputs

| Input | What to Ask | Default |
|-------|------------|---------|
| **Business context** | "Describe your business and current stage." | No default |
| **Assessment trigger** | "Why now? (new venture, annual review, specific concern)" | Annual review |
| **Revenue model** | "How do you make money? (services, products, subscriptions)" | No default |
| **Dependencies** | "What does your business depend on most? (key clients, platforms, suppliers)" | No default |
| **Known risks** | "What risks are already on your radar?" | No default |

### Risk Categories

Walk through each category to ensure comprehensive coverage:

- **Financial:** Cash flow, revenue concentration, pricing, debt
- **Operational:** Key person dependency, tool failures, process breakdowns
- **Market:** Competition, demand shifts, economic conditions
- **Legal/Compliance:** Contracts, regulations, IP, liability
- **Reputational:** Brand damage, negative reviews, public relations
- **Technology:** Platform dependency, data loss, security

```
## Risk Register

| # | Risk | Category | Description |
|---|------|----------|-------------|
| R1 | [Risk name] | [Category] | [What could happen and how] |
| R2 | [Risk name] | [Category] | [What could happen and how] |
```

**GATE: Confirm the risk register is complete before scoring.**

---

## Phase 2: Score

Assess each risk using likelihood and impact scoring.

### Scoring Matrix

Rate each risk 1-5 on both dimensions:

| Score | Likelihood | Impact |
|-------|-----------|--------|
| 1 | Rare (less than 5% chance) | Negligible (minor inconvenience) |
| 2 | Unlikely (5-20%) | Minor (temporary disruption) |
| 3 | Possible (20-50%) | Moderate (significant effort to recover) |
| 4 | Likely (50-80%) | Major (serious financial or operational damage) |
| 5 | Almost certain (80%+) | Catastrophic (business survival threatened) |

```
## Risk Scoring

| # | Risk | Likelihood | Impact | Risk Score | Priority |
|---|------|-----------|--------|-----------|----------|
| R1 | [Name] | [1-5] | [1-5] | [L x I] | [Critical/High/Medium/Low] |

**Priority thresholds:**
- Critical: 15-25 — Immediate action required
- High: 10-14 — Mitigation plan needed within 30 days
- Medium: 5-9 — Monitor and prepare contingency
- Low: 1-4 — Accept and review quarterly
```

### Risk Heat Map

Present a visual summary:

```
         Impact →
         1    2    3    4    5
    5  | M  | H  | C  | C  | C  |
L   4  | M  | H  | H  | C  | C  |
i   3  | L  | M  | H  | H  | C  |
k   2  | L  | L  | M  | H  | H  |
e   1  | L  | L  | L  | M  | M  |
```

**GATE: Review scored risks before building mitigation plans.**

---

## Phase 3: Mitigate

Create action plans for high and critical risks.

### Mitigation Strategy Template

For each critical and high-priority risk:

```
## Mitigation Plan: [Risk Name]

**Risk score:** [X] (Likelihood [X] x Impact [X])
**Risk owner:** [Name]

**Prevention (reduce likelihood):**
- [Action to prevent the risk from occurring]
- [Action]

**Preparation (reduce impact):**
- [Action to minimize damage if it occurs]
- [Action]

**Response (if it happens):**
1. [Immediate action]
2. [Short-term recovery step]
3. [Long-term recovery step]

**Early warning indicators:**
- [Sign that this risk is becoming more likely]
- [Metric to monitor]

**Review frequency:** [Monthly / Quarterly]
```

### Common Solopreneur Mitigations

| Risk | Common Mitigation |
|------|-------------------|
| Revenue concentration (1-2 big clients) | Diversify: no client should exceed 30% of revenue |
| Key person dependency | Document processes, cross-train, build a contractor bench |
| Platform dependency | Maintain email list, diversify channels, export data regularly |
| Cash flow gaps | Maintain 3-month operating reserve, invoice promptly |

---

## Phase 4: Monitor

Set up ongoing risk monitoring.

### Risk Dashboard

```
## Risk Dashboard — [Quarter/Year]

| Risk | Score | Status | Last Reviewed | Next Review | Owner |
|------|-------|--------|--------------|-------------|-------|
| [Name] | [X] | Stable / Increasing / Decreasing | [Date] | [Date] | [Name] |
```

### Review Cadence

- **Monthly:** Review critical and high risks — any changes in likelihood or impact?
- **Quarterly:** Full risk register review — add new risks, retire resolved ones, re-score
- **After any incident:** Update the affected risk's score and mitigation plan

### Risk Appetite Statement

Help the user define their risk tolerance:

```
**Our risk appetite:**
- We ACCEPT risks scored 1-4 (Low) without active mitigation
- We MITIGATE risks scored 5-14 (Medium-High) with documented plans
- We AVOID or TRANSFER risks scored 15-25 (Critical) — these threaten business survival
```

---

## Anti-Patterns

- **Ignoring low-probability, high-impact risks** — "It will never happen" is not a strategy. Plan for catastrophic risks even if unlikely.
- **Risk register as a one-time exercise** — risks change constantly. A static register is a false sense of security.
- **No risk owner** — unowned risks are unmanaged risks. Every risk needs one accountable person.
- **Mitigation without monitoring** — you cannot know if mitigation is working without tracking indicators.
- **Analysis paralysis** — do not score 50 risks. Focus on the top 10-15 that matter most.

---

## Recovery

- **User cannot identify risks:** Walk through each category with specific prompts: "What happens if your biggest client leaves tomorrow?"
- **Everything scores as critical:** Recalibrate — compare each risk to "business cannot operate tomorrow." Only true existential threats are 5/5.
- **User wants to ignore risks:** Focus on the one risk that scares them most. Getting one mitigation plan in place builds the habit.
- **Risk has already materialized:** Switch to incident response. Document what happened, stabilize, then update the assessment with lessons learned.
- **User is overwhelmed:** Start with the top 3 risks only. A plan for 3 risks is infinitely better than no plan for 20.
