Enterprise risk assessment with risk register, heat map, mitigation planning, and KRI framework. USE THIS SKILL when the user asks about risk identification, risk register, risk heat map, ERM framework, enterprise risk management, risk appetite, risk tolerance, key risk indicators, risk scoring, risk universe, control effectiveness, residual risk, inherent risk, or "what are our biggest risks." Also trigger when asked to build a risk matrix, assess control effectiveness, design a KRI dashboard, evaluate ERM maturity, or develop a risk mitigation plan for any organization or business unit.
Place risk IDs (R01, R02, etc.) in the appropriate cell based on their residual likelihood and impact scores.
9. Risk Appetite Framework
Define acceptable risk levels by category. Risk appetite is set by the board; risk tolerance is the operational boundary.
Risk Category
Risk Appetite
Risk Tolerance (Max Residual Score)
Rationale
Strategic
Moderate-High
16
Organization accepts strategic risk to pursue growth; no existential bets
Operational
Low-Moderate
12
Operational disruptions must be contained; no prolonged outages
Financial
Low
9
Protect balance sheet; no risk of covenant breach or liquidity crisis
Compliance
Very Low
6
Zero tolerance for regulatory violations or legal non-compliance
Reputational
Low
9
Protect brand; avoid any sustained negative media exposure
Appetite breach protocol: Any risk with a residual score exceeding the tolerance threshold requires a documented risk acceptance by the appropriate authority:
Residual Score vs. Tolerance
Acceptance Authority
Documentation
Within tolerance
Risk owner (management)
Standard risk register entry
1-4 points above tolerance
Senior leadership / C-suite
Written risk acceptance memo with rationale and timeline
5+ points above tolerance
Board / Audit Committee
Board paper with mitigation plan and progress tracking
10. Mitigation Strategy Selection
For each risk requiring mitigation, select from four strategies:
Strategy
Definition
When to Use
Example
Accept
Consciously accept the risk without additional mitigation
Risk is within appetite; cost of mitigation exceeds expected loss; risk is inherent to the business model
Accepting competitive risk in a mature market
Mitigate
Implement controls to reduce likelihood, impact, or both
Risk exceeds appetite and can be reduced to acceptable level with reasonable investment
Installing backup generators; implementing fraud detection system
Transfer
Shift risk to a third party through insurance, contract, or outsourcing
Risk is insurable; contractual risk allocation is possible; outsourcing transfers operational risk
Purchasing cyber insurance; contractual indemnities; outsourcing IT operations
Avoid
Eliminate the risk by changing strategy, exiting a market, or stopping an activity
Risk is unacceptable and cannot be mitigated or transferred at reasonable cost
Exiting a market with unmanageable regulatory risk; discontinuing a product line
Mitigation plan template per risk:
Element
Detail
Risk ID
R-XX
Current residual score
XX (Likelihood X x Impact X)
Target residual score
XX (Likelihood X x Impact X)
Strategy
Accept / Mitigate / Transfer / Avoid
Specific actions
[Numbered list of mitigation actions]
Owner
[Role — not individual name]
Timeline
[Start date — completion date]
Cost estimate
$[X]
Dependencies
[Other actions, approvals, or resources required]
Success measure
[How will we know the mitigation worked?]
11. Key Risk Indicators (KRIs)
Design KRIs with threshold-based alerting for continuous risk monitoring:
Risk
KRI
Green (Normal)
Amber (Elevated)
Red (Critical)
Frequency
Owner
Cyber breach
Failed login attempts per day
<100
100-500
>500
Daily
CISO
Cyber breach
Days since last penetration test
<90
90-180
>180
Monthly
CISO
Customer concentration
Revenue from top customer (%)
<15%
15-25%
>25%
Quarterly
CCO
Talent attrition
Voluntary turnover rate (annualized)
<10%
10-18%
>18%
Monthly
CHRO
Liquidity
Days cash on hand
>90
60-90
<60
Weekly
CFO
Regulatory
Open audit findings (past due)
0
1-3
>3
Monthly
CCO/GC
Operational
System uptime (%)
>99.5%
99.0-99.5%
<99.0%
Weekly
CTO
Supply chain
Supplier on-time delivery rate
>95%
90-95%
<90%
Monthly
COO
Financial reporting
Adjusting journal entries per close
<5
5-15
>15
Monthly
CFO
Reputation
Social media sentiment score
>0.7
0.5-0.7
<0.5
Weekly
CMO
KRI design principles:
Each KRI must be measurable with available data (do not design KRIs that cannot be collected).
