Mattakushi432 Risk Management
Risk Register
Register Template
| ID | Category | Risk description | Likelihood (1–5) | Impact (1–5) | Risk score | Owner | Mitigation | Status | Last reviewed |
|---|---|---|---|---|---|---|---|---|---|
| R-001 | Operational | Key-person dependency in [role] | 4 | 5 | 20 | CEO | Document processes; cross-train; succession plan | Active | YYYY-MM-DD |
| R-002 | Financial | Runway < 6 months before next raise | 2 | 5 | 10 | CFO | Extend runway via cost cuts; accelerate fundraise | Monitor | YYYY-MM-DD |
| R-003 | Technology | Single cloud provider dependency | 3 | 4 | 12 | CTO | Multi-region redundancy; vendor contract guarantees | Mitigating | YYYY-MM-DD |
Scoring Formula
Risk Score = Likelihood × Impact
Likelihood scale:
1 = Rare (<5% probability in 12 months)
2 = Unlikely (5–15%)
3 = Possible (15–35%)
4 = Likely (35–65%)
5 = Almost certain (>65%)
Impact scale:
1 = Negligible (< $10K impact or minor disruption)
2 = Minor ($10–100K or temporary disruption)
3 = Moderate ($100K–1M or significant disruption)
4 = Major ($1–10M or sustained disruption)
5 = Critical (> $10M, existential, or data breach)
Risk Score Priority Bands
| Score | Priority | Action |
|---|---|---|
| 20–25 | Critical | Immediate mitigation; exec ownership; monthly review |
| 12–19 | High | Active mitigation plan; VP ownership; quarterly review |
| 6–11 | Medium | Monitor; mitigation plan optional; semi-annual review |
| 1–5 | Low | Accept; document; annual review |
Risk Categories
Strategic Risks
- Market timing: product-market fit assumptions prove wrong
- Competitive disruption: new entrant or incumbent response
- Regulatory change: laws that alter business model viability
- Partnership dependency: key partner relationship deteriorates
- M&A integration: acquired entity underperforms
Financial Risks
- Runway: cash runs out before next funding
- Customer concentration: top customer churns (>20% of ARR)
- FX / currency: revenue in one currency, costs in another
- Fraud / theft: internal or external financial crime
- Credit: customers don't pay / collection issues
Operational Risks
- Key-person: critical knowledge in one person
- Vendor failure: critical SaaS or supplier goes offline
- Data loss: backup failure or ransomware
- Supply chain: hardware or material shortages
- Process failure: critical process breaks down
Technology / Cybersecurity Risks
- Data breach: PII or sensitive data exposure
- DDoS: service availability attack
- Software vulnerability: zero-day in dependencies
- Cloud outage: single provider dependency
- AI/ML model failure: model drift or adversarial inputs
People / HR Risks
- Talent shortage: inability to hire key roles
- Mass attrition: sudden departure of key team members
- Harassment / culture incident: reputational and legal exposure
- Labor law: misclassification, wage disputes
- Leadership: C-suite departure during critical growth phase
Legal / Compliance Risks
- IP infringement: third-party claims against product
- Contract breach: failure to meet customer SLAs/terms
- Regulatory action: fines, sanctions, license revocation
- Privacy violations: GDPR / CCPA non-compliance
- Employment claims: wrongful termination, discrimination
Mitigation Strategies
Strategy Types
| Strategy | Definition | Use when |
|---|---|---|
| Avoid | Eliminate the risk by not doing the risky activity | Risk > reward |
| Reduce | Take action to lower likelihood or impact | Feasible mitigation exists |
| Transfer | Shift risk to third party (insurance, contract) | Insurable or contractually transferable |
| Accept | Acknowledge and monitor, no active mitigation | Low score or cost of mitigation > cost of risk |
Mitigation Template
Risk ID: R-[NNN]
Risk: [Description]
Current score: [Likelihood × Impact]
Mitigation plan:
Strategy: [Avoid / Reduce / Transfer / Accept]
Actions:
1. [Specific action] — Owner: [Name] — Due: YYYY-MM-DD
2. [Specific action] — Owner: [Name] — Due: YYYY-MM-DD
Target score after mitigation: [Likelihood × Impact]
Monitoring:
Indicator: [What signals that this risk is materializing?]
