Risk analysis using risk registers, probability/impact matrices, and mitigation planning. Identifies, assesses, and manages project, business, and technical risks with structured response strategies.
Systematically identify, assess, and manage project, business, and technical risks using risk registers and probability/impact matrices. Use when creating risk registers, evaluating threats and opportunities, or planning mitigation strategies for high-priority risks.
/plugin marketplace add melodic-software/claude-code-plugins/plugin install business-analysis@melodic-softwareThis skill is limited to using the following tools:
Use this skill when:
Systematically identify, assess, and manage risks using risk registers, probability/impact matrices, and structured response planning. Supports project risks, business risks, technical risks, and opportunity management.
Risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on objectives. Risk analysis involves:
| Concept | Definition | Action |
|---|---|---|
| Risk | Potential future event (uncertain) | Plan response |
| Issue | Current problem (certain) | Resolve now |
| Type | Effect | Response Goal |
|---|---|---|
| Threat | Negative impact | Minimize exposure |
| Opportunity | Positive impact | Maximize benefit |
The central repository for all identified risks:
## Risk Register
| ID | Risk Description | Category | Probability | Impact | Score | Owner | Response | Status |
|----|-----------------|----------|-------------|--------|-------|-------|----------|--------|
| R-001 | [Description] | [Category] | H/M/L | H/M/L | [P×I] | [Name] | [Strategy] | Open |
| Field | Description |
|---|---|
| ID | Unique identifier |
| Description | Clear risk statement |
| Category | Type of risk |
| Probability | Likelihood of occurrence |
| Impact | Consequence if it occurs |
| Score | Risk priority (P × I) |
| Owner | Person responsible |
| Response | Planned response strategy |
| Status | Open, Mitigated, Closed, Occurred |
| Category | Examples |
|---|---|
| Technical | Technology failure, integration issues |
| Schedule | Delays, dependencies |
| Cost | Budget overrun, resource costs |
| Resource | Skill gaps, availability |
| External | Vendor, regulatory, market |
| Organizational | Change resistance, priorities |
| Quality | Defects, performance |
| Security | Data breach, unauthorized access |
Probability Scale:
| Level | Score | Description | Likelihood |
|---|---|---|---|
| Very Low | 1 | Rare | < 10% |
| Low | 2 | Unlikely | 10-30% |
| Medium | 3 | Possible | 30-50% |
| High | 4 | Likely | 50-70% |
| Very High | 5 | Almost Certain | > 70% |
Impact Scale:
| Level | Score | Schedule | Cost | Quality |
|---|---|---|---|---|
| Very Low | 1 | < 1 week | < 5% | Minor |
| Low | 2 | 1-2 weeks | 5-10% | Noticeable |
| Medium | 3 | 2-4 weeks | 10-20% | Significant |
| High | 4 | 1-3 months | 20-40% | Major |
| Very High | 5 | > 3 months | > 40% | Critical |
Risk Score = Probability × Impact
Score Range: 1-25
Risk Priority Zones:
| Score | Priority | Action |
|---|---|---|
| 1-4 | Low | Accept or monitor |
| 5-9 | Medium | Active management |
| 10-14 | High | Priority attention |
| 15-25 | Critical | Immediate action |
quadrantChart
title Risk Matrix
x-axis Low Impact --> High Impact
y-axis Low Probability --> High Probability
quadrant-1 Critical
quadrant-2 High Priority
quadrant-3 Low Priority
quadrant-4 Medium Priority
| Strategy | Description | When to Use |
|---|---|---|
| Avoid | Eliminate the threat | High probability and impact |
| Transfer | Shift to third party | Financial/contractual risks |
| Mitigate | Reduce probability or impact | Most common approach |
| Accept | Acknowledge, no action | Low priority risks |
| Strategy | Description | When to Use |
|---|---|---|
| Exploit | Ensure opportunity occurs | High-value opportunities |
| Share | Partner to increase capability | Need external help |
| Enhance | Increase probability or impact | Moderate opportunities |
| Accept | Take advantage if it occurs | Low-effort opportunities |
## Risk Response Plan: R-001
**Risk:** [Description]
**Strategy:** [Avoid/Transfer/Mitigate/Accept]
### Prevention Actions
| Action | Owner | Due Date | Status |
|--------|-------|----------|--------|
| [Preventive measure] | [Name] | [Date] | [Status] |
### Contingency Plan
**Trigger:** [What indicates risk is occurring]
**Actions:**
1. [Contingency action 1]
2. [Contingency action 2]
### Residual Risk
**After mitigation:**
- Probability: [Reduced level]
- Impact: [Reduced level]
- New Score: [Residual score]
Sources for risk identification:
Techniques:
Risk statement format:
"There is a risk that [CONDITION/CAUSE] may result in [CONSEQUENCE/IMPACT]"
Example:
"There is a risk that key developer leaves may result in schedule delay and knowledge loss"
For each risk:
For each risk:
## Risk Assessment Summary
| ID | Risk | P | I | Score | Priority |