Green/Amber/Red thresholds must be calibrated to the organization's risk appetite.
Amber = investigate and prepare; Red = escalate and act.
Review thresholds semi-annually; recalibrate based on trends and incidents.
12. Risk Reporting and Governance
Reporting Level
Audience
Frequency
Content
Format
Operational
Risk owners, functional teams
Weekly / Monthly
KRI dashboard; incident reports; control test results
Dashboard with drill-down
Management
C-suite, risk committee
Monthly
Top 10 risks; KRI summary; new/emerging risks; mitigation progress
Risk report (3-5 pages)
Board / Audit Committee
Board members
Quarterly
Risk heat map; appetite breaches; material incidents; ERM maturity progress
Velocity assessed for every risk (Immediate / Days / Weeks / Months / Years).
Both inherent and residual risk scores calculated for every risk in the register.
Control effectiveness rated for every risk using the four-level scale (Effective / Partially Effective / Ineffective / None).
Risk heat map plotted as a 5x5 grid with risk IDs placed in the correct cells based on residual scores.
Risk appetite defined by category with tolerance thresholds; appetite breaches flagged.
Mitigation plans documented for all Critical and High risks with strategy, actions, owner, timeline, cost, and success measure.
KRIs designed with Green/Amber/Red thresholds, data source, frequency, and owner for at least the top 10 risks.
ERM maturity assessed against the 5-level model with current state, target state, and gap actions.
Governance structure defined with clear roles (Board, CRO, Risk Committee, Risk Owners, Internal Audit).
Reporting cadence specified for each governance level (operational, management, board, regulatory).
Risk owners assigned as roles (not individual names) to every risk in the register.
1---2name: enterprise-risk-assessment3description: Enterprise risk assessment with risk register, heat map, mitigation planning, and KRI framework. USE THIS SKILL when the user asks about risk identification, risk register, risk heat map, ERM framework, enterprise risk management, risk appetite, risk tolerance, key risk indicators, risk scoring, risk universe, control effectiveness, residual risk, inherent risk, or "what are our biggest risks." Also trigger when asked to build a risk matrix, assess control effectiveness, design a KRI dashboard, evaluate ERM maturity, or develop a risk mitigation plan for any organization or business unit.4---56# Enterprise Risk Assessment78## Required Inputs910- **Organization**: Company or business unit name, industry, size (revenue and headcount).11- **Scope**: Full enterprise risk assessment or specific category (Strategic, Operational, Financial, Compliance, Reputational).12- **Risk Context**: Known incidents, near-misses, regulatory findings, audit observations, or strategic changes driving the assessment.13- **Existing Controls**: Current risk management practices, policies, and control frameworks in place (if any).14- **Stakeholder Access**: Availability of leadership, functional heads, and frontline staff for workshops and interviews.15- **Reporting Requirements**: Board/audit committee reporting expectations; regulatory risk reporting obligations.1617## Execution Steps1819### 1. Risk Universe Definition2021Define the complete risk universe across 5 categories. Each category contains specific risk domains.2223| Category | Risk Domains | Example Risks |24|---|---|---|25| **Strategic** | Market & competitive; M&A & partnerships; Innovation & disruption; Reputation & brand; Geopolitical | New entrant disrupts core market; failed acquisition integration; technology paradigm shift; social media crisis; sanctions regime change |26| **Operational** | Process failure; Supply chain; Technology & IT; People & talent; Health & safety; Business continuity | Production line shutdown; single-source supplier failure; cyberattack; key person departure; workplace incident; natural disaster |27| **Financial** | Liquidity & cash flow; Credit & counterparty; Market (FX, rates, commodities); Tax; Financial reporting | Cash flow shortfall; customer