| name | riskmgmt - Risk Management |
| description | Identify, assess, mitigate, and monitor risks throughout the system lifecycle. Produces a risk register, risk matrix, and risk mitigation plan with triggers and contingencies. |
| output | {"format":"table"} |
Risk Management
Input: $ARGUMENTS
Interpretations
Before executing, identify which interpretation matches the user's input:
Interpretation 1 — Identify and assess risks for a new project or system: The user is starting a project and wants to systematically surface all risks — technical, schedule, cost, and programmatic — and build a risk management plan.
Interpretation 2 — Reassess risks for an ongoing project: The user has an existing risk register and wants to update it — re-evaluate likelihoods, retire closed risks, identify new risks that have emerged, and check mitigation effectiveness.
Interpretation 3 — Develop mitigation strategy for specific identified risks: The user has a known risk or set of risks and wants detailed mitigation plans, contingencies, and trigger definitions.
If ambiguous, ask: "I can help with identifying risks for a new project, reassessing risks on an ongoing project, or developing mitigation plans for specific risks — which fits?"
If clear from context, proceed with the matching interpretation.
Depth Scaling
Default: 2x. Parse depth from $ARGUMENTS if specified (e.g., "/riskmgmt 4x [input]").
| Depth | Min Risks Identified | Min Risk Categories | Min Mitigations | Min Triggers Defined |
|---|
| 1x | 8 | 3 | 5 | 3 |
| 2x | 15 | 5 | 10 | 8 |
| 4x | 30 | 6 | 20 | 15 |
| 8x | 50 | 8 | 35 | 25 |
| 16x | 80 | 10 | 50 | 40 |
The Process
Step 1: Risk Identification
Systematically surface risks across all categories:
RISK IDENTIFICATION BY CATEGORY:
TECHNICAL RISKS:
| ID | Risk | Description | Source |
|----|------|-------------|--------|
| TR-001 | [risk name] | [what could go wrong] | [how we identified it] |
...
SCHEDULE RISKS:
| ID | Risk | Description | Source |
|----|------|-------------|--------|
| SR-001 | [risk name] | [what could go wrong] | [how we identified it] |
...
COST RISKS:
| ID | Risk | Description | Source |
|----|------|-------------|--------|
| CR-001 | [risk name] | [what could go wrong] | [how we identified it] |
...
PROGRAMMATIC RISKS:
| ID | Risk | Description | Source |
|----|------|-------------|--------|
| PR-001 | [risk name] | [what could go wrong] | [how we identified it] |
...
EXTERNAL RISKS:
| ID | Risk | Description | Source |
|----|------|-------------|--------|
| ER-001 | [risk name] | [what could go wrong] | [how we identified it] |
...
RISK IDENTIFICATION PROMPTS:
| Prompt | Risks Found? |
|--------|-------------|
| "What technology are we using for the first time?" | |
| "What has the longest lead time?" | |
| "What depends on a single person or vendor?" | |
| "What has we estimated but never measured?" | |
| "What assumption would hurt most if wrong?" | |
| "What interface is least well-defined?" | |
| "What requirement is most likely to change?" | |
| "What's the most complex part of the system?" | |
| "What has failed on similar projects?" | |
| "What external event would disrupt this project?" | |
| "Where do we have the least expertise?" | |
| "What's the biggest unknown unknown we can imagine?" | |
Step 2: Risk Assessment
Rate each risk on likelihood and impact:
LIKELIHOOD SCALE:
| Level | Label | Probability | Description |
|-------|-------|-------------|-------------|
| 5 | Near Certain | >80% | Expected to occur |
| 4 | Likely | 60-80% | Will probably occur |
| 3 | Possible | 40-60% | May occur |
| 2 | Unlikely | 20-40% | Could occur but not expected |
| 1 | Rare | <20% | Very unlikely to occur |
IMPACT SCALE:
| Level | Technical | Schedule | Cost | Description |
|-------|-----------|----------|------|-------------|
| 5 | System failure / mission loss | >6 month delay | >50% budget overrun | Catastrophic |
| 4 | Major performance degradation | 3-6 month delay | 25-50% budget overrun | Critical |
| 3 | Moderate performance reduction | 1-3 month delay | 10-25% budget overrun | Significant |
| 2 | Minor performance impact | 2-4 week delay | 5-10% budget overrun | Marginal |
| 1 | Negligible impact | <2 week delay | <5% budget overrun | Negligible |
RISK MATRIX:
IMPACT
1 2 3 4 5
LIKELIHOOD 5 | 5 | 10 | 15 | 20 | 25 |
4 | 4 | 8 | 12 | 16 | 20 |
3 | 3 | 6 | 9 | 12 | 15 |
2 | 2 | 4 | 6 | 8 | 10 |
1 | 1 | 2 | 3 | 4 | 5 |
RISK LEVELS:
- CRITICAL (20-25): Immediate action required, escalate to leadership
- HIGH (12-16): Mitigation plan required, active monitoring
- MEDIUM (6-10): Mitigation planned, periodic monitoring
- LOW (1-5): Accept or monitor, no active mitigation required
Step 3: Risk Register
Consolidate all risks into a single register:
RISK REGISTER:
| Risk ID | Risk Title | Category | Likelihood (1-5) | Impact (1-5) | Risk Score | Level | Owner | Status |
|---------|-----------|----------|------------------|-------------|------------|-------|-------|--------|
| TR-001 | [title] | Technical | [L] | [I] | [LxI] | CRIT/HIGH/MED/LOW | [person] | OPEN/MITIGATING/WATCHING/CLOSED |
| SR-001 | [title] | Schedule | [L] | [I] | [LxI] | CRIT/HIGH/MED/LOW | [person] | OPEN/MITIGATING/WATCHING/CLOSED |
...
