Continuous risk identification, assessment, tracking, and retirement throughout SDLC.
Install via CLI
openskills install jmagly/ai-writing-guide# risk-cycle
Continuous risk identification, assessment, tracking, and retirement throughout SDLC.
## Triggers
- "risk review"
- "update risks"
- "new risk"
- "risk status"
- "mitigate risk"
- "retire risk"
- "risk cycle"
## Purpose
This skill manages continuous risk management by:
- Identifying new risks from project activities
- Assessing risk severity and probability
- Tracking mitigation progress
- Escalating overdue or critical risks
- Retiring completed risk mitigations
- Generating risk reports for stakeholders
## Behavior
When triggered, this skill:
1. **Reviews current state**:
- Load risk register
- Check mitigation status
- Identify overdue items
2. **Identifies new risks**:
- Analyze recent changes
- Review technical decisions
- Check external factors
- Gather team input
3. **Assesses risks**:
- Score probability and impact
- Calculate risk score
- Prioritize by exposure
4. **Plans mitigations**:
- Assign owners
- Define mitigation actions
- Set target dates
5. **Tracks progress**:
- Update mitigation status
- Escalate overdue items
- Retire completed risks
6. **Reports status**:
- Generate risk dashboard
- Highlight top risks
- Show trend over time
## Risk Categories
### Technical Risks
```yaml
technical_risks:
architecture:
examples:
- Scalability bottleneck
- Single point of failure
- Technology obsolescence
- Integration complexity
indicators:
- Performance degradation
- System failures
- Upgrade difficulties
development:
examples:
- Technical debt accumulation
- Code quality issues
- Testing gaps
- Dependency vulnerabilities
indicators:
- Increasing bug count
- Slower velocity
- Failed deployments
security:
examples:
- Data breach potential
- Authentication weaknesses
- Compliance gaps
- Third-party risks
indicators:
- Security scan findings
- Audit failures
- Incident reports
```
### Project Risks
```yaml
project_risks:
schedule:
examples:
- Scope creep
- Delayed dependencies
- Unrealistic estimates
- Resource constraints
indicators:
- Missed milestones
- Velocity decline
- Scope changes
resource:
examples:
- Key person dependency
- Skill gaps
- Team turnover
- Burnout risk
indicators:
- Unbalanced workload
- Low morale
- Resignation signals
stakeholder:
examples:
- Changing requirements
- Sponsor availability
- Organizational changes
- Competing priorities
indicators:
- Decision delays
- Priority conflicts
- Reduced engagement
```
### External Risks
```yaml
external_risks:
market:
examples:
- Competitor actions
- Market shift
- Economic factors
- Regulatory changes
indicators:
- Market news
- Competitor releases
- Industry reports
vendor:
examples:
- Vendor stability
- API changes
- Price increases
- Support quality
indicators:
- Vendor communications
- Service issues
- Contract terms
compliance:
examples:
- Regulatory requirements
- Industry standards
- Audit requirements
- Data regulations
indicators:
- Regulatory updates
- Audit findings
- Compliance gaps
```
## Risk Assessment Matrix
### Probability Scoring
```yaml
probability:
certain:
score: 5
likelihood: ">90%"
description: "Almost certain to occur"
likely:
score: 4
likelihood: "60-90%"
description: "More likely than not"
possible:
score: 3
likelihood: "30-60%"
description: "Could occur"