insolvency; currency devaluation; aggressive tax position challenged; material misstatement |28| **Compliance** | Regulatory; Legal & litigation; Data privacy; Anti-bribery & corruption; Sanctions; Environmental | License revocation; class action lawsuit; GDPR breach; FCPA violation; sanctions violation; environmental contamination |29| **Reputational** | Brand & trust; ESG & sustainability; Social license; Media & public perception; Employee advocacy | Product recall; ESG rating downgrade; community opposition; viral negative press; Glassdoor reputation collapse |3031### 2. Risk Identification Methodology3233Use four complementary methods to ensure comprehensive identification:3435**Method 1: Leadership Workshops (2-3 hours each)**36- Facilitated session with 6-12 participants per workshop.37- Use risk universe as a prompt — walk through each category and domain.38- Employ "pre-mortem" technique: "It is 12 months from now and [bad outcome] has happened. What caused it?"39- Capture risks on a shared board; cluster and de-duplicate in real time.40- Minimum: 1 workshop with executive team + 1 per major business unit.4142**Method 2: One-on-One Interviews (45-60 minutes each)**43- Interview functional heads and subject matter experts who may not speak freely in workshops.44- Use semi-structured interview guide: "What keeps you up at night? What risk are we not managing well? What incident almost happened?"45- Minimum: 8-12 interviews across functions.4647**Method 3: Scenario Analysis**48- Develop 3-5 plausible adverse scenarios relevant to the organization.49- For each scenario: identify trigger events, transmission mechanisms, and impact pathways.50- Stress test: "If [scenario] happened tomorrow, what would break first?"5152| Scenario | Trigger | Transmission | Primary Impact | Secondary Impact |53|---|---|---|---|---|54| Major cyber breach | Phishing attack succeeds | Data exfiltration; system lockout | Operational shutdown; customer data loss | Regulatory fine; reputation damage; litigation |55| Key customer loss | Competitor underbids by 20% | Revenue decline; utilization drop | Cash flow shortfall; headcount reduction | Talent attrition; supplier renegotiation |56| Regulatory change | New regulation effective in 12 months | Compliance cost increase; product redesign | Margin compression; capex requirement | Competitive disadvantage if slow to adapt |5758**Method 4: Incident and Near-Miss Review**59- Review all incidents, near-misses, audit findings, and regulatory observations from the last 3 years.60- Identify patterns and systemic root causes.61- Determine whether existing controls failed, were absent, or were bypassed.6263### 3. Risk Scoring: Likelihood6465Rate likelihood on a 1-5 scale with specific, observable criteria:6667| Score | Label | Frequency Basis | Probability Basis | Description |68|---|---|---|---|---|69| 1 | Rare | Less than once in 10 years | <5% in next 12 months | Has never occurred; would require extraordinary circumstances |70| 2 | Unlikely | Once in 5-10 years | 5-20% in next 12 months | Has occurred in the industry but not at this organization; plausible but not expected |71| 3 | Possible | Once in 2-5 years | 20-50% in next 12 months | Has occurred at this organization before or is occurring at peers; could reasonably happen |72| 4 | Likely | Once in 1-2 years | 50-80% in next 12 months | Has occurred recently or conditions make it probable; trending upward |73| 5 | Almost Certain | Multiple times per year | >80% in next 12 months | Is currently occurring or has occurred repeatedly; expected without intervention |7475### 4. Risk Scoring: Impact7677Rate impact on a 1-5 scale across multiple dimensions. Use the highest dimension score as the overall impact rating.7879| Score | Label | Financial | Operational | Regulatory | Reputational | Safety |80|---|---|---|---|---|---|---|81| 1 | Insignificant | <$100K or <0.1% revenue | <1 day disruption | Minor finding; self-remediated | Internal awareness only; no media | First aid only |82| 2 | Minor | $100K-$1M or 0.1-0.5% revenue | 1-3 day disruption | Regulatory inquiry; remediation