04-risk-assessment

name	04-risk-assessment
description	Use when identifying, analysing, treating, and accepting project or system risks with evidence-backed likelihood and impact. Use change-impact-analysis for a proposed change and audit-report for retrospective control findings.
metadata	{"portable":true,"compatible_with":["claude-code","codex"]}

Risk Assessment Skill

Use When

• Use when identifying, analysing, treating, and accepting project or system risks with evidence-backed likelihood and impact. Use change-impact-analysis for a proposed change and audit-report for retrospective control findings.

Do Not Use When

• Do not use when a more specific upstream or downstream skill owns the task, or when the required project context has not been prepared.
• Do not use this skill to fabricate missing project facts, legal conclusions, test results, approvals, or certification claims.

Required Inputs

Artefact	Source or provider	Required?	Missing-input behaviour
Defined system or change scope; asset and process inventory; threat, dependency, and incident evidence; likelihood/impact scales; risk appetite and owners	System owner, risk owner, security, privacy, operations, and business stakeholders	Yes	Stop dependent work; name the missing item, owner, and decision impact. A review check remains not assessed.
Scope, audience, baseline/version, and accountable decision owner	Requester or project context	Yes