Trigger: [Score or event that triggers escalation]
Review cadence: [Monthly / Quarterly]
Contingency (if risk materializes):
[Steps to take if the risk event occurs]
Business Continuity Plan (BCP)
BCP Scope Definition
- Recovery Time Objective (RTO): Maximum acceptable time to restore operations
- Recovery Point Objective (RPO): Maximum acceptable data loss (time window)
- Minimum Business Continuity Objective (MBCO): Minimum operational capacity acceptable
Critical Process Inventory
| Process | RTO | RPO | Owner | Backup procedure |
|---|---|---|---|---|
| Customer payments processing | 1 hour | 0 (no data loss) | Finance | [Procedure link] |
| Customer-facing application | 4 hours | 1 hour | Engineering | [Runbook link] |
| Employee payroll | 1 business day | 24 hours | HR/Finance | [Procedure link] |
| Internal communication | 4 hours | N/A | IT | [Runbook link] |
| Customer support queue | 8 hours | 4 hours | Support | [Procedure link] |
BCP Activation Criteria
- Physical office inaccessible for > 1 day
- Primary cloud provider down for > 2 hours
- Core database corrupted or unavailable
- Key personnel unavailable for > 1 week
- Cybersecurity incident affecting production systems
BCP Response Structure
1. Incident detection and assessment (0–30 min)
- Who discovered it?
- Is the BCP triggered? (meets activation criteria?)
- Notify BCP coordinator
2. BCP activation (30–60 min)
- Notify BCP team via [emergency channel]
- Activate backup systems / procedures
- Open war room (virtual or physical)
3. Operations in continuity mode
- Run critical processes via backup procedures
- Communicate status to employees every [N] hours
- Communicate status to customers per external comms plan
4. Recovery
- Restore primary systems following runbooks
- Validate data integrity before switching back
- Controlled handoff from backup to primary
5. Post-incident
- Document timeline and decisions
- Post-mortem within 5 business days
- Update BCP with lessons learned
- Test updated plan within 90 days
Insurance Considerations
Common Coverage Types for Tech Companies
| Policy | What it covers | When essential |
|---|---|---|
| Cyber liability | Data breaches, ransomware, notification costs, legal defense | Always |
| E&O (Errors & Omissions) | Claims arising from product or service failures | B2B SaaS |
| D&O (Directors & Officers) | Personal liability of executives and board members | Any funded company |
| General liability | Third-party bodily injury, property damage | Always |
| Workers' compensation | Employee injury | Required by law in most states |
| Employment practices liability | Wrongful termination, harassment, discrimination claims | 25+ employees |
| Business interruption | Lost income during covered outage | Post-Series B |
| Property | Physical assets (equipment, leasehold improvements) | If significant physical assets |
Coverage Review Triggers
- After each funding round (limits should scale with company size)
- When entering new markets or geographies
- After a significant product launch (new risk profile)
- Upon hiring first employees with fiduciary duties
- Annually with broker review
Risk Governance
Risk Committee Cadence
| Level | Participants | Frequency | Focus |
|---|---|---|---|
| Executive | CEO, CFO, CTO, General Counsel | Monthly | High / Critical risks |
| Board risk committee | 2 board members + CFO | Quarterly | Strategic and financial risks |
| Department | Dept heads | Quarterly | Function-specific risks |
Risk Review Agenda (Monthly Executive)
1. New risks identified this period (10 min)
2. Critical and High risk status updates (15 min)
3. Risks approaching materialization — early signals (10 min)
4. Mitigation action item review — on track? (10 min)
5. Risk appetite discussion — any policy updates needed? (5 min)
Risk Appetite Statement
[Company] accepts:
- [Category] risks up to score [N] without mitigation
- Financial exposure up to $[X] per individual risk event
[Company] does NOT accept:
- Risks to customer data security without active mitigation
- Risks that would result in regulatory sanctions
- Risks that could cause more than [N] days of service disruption