ordered | Local media; limited duration | Medical treatment; no lost time |83| 3 | Moderate | $1M-$10M or 0.5-2% revenue | 3-7 day disruption; workarounds needed | Formal enforcement action; fine <$1M | National media; short-term reputation impact | Lost-time injury; hospitalization |84| 4 | Major | $10M-$50M or 2-10% revenue | 1-4 week disruption; partial operations | Major fine ($1M-$10M); license conditions | Sustained negative media; customer attrition | Permanent disability; multiple injuries |85| 5 | Catastrophic | >$50M or >10% revenue | >1 month disruption; business continuity invoked | License revocation; criminal prosecution; fine >$10M | Viral global media; existential brand damage | Fatality; mass casualty |8687**Note**: Adjust financial thresholds proportionally for organization size. The percentages of revenue serve as scale-agnostic anchors.8889### 5. Velocity Assessment9091Assess how quickly a risk event materializes from trigger to full impact:9293| Velocity | Time from Trigger to Full Impact | Implication for Response | Examples |94|---|---|---|---|95| Immediate | Minutes to hours | Pre-positioned response required; no time to deliberate | Cyberattack; workplace fatality; social media crisis; natural disaster |96| Days | 1-7 days | Rapid response team activation; executive decision within 24 hours | Product recall; key customer termination notice; data breach discovery |97| Weeks | 1-4 weeks | Time to assess, plan, and respond; cross-functional coordination | Regulatory investigation notice; competitive product launch; supply disruption |98| Months | 1-12 months | Strategic response; time to pivot or mitigate | New regulation announced; market shift emerging; talent pipeline depleting |99| Years | >12 months | Monitor and prepare; incorporate into strategic planning | Demographic shifts; technology disruption; climate change physical risks |100101High-velocity risks require standing response protocols. Low-velocity risks require monitoring and early-warning indicators.102103### 6. Inherent vs. Residual Risk Scoring104105Score each risk twice:106107| Concept | Definition | When to Use |108|---|---|---|109| **Inherent risk** | Risk level assuming NO controls are in place | Shows the "raw" exposure; useful for understanding total risk landscape and control dependency |110| **Residual risk** | Risk level AFTER existing controls are applied | Shows the "current" exposure; basis for prioritization and mitigation decisions |111112```113Risk Score = Likelihood x Impact (range: 1 to 25)114```115116| Score Range | Risk Rating | Required Action |117|---|---|---|118| 20-25 | **Critical** | Immediate remediation required; executive escalation; board notification |119| 12-19 | **High** | Remediation plan within 30 days; senior management ownership |120| 6-11 | **Medium** | Remediation plan within 90 days; management ownership |121| 1-5 | **Low** | Accept or monitor; review at next assessment cycle |122123The risk rating table aligned to the specified standard:124125| Rating | Likelihood | Impact | Action |126|---|---|---|---|127| Critical | Almost certain | Catastrophic | Immediate remediation required |128| High | Likely | Major | Remediation within 30 days |129| Medium | Possible | Moderate | Remediation within 90 days |130| Low | Unlikely | Minor | Accept or monitor |131132### 7. Control Effectiveness Assessment133134Rate existing controls for each risk:135136| Rating | Label | Criteria | Residual Risk Adjustment |137|---|---|---|---|138| 4 | **Effective** | Control is well-designed, consistently operating, tested regularly, documented, with clear ownership | Reduces inherent risk score by 60-80% |139| 3 | **Partially Effective** | Control exists and operates most of the time but has gaps in design, operation, or testing | Reduces inherent risk score by 30-50% |140| 2 | **Ineffective** | Control exists on paper but is not consistently operating, not tested, or has known design flaws | Reduces inherent risk score by 0-20% |141| 1 | **None** | No control in place for this risk | No reduction; residual risk = inherent risk |142143**Control assessment questions:**144- Is the control documented in a policy or procedure?145- Is there evidence the control operates as designed (test results, logs, approvals)?146- Is the control automated or manual? (Automated controls are inherently more reliable.)147- Who is responsible for operating the control? Is that person aware?148- When was the control last tested or audited?149- Has the control failed in the last 12 months? What happened?150151### 8. Risk Heat Map (5x5 Grid)152153Plot risk IDs on a text-based 5x5 matrix:154155```156RISK HEAT MAP — Residual Risk157158Impact -> 1-Insignif. 