unlikely:
score: 2
likelihood: "10-30%"
description: "Not expected but possible"
rare:
score: 1
likelihood: "<10%"
description: "Very unlikely"
```
### Impact Scoring
```yaml
impact:
catastrophic:
score: 5
schedule: ">3 months delay"
cost: ">50% budget"
quality: "Unusable product"
reputation: "Major damage"
major:
score: 4
schedule: "1-3 months delay"
cost: "25-50% budget"
quality: "Significant defects"
reputation: "Serious concern"
moderate:
score: 3
schedule: "2-4 weeks delay"
cost: "10-25% budget"
quality: "Noticeable issues"
reputation: "Some concern"
minor:
score: 2
schedule: "1-2 weeks delay"
cost: "5-10% budget"
quality: "Minor issues"
reputation: "Limited impact"
negligible:
score: 1
schedule: "<1 week delay"
cost: "<5% budget"
quality: "Trivial issues"
reputation: "No impact"
```
### Risk Score Matrix
```
│ Impact
│ 1 2 3 4 5
───────────┼─────────────────────
Prob 5 │ 5 10 15 20 25 ←Critical
4 │ 4 8 12 16 20
3 │ 3 6 9 12 15 ←High
2 │ 2 4 6 8 10
1 │ 1 2 3 4 5 ←Medium
└─────────────────────
↑ ↑
Low Medium
```
```yaml
risk_levels:
critical:
range: [20, 25]
response: "Immediate action required"
escalation: "Executive notification"
high:
range: [12, 19]
response: "Priority mitigation"
escalation: "Manager notification"
medium:
range: [6, 11]
response: "Planned mitigation"
escalation: "Team lead notification"
low:
range: [1, 5]
response: "Monitor and accept"
escalation: "None required"
```
## Risk Register Format
```markdown
# Risk Register
**Project**: [Name]
**Last Updated**: 2025-12-08
**Next Review**: 2025-12-15
## Summary Dashboard
| Risk Level | Count | Trend |
|------------|-------|-------|
| Critical | 1 | ↑ +1 |
| High | 3 | → 0 |
| Medium | 8 | ↓ -2 |
| Low | 12 | → 0 |
| **Total** | **24** | - |
### Risk Trend
```
Week 1: ████████████████████████ 24 risks
Week 2: ██████████████████████ 22 risks
Week 3: ████████████████████████ 24 risks (2 new)
Week 4: ████████████████████████ 24 risks
↑ Stable with critical +1
```
## Active Risks
### RISK-001: Database Scalability [CRITICAL]
| Attribute | Value |
|-----------|-------|
| ID | RISK-001 |
| Title | Database Scalability Bottleneck |
| Category | Technical / Architecture |
| Probability | 4 (Likely) |
| Impact | 5 (Catastrophic) |
| Score | 20 (Critical) |
| Owner | Sarah Chen |
| Status | Mitigating |
**Description**:
Current PostgreSQL single-instance architecture cannot handle projected 10x traffic growth. Performance degradation expected within 6 months.
**Impact if Realized**:
- Service degradation or outage
- Customer churn
- Revenue loss estimated at $500K/month
**Mitigation Plan**:
1. [x] Evaluate sharding options (complete)
2. [x] Design read replica architecture (complete)
3. [ ] Implement connection pooling (in progress, due Dec 15)
4. [ ] Deploy read replicas (planned, due Jan 15)
5. [ ] Implement sharding (planned, due Feb 15)
**Contingency**:
Emergency vertical scaling + temporary traffic limiting
**Progress**:
```
[████████████░░░░░░░░] 60%
```
---
### RISK-002: Key Person Dependency [HIGH]
| Attribute | Value |
|-----------|-------|
| ID | RISK-002 |
| Title | Key Person Dependency on Lead Architect |
| Category | Project / Resource |
| Probability | 3 (Possible) |
| Impact | 4 (Major) |
| Score | 12 (High) |
| Owner | David Kim |
| Status | Mitigating |
**Description**:
Lead architect holds critical system knowledge. No backup identified.
