risk-assessment

name	risk_assessment
description	Assesses market-entry and GTM-execution risk — competitive response, regulatory exposure, channel dependency, timing risk — and rates each by likelihood x impact. Triggers on "리스크는?", "이거 위험한가", "진입 장벽".

Risk Assessment — Market Entry & Execution Risk

Every GTM plan has failure modes beyond "the product doesn't work." This skill names them explicitly so the user decides with eyes open, not after the fact.

Risk Categories (check each)

1. Competitive response — can an incumbent from research/COMPARISON.md copy the differentiator quickly, or price-war the entrant out? Rate how defensible the gap really is.
2. Regulatory/compliance — does this category require licensing, certification, or data-handling compliance that adds time/cost not yet in the GTM plan?
3. Channel dependency — does the GTM plan rely on one channel (a platform, a partner, an algorithm) that could change terms or access unilaterally?
4. Timing risk — is the market trend from research/FINDINGS.md cyclical or durable? Entering on a hype peak carries different risk than entering on a structural shift.
5. Execution risk — does the 90-day plan in gtm/GTM-PLAN.md assume capacity (hiring, budget, partnerships) that isn't yet secured?

Process

1. Read research/COMPARISON.md, research/FINDINGS.md, gtm/GTM-PLAN.md.
2. For each category above, state the specific risk (not the category name itself) and rate:

Rating	Likelihood	Impact
High	>50% chance within horizon	Threatens the core thesis
Medium	20–50%	Delays or narrows the plan
Low	<20%	Manageable friction

3. Compute a risk score = likelihood tier × impact tier (informal, for ranking, not false-precision math).
4. For every High-rated risk, require a mitigation or an explicit acceptance. "We accept this risk because X" is valid — silence is not.

Write to gtm/RISK-ASSESSMENT.md:

---
gtm_ref: gtm/GTM-PLAN.md
created: {ISO-8601}
---

# Risk Assessment

| Risk | Category | Likelihood | Impact | Mitigation / Acceptance |
|---|---|---|---|---|
| {specific risk} | Competitive response | High/Med/Low | High/Med/Low | {...} |
| {specific risk} | Regulatory | ... | ... | ... |
| {specific risk} | Channel dependency | ... | ... | ... |
| {specific risk} | Timing | ... | ... | ... |
| {specific risk} | Execution | ... | ... | ... |

## Highest-Priority Risks (High/High)
1. {risk} — {mitigation or explicit acceptance with reasoning}

## Unmitigated High Risks
{any High/High risk with no mitigation and no explicit acceptance — flag as blocking}

Anti-Rationalization

• "We'll deal with it if it happens" is not a mitigation — it's deferral. Either name the mitigation or explicitly accept the risk with reasoning.
• Rating everything "Medium" to avoid a hard conversation defeats the purpose — force differentiation.
• A regulatory risk dismissed as "probably fine" without checking is a gap, not an assessment.

Evidence

Complete when all 5 categories have at least one named risk, every High/High risk has a stated mitigation or explicit acceptance, and no risk is rated without a one-sentence justification.

Red Flags

• No risks rated High on any axis — likely under-examined, not actually low-risk.
• Mitigation column full of "monitor closely" for every row (non-answer).
• Regulatory category skipped entirely for a category where compliance is known to matter (fintech, health, data-sensitive products).