legal-risk-scoring

name	legal-risk-scoring
description	Score and classify legal risks on a severity-times-likelihood matrix, assign GREEN/YELLOW/ORANGE/RED ratings, document findings in structured memos, and determine escalation paths. Use when scoring contract exposure, evaluating deal risk, rating legal issues by severity and probability, deciding whether to involve senior counsel or outside lawyers, or building a legal risk register.

Scoring Model

Two-Axis Evaluation Grid

Every legal risk is measured across two independent axes:

Impact Magnitude (consequences if the risk becomes reality):

Rating	Descriptor	Meaning
1	Trivial	Minimal disruption; no meaningful financial, operational, or reputational consequence. Absorbed within day-to-day operations.
2	Minor	Contained impact; financial exposure under 1% of the relevant contract or transaction value; brief operational hiccup; no public visibility.
3	Substantial	Tangible impact; financial exposure in the 1-5% range of relevant value; noticeable operational interference; possibility of limited external attention.
4	Serious	Major impact; financial exposure between 5-25% of relevant value; significant operational disruption; probable public scrutiny; potential for regulatory interest.
5	Severe	Existential-level impact; financial exposure exceeding 25% of relevant value; core business operations threatened; material reputational harm; regulatory action anticipated; potential personal exposure for directors and officers.

Occurrence Probability (how likely the risk is to materialize):

Rating	Descriptor	Meaning
1	Negligible	Essentially theoretical; no known precedent in comparable situations; would demand extraordinary circumstances.
2	Low	Conceivable but not anticipated; sparse precedent; requires specific precipitating events.
3	Moderate	Plausible; some analogous situations have materialized; precipitating conditions are foreseeable.
4	Elevated	Expected to happen; clear precedent exists; precipitating conditions are commonplace in analogous contexts.
5	Near Certain	Virtually guaranteed; strong historical pattern; precipitating conditions are already present or imminent.

Computing the Score

Risk Score = Impact Magnitude x Occurrence Probability

Score Band	Category	Indicator
1-4	Baseline Risk	GREEN
5-9	Intermediate Risk	YELLOW
10-15	Elevated Risk	ORANGE
16-25	Acute Risk	RED

Visual Grid

                     OCCURRENCE PROBABILITY
               Negligible  Low   Moderate  Elevated  Near Certain
                  (1)      (2)     (3)       (4)        (5)
IMPACT
Severe    (5) |   5    |   10   |   15   |   20   |     25     |
Serious   (4) |   4    |    8   |   12   |   16   |     20     |
Substantial(3)|   3    |    6   |    9   |   12   |     15     |
Minor     (2) |   2    |    4   |    6   |    8   |     10     |
Trivial   (1) |   1    |    2   |    3   |    4   |      5     |

Category Profiles and Response Protocols

GREEN -- Baseline Risk (Score 1-4)

Profile:

• Low-consequence issues with negligible probability
• Routine operational risks with well-established controls already in place
• Familiar risk patterns that the organization regularly manages

Protocol:

• Accept: Proceed with existing controls in place
• Log: Enter into the risk register for ongoing visibility
• Periodic check: Revisit during quarterly or annual review cycles
• No escalation: The responsible team member manages independently

Typical scenarios:

• Vendor agreement with a small deviation from preferred terms in a non-material area
• Standard confidentiality agreement with a reputable counterparty in a familiar jurisdiction
• Routine administrative compliance task with a clear owner and deadline

YELLOW -- Intermediate Risk (Score 5-9)

Profile:

• Issues of moderate consequence that could arise under realistic conditions
• Risks deserving active attention without requiring emergency response
• Situations where precedent provides a management roadmap

Protocol:

• Reduce exposure: Deploy targeted controls or negotiate improved terms
• Active surveillance: Review monthly or upon occurrence of defined trigger events
• Thorough documentation: Capture the risk, all mitigation steps, and decision rationale in the register
• Designated owner: A specific individual holds accountability for tracking and mitigation
• Stakeholder communication: Relevant business contacts are informed of the risk and the mitigation approach
• Escalation triggers: Define specific conditions that would push this risk to a higher category

Typical scenarios:

• Agreement with a liability ceiling below the preferred level but within a negotiable range
• Vendor processing personal data in a territory with uncertain adequacy status
• Regulatory development that may affect a business line over the medium term
• IP provision that is broader than optimal but consistent with market practice

ORANGE -- Elevated Risk (Score 10-15)

Profile:

• Weighty issues with a realistic chance of materializing
• Risks capable of producing significant financial, operational, or public-facing harm
• Situations demanding senior-level attention and structured mitigation

Protocol:

• Senior counsel involvement: Brief the head of legal or designated senior attorney
• Structured mitigation plan: Build a concrete, time-bound plan to reduce the risk
• Leadership awareness: Ensure relevant business leaders understand the risk and the recommended path
• Frequent review: Weekly check-ins or milestone-based reassessment
• External counsel assessment: Engage outside specialists for domain-specific guidance as warranted
• Detailed written analysis: Produce a full risk memorandum covering analysis, alternatives, and recommendations
• Contingency planning: Define the response playbook if the risk materializes

Typical scenarios:

• Agreement containing uncapped indemnification in a material obligation area
• Data processing operation that may violate regulatory requirements without restructuring
• Credible litigation threat from a significant counterparty
• Intellectual property infringement allegation with a plausible basis
• Formal regulatory inquiry or audit notification