2-Minor 3-Moderate 4-Major 5-Catastrophic159 +------------+------------+------------+------------+------------+1605-Almost | | | | | |161 Certain | [ ] | [ ] | [ ] | [ ] | [ ] |162 +------------+------------+------------+------------+------------+1634-Likely | | | | | |164 | [ ] | [ ] | [ ] | [ ] | [ ] |165 +------------+------------+------------+------------+------------+1663-Possible | | | | | |167 | [ ] | [ ] | [ ] | [ ] | [ ] |168 +------------+------------+------------+------------+------------+1692-Unlikely | | | | | |170 | [ ] | [ ] | [ ] | [ ] | [ ] |171 +------------+------------+------------+------------+------------+1721-Rare | | | | | |173 | [ ] | [ ] | [ ] | [ ] | [ ] |174 +------------+------------+------------+------------+------------+175176Zone Legend:177 Critical (Score 20-25): Cells at top-right — immediate action178 High (Score 12-19): Cells in upper-middle band — 30-day action179 Medium (Score 6-11): Cells in middle band — 90-day action180 Low (Score 1-5): Cells at bottom-left — accept or monitor181```182183Place risk IDs (R01, R02, etc.) in the appropriate cell based on their residual likelihood and impact scores.184185### 9. Risk Appetite Framework186187Define acceptable risk levels by category. Risk appetite is set by the board; risk tolerance is the operational boundary.188189| Risk Category | Risk Appetite | Risk Tolerance (Max Residual Score) | Rationale |190|---|---|---|---|191| Strategic | Moderate-High | 16 | Organization accepts strategic risk to pursue growth; no existential bets |192| Operational | Low-Moderate | 12 | Operational disruptions must be contained; no prolonged outages |193| Financial | Low | 9 | Protect balance sheet; no risk of covenant breach or liquidity crisis |194| Compliance | Very Low | 6 | Zero tolerance for regulatory violations or legal non-compliance |195| Reputational | Low | 9 | Protect brand; avoid any sustained negative media exposure |196197**Appetite breach protocol**: Any risk with a residual score exceeding the tolerance threshold requires a documented risk acceptance by the appropriate authority:198199| Residual Score vs. Tolerance | Acceptance Authority | Documentation |200|---|---|---|201| Within tolerance | Risk owner (management) | Standard risk register entry |202| 1-4 points above tolerance | Senior leadership / C-suite | Written risk acceptance memo with rationale and timeline |203| 5+ points above tolerance | Board / Audit Committee | Board paper with mitigation plan and progress tracking |204205### 10. Mitigation Strategy Selection206207For each risk requiring mitigation, select from four strategies:208209| Strategy | Definition | When to Use | Example |210|---|---|---|---|211| **Accept** | Consciously accept the risk without additional mitigation | Risk is within appetite; cost of mitigation exceeds expected loss; risk is inherent to the business model | Accepting competitive risk in a mature market |212| **Mitigate** | Implement controls to reduce likelihood, impact, or both | Risk exceeds appetite and can be reduced to acceptable level with reasonable investment | Installing backup generators; implementing fraud detection system |213| **Transfer** | Shift risk to a third party through insurance, contract, or outsourcing | Risk is insurable; contractual risk allocation is possible; outsourcing transfers operational risk | Purchasing cyber insurance; contractual indemnities; outsourcing IT operations |214| **Avoid** | Eliminate the risk by changing strategy, exiting a market, or