RISK DISTRIBUTION:
| Level | Count | Percentage |
|-------|-------|-----------|
| CRITICAL | [N] | [%] |
| HIGH | [N] | [%] |
| MEDIUM | [N] | [%] |
| LOW | [N] | [%] |
Step 4: Mitigation Strategy
For each HIGH and CRITICAL risk, define a mitigation approach:
MITIGATION STRATEGIES:
STRATEGY TYPES:
- AVOID: Eliminate the risk by changing the approach
- TRANSFER: Shift the risk to another party (insurance, subcontract, etc.)
- MITIGATE: Reduce likelihood and/or impact through specific actions
- ACCEPT: Acknowledge the risk and prepare contingency
MITIGATION PLAN:
RISK: [Risk ID] — [Risk Title]
STRATEGY: AVOID / TRANSFER / MITIGATE / ACCEPT
OWNER: [person]
MITIGATION ACTIONS:
| # | Action | Reduces | Responsible | Due Date | Status | Cost |
|---|--------|---------|------------|----------|--------|------|
| 1 | [specific action] | Likelihood / Impact / Both | [person] | [date] | NOT STARTED/IN PROGRESS/COMPLETE | [cost] |
| 2 | [specific action] | Likelihood / Impact / Both | [person] | [date] | NOT STARTED/IN PROGRESS/COMPLETE | [cost] |
...
RESIDUAL RISK AFTER MITIGATION:
| Parameter | Before | After |
|-----------|--------|-------|
| Likelihood | [1-5] | [1-5] |
| Impact | [1-5] | [1-5] |
| Risk Score | [LxI] | [LxI] |
| Risk Level | [level] | [level] |
Step 5: Risk Triggers and Contingencies
Define early warning signs and contingency plans:
RISK TRIGGERS AND CONTINGENCIES:
| Risk ID | Trigger | Detection Method | Contingency Plan | Contingency Cost |
|---------|---------|-----------------|-----------------|-----------------|
| TR-001 | [observable sign that risk is materializing] | [how you'll detect it] | [what to do if risk occurs] | [estimated cost] |
| SR-001 | [observable sign] | [detection method] | [contingency] | [cost] |
...
TRIGGER EXAMPLES BY CATEGORY:
- Technical: Prototype fails test, performance below threshold, integration defect rate rising
- Schedule: Milestone slip >1 week, critical path task delayed, resource unavailable
- Cost: Actual spend >10% over plan, vendor price increase, scope creep detected
- External: Regulatory change announced, key vendor acquired, market shift
Step 6: Risk Monitoring Plan
RISK MONITORING:
REVIEW CADENCE:
| Risk Level | Review Frequency | Review Forum | Escalation Path |
|-----------|-----------------|-------------|-----------------|
| CRITICAL | Weekly | Project leadership | Executive sponsor |
| HIGH | Bi-weekly | Project team | Project manager |
| MEDIUM | Monthly | Risk review meeting | Project team lead |
| LOW | Quarterly | Status report | Risk owner |
RISK DASHBOARD METRICS:
| Metric | Current | Trend | Target |
|--------|---------|-------|--------|
| Total open risks | [N] | [↑↓→] | Decreasing over time |
| Critical risks | [N] | [↑↓→] | 0 at delivery |
| Risks mitigated this period | [N] | [↑↓→] | Per plan |
| New risks identified | [N] | [↑↓→] | Decreasing over time |
| Overdue mitigation actions | [N] | [↑↓→] | 0 |
| Risks materialized | [N] | [↑↓→] | Below plan |
TOP RISKS WATCHLIST:
| Rank | Risk ID | Title | Score | Trend | Next Action | Due |
|------|---------|-------|-------|-------|------------|-----|
| 1 | [ID] | [title] | [score] | [↑↓→] | [action] | [date] |
| 2 | [ID] | [title] | [score] | [↑↓→] | [action] | [date] |
...
Output Format
## RISK MANAGEMENT PLAN: [System/Project Name]
### Document Control
Version: [X.Y]
Date: [date]
Status: [DRAFT/REVIEW/APPROVED]
### Risk Identification
[All identified risks by category with descriptions]
### Risk Assessment
[Likelihood and impact scales, risk matrix]
### Risk Register
[Complete risk register with scores, levels, owners, status]
### Mitigation Plans
[Detailed mitigation for each HIGH and CRITICAL risk]
### Triggers and Contingencies
[Early warning triggers, detection methods, contingency plans]
### Monitoring Plan
[Review cadence, dashboard metrics, escalation paths]
### Risk Summary
Total: [N] | Critical: [N] | High: [N] | Medium: [N] | Low: [N]
Top risk: [title and score]
### Open Items
[Risks needing further analysis, pending stakeholder input]
Quality Checklist
Before completing:
Next Steps
After risk management:
- Use
/vv to verify that risk mitigations are effective
- Use
/iface to check high-risk interfaces in detail
- Use
/sysintegration to sequence integration to address highest risks first
- Use
/de to map dependencies between risks and project elements
- Use
/fla to stress-test mitigation plans against failure scenarios
- Use
/configmgmt to baseline risk register and track changes