RED -- Acute Risk (Score 16-25)

Profile:

• The most consequential issues, with high or near-certain probability of materializing
• Risks that threaten fundamental business viability, expose officers and directors, or endanger key stakeholders
• Demands immediate executive engagement and rapid mobilization

Protocol:

• Immediate executive briefing: Notify General Counsel, C-suite, and Board as the situation warrants
• Outside counsel retention: Engage specialized external lawyers without delay
• Dedicated response team: Stand up a cross-functional team with clearly defined roles and authority
• Insurance notification: Alert carriers where coverage may apply
• Crisis protocols: Activate crisis management procedures when reputational exposure exists
• Evidence preservation: Institute a litigation hold if legal proceedings are a possibility
• Continuous monitoring: Daily or more frequent status reviews until resolved or downgraded
• Board-level reporting: Include in governance risk reporting as appropriate
• Regulatory communication: File any mandatory regulatory notifications

Typical scenarios:

• Pending litigation with substantial financial exposure
• Personal data breach affecting regulated information
• Active regulatory enforcement proceeding
• Material breach of or against the organization under a significant contract
• Government investigation
• Infringement claim targeting a core product or revenue-generating service

Formal Documentation Standards

Risk Assessment Memorandum

Every formal evaluation should follow this structure:

## Legal Risk Evaluation

**Prepared**: [date]
**Analyst**: [name of person conducting the evaluation]
**Subject**: [description of the matter under review]
**Privilege designation**: [Yes/No -- mark as attorney-client privileged where applicable]

### 1. Risk Statement
[Precise, concise articulation of the legal risk]

### 2. Factual Background
[Relevant facts, chronology, and business context]

### 3. Scoring Analysis

#### Impact Magnitude: [1-5] - [Descriptor]
[Supporting rationale including potential financial exposure, operational consequences, and reputational dimensions]

#### Occurrence Probability: [1-5] - [Descriptor]
[Supporting rationale including precedent, triggering conditions, and current circumstances]

#### Composite Score: [Number] - [GREEN/YELLOW/ORANGE/RED]

### 4. Aggravating Factors
[Elements that amplify the risk]

### 5. Countervailing Factors
[Elements that dampen the risk or contain exposure]

### 6. Mitigation Alternatives

| Alternative | Effectiveness | Resource Demand | Recommended? |
|---|---|---|---|
| [Option A] | [High/Med/Low] | [High/Med/Low] | [Yes/No] |
| [Option B] | [High/Med/Low] | [High/Med/Low] | [Yes/No] |

### 7. Recommended Course of Action
[Specific recommendation with supporting rationale]

### 8. Post-Mitigation Risk Level
[Projected risk category after implementing recommended measures]

### 9. Ongoing Monitoring Plan
[Frequency and method of review; conditions that would trigger reassessment]

### 10. Immediate Next Steps
1. [Task - Responsible party - Due date]
2. [Task - Responsible party - Due date]

Risk Register Format

For entry into the team's centralized risk tracker:

Field	Content
Identifier	Unique tracking code
Discovery Date	When the risk first came to light
Summary	Brief characterization
Domain	Contract / Regulatory / Litigation / IP / Data Privacy / Employment / Corporate / Other
Impact Rating	1-5 with descriptor
Probability Rating	1-5 with descriptor
Composite Score	Calculated value
Category	GREEN / YELLOW / ORANGE / RED
Accountable Person	Individual responsible for monitoring
Active Controls	Mitigations currently deployed
Disposition	Open / Mitigated / Accepted / Closed
Next Review	Scheduled reassessment date
Remarks	Supplementary context

Criteria for Engaging Outside Counsel

Situations Requiring External Representation

• Filed litigation: Any lawsuit brought by or against the organization
• Government proceedings: Any inquiry from a regulatory agency, government body, or law enforcement
• Criminal risk: Any scenario involving potential criminal liability for the entity or its people
• Capital markets implications: Any matter that could affect securities disclosures or regulatory filings
• Governance-level matters: Any issue necessitating board notification or board-level approval

Situations Strongly Favoring External Engagement

• Uncharted legal territory: Questions lacking settled authority where the organization's position could establish precedent
• Multi-jurisdictional complexity: Matters spanning unfamiliar or conflicting legal regimes
• Outsized financial stakes: Exposure exceeding the organization's defined risk appetite thresholds
• Specialist knowledge gaps: Subject areas not covered by in-house expertise (antitrust, anti-corruption, patent prosecution, etc.)
• Major regulatory shifts: New legal frameworks that require compliance program construction or significant adaptation
• Strategic transactions: Mergers, acquisitions, or major deals requiring diligence, structuring, and regulatory clearance

Situations Worth Evaluating for External Support

• Significant contractual disputes: Substantial disagreements over interpretation with important business partners
• Workforce claims: Actual or threatened claims involving discrimination, harassment, wrongful termination, or retaliation
• Data security events: Incidents that may trigger mandatory notification duties
• IP conflicts: Infringement allegations (inbound or outbound) involving material products or services
• Coverage disagreements: Disputes with insurance carriers over claim coverage

Selecting the Right Firm

When recommending outside engagement, prompt the user to weigh:

• Subject matter depth and track record
• Familiarity with the relevant jurisdiction
• Industry sector experience
• Conflict clearance status
• Fee structure expectations (hourly, flat, blended, contingency)
• Firm diversity commitments
• Pre-existing relationships (panel membership, prior engagements)