stopping an activity | Risk is unacceptable and cannot be mitigated or transferred at reasonable cost | Exiting a market with unmanageable regulatory risk; discontinuing a product line |215216**Mitigation plan template per risk:**217218| Element | Detail |219|---|---|220| Risk ID | R-XX |221| Current residual score | XX (Likelihood X x Impact X) |222| Target residual score | XX (Likelihood X x Impact X) |223| Strategy | Accept / Mitigate / Transfer / Avoid |224| Specific actions | [Numbered list of mitigation actions] |225| Owner | [Role — not individual name] |226| Timeline | [Start date — completion date] |227| Cost estimate | $[X] |228| Dependencies | [Other actions, approvals, or resources required] |229| Success measure | [How will we know the mitigation worked?] |230231### 11. Key Risk Indicators (KRIs)232233Design KRIs with threshold-based alerting for continuous risk monitoring:234235| Risk | KRI | Green (Normal) | Amber (Elevated) | Red (Critical) | Frequency | Owner |236|---|---|---|---|---|---|---|237| Cyber breach | Failed login attempts per day | <100 | 100-500 | >500 | Daily | CISO |238| Cyber breach | Days since last penetration test | <90 | 90-180 | >180 | Monthly | CISO |239| Customer concentration | Revenue from top customer (%) | <15% | 15-25% | >25% | Quarterly | CCO |240| Talent attrition | Voluntary turnover rate (annualized) | <10% | 10-18% | >18% | Monthly | CHRO |241| Liquidity | Days cash on hand | >90 | 60-90 | <60 | Weekly | CFO |242| Regulatory | Open audit findings (past due) | 0 | 1-3 | >3 | Monthly | CCO/GC |243| Operational | System uptime (%) | >99.5% | 99.0-99.5% | <99.0% | Weekly | CTO |244| Supply chain | Supplier on-time delivery rate | >95% | 90-95% | <90% | Monthly | COO |245| Financial reporting | Adjusting journal entries per close | <5 | 5-15 | >15 | Monthly | CFO |246| Reputation | Social media sentiment score | >0.7 | 0.5-0.7 | <0.5 | Weekly | CMO |247248**KRI design principles:**249- Each KRI must be measurable with available data (do not design KRIs that cannot be collected).250- Green/Amber/Red thresholds must be calibrated to the organization's risk appetite.251- Amber = investigate and prepare; Red = escalate and act.252- Review thresholds semi-annually; recalibrate based on trends and incidents.253254### 12. Risk Reporting and Governance255256| Reporting Level | Audience | Frequency | Content | Format |257|---|---|---|---|---|258| Operational | Risk owners, functional teams | Weekly / Monthly | KRI dashboard; incident reports; control test results | Dashboard with drill-down |259| Management | C-suite, risk committee | Monthly | Top 10 risks; KRI summary; new/emerging risks; mitigation progress | Risk report (3-5 pages) |260| Board / Audit Committee | Board members | Quarterly | Risk heat map; appetite breaches; material incidents; ERM maturity progress | Board paper (5-10 pages) |261| Regulatory | Regulators (if required) | As required | Regulatory risk disclosures; compliance attestations | Regulatory filing format |262263**Governance structure:**264265| Role | Responsibility |266|---|---|267| Board / Audit Committee | Approve risk appetite; oversee ERM program; review top risks quarterly |268| Chief Risk Officer (or equivalent) | Own ERM framework; aggregate and report risks; challenge first-line risk assessments |269| Risk Committee (management) | Review risk register monthly; approve mitigation plans; allocate resources |270| Risk Owners (functional heads) | Own assigned risks; implement mitigations; report KRIs; escalate breaches |271| Internal Audit | Independent assurance on control effectiveness; test risk management processes |272273### 13. ERM Maturity Model274275Assess organizational ERM maturity on a 5-level scale:276277| Level | Label | Description | Key Characteristics |278|---|---|---|---|279| 1 | Ad Hoc | Risk management is reactive and informal | No formal risk register; risks managed in silos; incident-driven only; no common risk language |280| 2 | Emerging | Basic risk identification and reporting started | Risk register exists but incomplete; annual assessment