**Mitigation Plan**:
1. [ ] Document architecture decisions (in progress)
2. [ ] Schedule knowledge transfer sessions
3. [ ] Identify and train backup
---
## Recently Retired Risks
### RISK-012: Third-Party API Stability [RETIRED]
- **Retired**: 2025-12-01
- **Original Score**: 12 (High)
- **Mitigation**: Implemented circuit breaker and fallback
- **Outcome**: Risk eliminated through technical solution
---
## Risk Review Actions
### This Week
- [ ] Complete RISK-001 connection pooling
- [ ] Schedule RISK-002 knowledge transfer
- [ ] Review new vendor contract for RISK-008
### Overdue
- ⚠️ RISK-005: Security audit (2 days overdue)
- Owner: Elena Rodriguez
- Escalated to: Team Lead
```
## Usage Examples
### Risk Review
```
User: "Risk review"
Skill executes:
1. Load current risk register
2. Check mitigation status
3. Identify overdue items
4. Prompt for new risks
Output:
"Risk Review Summary
Current Status:
- Critical: 1 (RISK-001: DB Scalability) ← Action needed
- High: 3
- Medium: 8
- Low: 12
Mitigation Progress:
✅ RISK-001: 60% complete (on track)
✅ RISK-002: 40% complete (on track)
⚠️ RISK-005: Security audit 2 days overdue
Top Priority:
RISK-001 needs connection pooling by Dec 15
Questions:
1. Any new risks identified this week?
2. Update on RISK-005 delay?"
```
### Add New Risk
```
User: "New risk: vendor pricing increase"
Skill guides:
1. Capture risk details
2. Assess probability/impact
3. Add to register
Output:
"Adding New Risk
Let me capture the details:
**Title**: Vendor Pricing Increase
**Category**: External / Vendor
Assessment Questions:
1. How likely is this? (1-5)
2. What's the potential impact? (1-5)
3. When might this occur?
4. Who should own mitigation?
Or say 'quick add' to use defaults."
```
### Mitigate Risk
```
User: "Mitigate RISK-002"
Skill guides:
1. Review current mitigation plan
2. Update progress
3. Adjust actions if needed
Output:
"RISK-002: Key Person Dependency
Current Mitigation Plan:
1. [ ] Document architecture decisions (in progress)
2. [ ] Schedule knowledge transfer sessions
3. [ ] Identify and train backup
Current Progress: 40%
What would you like to update?
1. Mark task complete
2. Add new mitigation action
3. Adjust timeline
4. Escalate issue"
```
### Retire Risk
```
User: "Retire RISK-012"
Skill processes:
1. Verify mitigation complete
2. Document outcome
3. Move to retired list
Output:
"Retiring RISK-012: Third-Party API Stability
Verification:
- Circuit breaker: ✅ Implemented
- Fallback mechanism: ✅ Tested
- Monitoring: ✅ Active
Outcome Documentation:
Risk eliminated through technical solution.
No incidents since mitigation deployed (30 days).
✅ RISK-012 moved to retired risks.
Risk count: 24 → 23"
```
## Integration
This skill uses:
- `project-awareness`: Current phase and activity context
- `artifact-metadata`: Track risk artifact versions
- `decision-support`: Complex risk decisions
## Agent Orchestration
```yaml
agents:
risk_assessment:
agent: project-manager
focus: Project risk evaluation
technical_analysis:
agent: architecture-designer
focus: Technical risk assessment
condition: risk_category == "technical"
security_assessment:
agent: security-architect
focus: Security risk evaluation
condition: risk_category == "security"
```
## Configuration
### Review Schedule
```yaml
review_schedule:
weekly:
day: "Monday"
time: "10:00"
scope: active_risks
monthly:
day: 1
scope: full_register
phase_gate:
trigger: gate_check
scope: blocking_risks
```
### Escalation Rules
```yaml
escalation:
overdue:
threshold: 2_days
notify: owner_manager
critical_new:
threshold: score >= 20
notify: [project_manager, sponsor]
trend_increase:
threshold: 3_consecutive_increases
notify: project_manager
```
## Output Locations
- Risk register: `.aiwg/risks/risk-register.md`
- Risk reports: `.aiwg/risks/reports/`
- Retired risks: `.aiwg/risks/retired/`
- Risk trends: `.aiwg/risks/trends/`
## References
- Risk templates: templates/management/risk-*.md
- Risk matrix: docs/risk-assessment-matrix.md
- Escalation procedures: docs/risk-escalation.md
No comments yet. Be the first to comment!