|----|------|---|---|-------|----------|
| R-001 | [Risk 1] | 4 | 5 | 20 | Critical |
| R-002 | [Risk 2] | 3 | 3 | 9 | Medium |
| R-003 | [Risk 3] | 2 | 2 | 4 | Low |
For each significant risk:
After planned mitigations:
Regular review cadence:
## Risk Register: [Project/Initiative]
**Date:** [ISO Date]
**Owner:** [Name]
**Review Cycle:** [Weekly/Monthly]
| ID | Risk Description | Category | P | I | Score | Owner | Response | Actions | Status |
|----|-----------------|----------|---|---|-------|-------|----------|---------|--------|
| R-001 | Key developer may leave during critical phase | Resource | 4 | 5 | 20 | PM | Mitigate | Cross-train, document | Open |
| R-002 | Third-party API may have breaking changes | Technical | 3 | 4 | 12 | Tech Lead | Mitigate | Abstraction layer | Open |
| R-003 | Budget approval may be delayed | Cost | 2 | 4 | 8 | Sponsor | Accept | Monitor | Open |
| R-004 | New regulation may require features | External | 2 | 3 | 6 | BA | Accept | Watch | Open |
### Summary
- **Total Risks:** 4
- **Critical (15+):** 1
- **High (10-14):** 1
- **Medium (5-9):** 1
- **Low (1-4):** 1
quadrantChart
title Risk Assessment Matrix
x-axis Low Impact --> High Impact
y-axis Low Probability --> High Probability
quadrant-1 Critical - Immediate Action
quadrant-2 High - Active Management
quadrant-3 Low - Monitor
quadrant-4 Medium - Plan Response
"R-001 Key Dev": [0.9, 0.8]
"R-002 API Changes": [0.7, 0.6]
"R-003 Budget": [0.7, 0.35]
"R-004 Regulation": [0.5, 0.35]
risk_register:
name: "[Project/Initiative]"
version: "1.0"
date: "2025-01-15"
owner: "Project Manager"
review_cycle: "weekly"
risk_appetite:
overall: "moderate"
schedule: "low"
cost: "moderate"
quality: "low"
scales:
probability:
1: "Rare (<10%)"
2: "Unlikely (10-30%)"
3: "Possible (30-50%)"
4: "Likely (50-70%)"
5: "Almost Certain (>70%)"
impact:
1: "Very Low"
2: "Low"
3: "Medium"
4: "High"
5: "Very High"
risks:
- id: "R-001"
description: "Key developer may leave during critical phase"
category: "Resource"
probability: 4
impact: 5
score: 20
priority: "critical"
owner: "Project Manager"
response_strategy: "mitigate"
response_actions:
- action: "Cross-train team member"
owner: "Tech Lead"
due_date: "2025-02-01"
status: "in_progress"
- action: "Document critical knowledge"
owner: "Developer"
due_date: "2025-02-15"
status: "not_started"
contingency:
trigger: "Developer gives notice"
actions:
- "Accelerate knowledge transfer"
- "Engage contractor"
residual_risk:
probability: 3
impact: 3
score: 9
status: "open"
created_date: "2025-01-15"
last_reviewed: "2025-01-15"
summary:
total: 4
by_priority:
critical: 1
high: 1
medium: 1
low: 1
by_status:
open: 4
mitigated: 0
closed: 0
occurred: 0
## Risk Assessment Summary
**Project:** [Name]
**Date:** [ISO Date]
**Assessed By:** risk-analyst
### Risk Profile
| Priority | Count | Top Risk |
|----------|-------|----------|
| Critical | 1 | Key developer leaving |
| High | 1 | Third-party API changes |
| Medium | 1 | Budget approval delay |
| Low | 1 | Regulatory changes |
### Critical Risks Requiring Action
#### R-001: Key Developer Departure
- **Score:** 20 (P:4 × I:5)
- **Response:** Mitigate through cross-training and documentation
- **Target Residual:** 9 (P:3 × I:3)
- **Actions:** 2 in progress, 0 completed
### Risk Trends
| Metric | This Period | Last Period | Trend |
|--------|-------------|-------------|-------|
| Total Risks | 4 | 3 | ↑ |
| Critical | 1 | 0 | ↑ |
| Closed | 0 | 1 | ↓ |
### Recommendations
1. **Immediate:** Accelerate R-001 mitigation actions
2. **This Week:** Complete API abstraction layer design
3. **Monitor:** Watch for regulatory announcements
| Pitfall | Prevention |
|---|---|
| Vague risk descriptions | Use "condition may cause consequence" format |
| Inconsistent scoring | Define and use standard scales |
| No risk owners | Assign owner at identification |
| Stale register | Schedule regular reviews |
| Ignoring opportunities | Include positive risks |
| Over-analysis | Focus on high-priority risks |
| No contingency | Plan for when risks occur |
swot-pestle-analysis - Strategic threats/opportunitiesroot-cause-analysis - When risks occurdecision-analysis - Risk-based decisionsprioritization - Risk prioritizationUse when working with Payload CMS projects (payload.config.ts, collections, fields, hooks, access control, Payload API). Use when debugging validation errors, security issues, relationship queries, transactions, or hook behavior.
Applies Anthropic's official brand colors and typography to any sort of artifact that may benefit from having Anthropic's look-and-feel. Use it when brand colors or style guidelines, visual formatting, or company design standards apply.
Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems. Create original algorithmic art rather than copying existing artists' work to avoid copyright violations.