conducted; risk committee forming; basic reporting to board |281| 3 | Defined | Formal ERM framework in place and operating | Comprehensive risk register; defined risk appetite; regular reporting; KRIs tracked; roles and responsibilities clear; training provided |282| 4 | Managed | ERM integrated into decision-making | Risk considerations embedded in strategic planning, capital allocation, and project approvals; quantitative risk analysis used; forward-looking scenario analysis; strong risk culture |283| 5 | Optimized | ERM drives competitive advantage | Real-time risk monitoring; predictive analytics; risk-adjusted performance measurement; continuous improvement; recognized as industry benchmark |284285**Maturity assessment by capability:**286287| Capability | Level 1 | Level 2 | Level 3 | Level 4 | Level 5 |288|---|---|---|---|---|---|289| Risk identification | Reactive | Annual exercise | Continuous + emerging risks | Forward-looking scenarios | Predictive analytics |290| Risk assessment | Qualitative only | Basic scoring | Consistent 5x5 matrix | Quantitative modeling (Monte Carlo) | Real-time risk scoring |291| Risk appetite | Not defined | Implicit | Documented and approved | Cascaded to business units | Dynamically adjusted |292| Reporting | Ad hoc | Annual report | Quarterly board report | Monthly management + quarterly board | Real-time dashboards |293| Culture | Risk avoidance | Awareness growing | Training in place | Risk-aware decision making | Risk intelligence embedded |294| Technology | Spreadsheets | Basic GRC tool | Integrated GRC platform | Automated monitoring + alerts | AI-powered risk analytics |295296## Output Template297298```markdown299## Enterprise Risk Assessment: [Organization Name]300301**Date**: [Date] | **Industry**: [Industry] | **Revenue**: $[X]M | **Headcount**: [N]302**Scope**: [Full enterprise / Specific category]303304### Executive Summary305[Organization] faces [N] identified risks across [X] categories. [N] risks are rated Critical,306[N] High, [N] Medium, and [N] Low on a residual basis. The top 3 risks are: (1) [Risk],307(2) [Risk], and (3) [Risk]. Current ERM maturity is Level [X] ([Label]). [N] risks exceed308the organization's stated risk appetite and require immediate attention. This report309provides a full risk register, heat map, mitigation plans, and KRI framework.310311### Risk Register312313| ID | Risk | Category | Inherent L | Inherent I | Inherent Score | Controls | Control Rating | Residual L | Residual I | Residual Score | Rating | Velocity | Owner |314|---|---|---|---|---|---|---|---|---|---|---|---|---|---|315| R01 | [Description] | [Category] | X | X | XX | [Current controls] | [E/PE/IE/N] | X | X | XX | [Critical/High/Med/Low] | [Imm/Days/Wks/Mos/Yrs] | [Role] |316| R02 | [Description] | [Category] | X | X | XX | [Current controls] | [E/PE/IE/N] | X | X | XX | [Rating] | [Velocity] | [Role] |317318### Risk Heat Map (Residual)319320```321Impact -> 1-Insignif. 2-Minor 3-Moderate 4-Major 5-Catastrophic322 +------------+------------+------------+------------+------------+3235-Almost | | | | | |324 Certain | [ ] | [ ] | [ Rxx ] | [ Rxx ] | [ Rxx ] |325 +------------+------------+------------+------------+------------+3264-Likely | | | | | |327 | [ ] | [ ] | [ Rxx ] | [ Rxx ] | [ Rxx ] |328 +------------+------------+------------+------------+------------+3293-Possible | | | | | |330 | [ ] | [ Rxx ] | [ Rxx ] | [ Rxx ] | [ ] |331 +------------+------------+------------+------------+------------+3322-Unlikely | | | | | |333 | [ Rxx ] | [ Rxx ] | [ Rxx ] | [ ] | [ ] |334 +------------+------------+------------+------------+------------+3351-Rare | | | | | |336 | [ Rxx ] | [ Rxx ] | [ ] | [ ] | [ ] |337 +------------+------------+------------+------------+------------+338```339340### Risk Appetite Compliance341| Category | Appetite | Tolerance (Max Score) | Highest Residual Score | Status |342|---|---|---|---|---|343| Strategic | [Level] | XX | XX | Within / Breach |344| Operational | [Level] | XX | XX | Within / Breach |345| Financial | [Level] | XX | XX | Within / Breach |346| Compliance | [Level] | XX | XX | Within / Breach |347| Reputational | [Level] | XX | XX | Within / Breach |348349### Mitigation Plans (Critical and High Risks)350351#### R-[XX]: [Risk Name]352| Element | Detail |353|---|---|354| Current residual score | XX ([Rating]) |355| Target residual score | XX ([Rating]) |356| Strategy | Accept / Mitigate / Transfer / Avoid |357| Actions | 1. [Action] 2. [Action] 3. [Action] |358| Owner | [Role] |359| Timeline | [Start] — [Completion] |360| Cost | $[X] |361| Success measure | [Measure] |362363### KRI Dashboard364| Risk | KRI | Current Value | Status | Threshold (G/A/R) | Trend | Owner |365|---|---|---|---|---|---|---|366| [Risk] | [KRI] | [Value] | Green/Amber/Red | [Thresholds] | Up/Stable/Down | [Role] |367368### ERM Maturity Assessment369| Capability | Current Level | Target Level | Gap | Priority Actions |370|---|---|---|---|---|371| Risk identification | X | X | X | [Action] |372| Risk assessment | X | X | X | [Action] |373| Risk appetite | X | X | X | [Action] |374| Reporting | X | X | X | [Action] |375| Culture | X | X | X | [Action] |376| Technology | X | X | X | [Action] |377| **Overall** | **X** | **X** | | |378379### Governance and Reporting Cadence380| Forum | Frequency | Content | Owner |381|---|---|---|---|382| [Forum] | [Frequency] | [Content] | [Role] |383384### Recommendations3851. [Highest-priority recommendation with rationale]3862. [Second priority]3873. [Third priority]3884. [Continue as needed]389```390391## Quality Checks392393- [ ] All 5 risk categories covered in the risk universe (Strategic, Operational, Financial, Compliance, Reputational).394- [ ] Risk identification used at least 2 of the 4 methods (workshops, interviews, scenario analysis, incident review).395- [ ] Every risk scored on both likelihood (1-5) and impact (1-5) using the defined criteria — no scores assigned without justification.396- [ ] Impact scoring uses the highest relevant dimension (financial, operational, regulatory, reputational, safety).397- [ ] Velocity assessed for every risk (Immediate / Days / Weeks / Months / Years).398- [ ] Both inherent and residual risk scores calculated for every risk in the register.399- [ ] Control effectiveness rated for every risk using the four-level scale (Effective / Partially Effective / Ineffective / None).400- [ ] Risk heat map plotted as a 5x5 grid with risk IDs placed in the correct cells based on residual scores.401- [ ] Risk appetite defined by category with tolerance thresholds; appetite breaches flagged.402- [ ] Mitigation plans documented for all Critical and High risks with strategy, actions, owner, timeline, cost, and success measure.403- [ ] KRIs designed with Green/Amber/Red thresholds, data source, frequency, and owner for at least the top 10 risks.404- [ ] ERM maturity assessed against the 5-level model with current state, target state, and gap actions.405- [ ] Governance structure defined with clear roles (Board, CRO, Risk Committee, Risk Owners, Internal Audit).406- [ ] Reporting cadence specified for each governance level (operational, management, board, regulatory).407- [ ] Risk owners assigned as roles (not individual names) to every risk in the register.
Run npx skillmds@latest add kaakati/enterprise-risk-assessment in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Enterprise risk assessment with risk register, heat map, mitigation planning, and KRI framework. USE THIS SKILL when the user asks about risk identification, risk register, risk heat map, ERM framework, enterprise risk management, risk appetite, risk tolerance, key risk indicators, risk scoring, risk universe, control effectiveness, residual risk, inherent risk, or "what are our biggest risks." Also trigger when asked to build a risk matrix, assess control effectiveness, design a KRI dashboard, evaluate ERM maturity, or develop a risk mitigation plan for any organization or business unit. It is listed under Coding & Dev Tools on SkillMD.
This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
Kaakati (@kaakati) published this skill. Their other Agent Skills are listed on their SkillMD profile.
Kaakati