# Risk Management

> When to activate: risk register, risk matrix, risk mitigation, business continuity, enterprise risk management, operational risk, risk owners, risk assessment

- Skill: `mattakushi432/risk-management` (Agent Skill)
- Install (CLI): `npx skillmds@latest add mattakushi432/risk-management`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mattakushi432/risk-management/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: Mattakushi432 (https://skillmd.com/u/mattakushi432)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/mattakushi432/risk-management

---


# Risk Management

## Risk Register

### Register Template

| ID | Category | Risk description | Likelihood (1–5) | Impact (1–5) | Risk score | Owner | Mitigation | Status | Last reviewed |
|----|----------|-----------------|-----------------|-------------|------------|-------|------------|--------|--------------|
| R-001 | Operational | Key-person dependency in [role] | 4 | 5 | 20 | CEO | Document processes; cross-train; succession plan | Active | YYYY-MM-DD |
| R-002 | Financial | Runway < 6 months before next raise | 2 | 5 | 10 | CFO | Extend runway via cost cuts; accelerate fundraise | Monitor | YYYY-MM-DD |
| R-003 | Technology | Single cloud provider dependency | 3 | 4 | 12 | CTO | Multi-region redundancy; vendor contract guarantees | Mitigating | YYYY-MM-DD |

### Scoring Formula
```
Risk Score = Likelihood × Impact

Likelihood scale:
  1 = Rare (<5% probability in 12 months)
  2 = Unlikely (5–15%)
  3 = Possible (15–35%)
  4 = Likely (35–65%)
  5 = Almost certain (>65%)

Impact scale:
  1 = Negligible (< $10K impact or minor disruption)
  2 = Minor ($10–100K or temporary disruption)
  3 = Moderate ($100K–1M or significant disruption)
  4 = Major ($1–10M or sustained disruption)
  5 = Critical (> $10M, existential, or data breach)
```

### Risk Score Priority Bands
| Score | Priority | Action |
|-------|----------|--------|
| 20–25 | Critical | Immediate mitigation; exec ownership; monthly review |
| 12–19 | High | Active mitigation plan; VP ownership; quarterly review |
| 6–11 | Medium | Monitor; mitigation plan optional; semi-annual review |
| 1–5 | Low | Accept; document; annual review |

---

## Risk Categories

### Strategic Risks
- Market timing: product-market fit assumptions prove wrong
- Competitive disruption: new entrant or incumbent response
- Regulatory change: laws that alter business model viability
- Partnership dependency: key partner relationship deteriorates
- M&A integration: acquired entity underperforms

### Financial Risks
- Runway: cash runs out before next funding
- Customer concentration: top customer churns (>20% of ARR)
- FX / currency: revenue in one currency, costs in another
- Fraud / theft: internal or external financial crime
- Credit: customers don't pay / collection issues

### Operational Risks
- Key-person: critical knowledge in one person
- Vendor failure: critical SaaS or supplier goes offline
- Data loss: backup failure or ransomware
- Supply chain: hardware or material shortages
- Process failure: critical process breaks down

### Technology / Cybersecurity Risks
- Data breach: PII or sensitive data exposure
- DDoS: service availability attack
- Software vulnerability: zero-day in dependencies
- Cloud outage: single provider dependency
- AI/ML model failure: model drift or adversarial inputs

### People / HR Risks
- Talent shortage: inability to hire key roles
- Mass attrition: sudden departure of key team members
- Harassment / culture incident: reputational and legal exposure
- Labor law: misclassification, wage disputes
- Leadership: C-suite departure during critical growth phase

### Legal / Compliance Risks
- IP infringement: third-party claims against product
- Contract breach: failure to meet customer SLAs/terms
- Regulatory action: fines, sanctions, license revocation
- Privacy violations: GDPR / CCPA non-compliance
- Employment claims: wrongful termination, discrimination

---

## Mitigation Strategies

### Strategy Types
| Strategy | Definition | Use when |
|----------|-----------|---------|
| Avoid | Eliminate the risk by not doing the risky activity | Risk > reward |
| Reduce | Take action to lower likelihood or impact | Feasible mitigation exists |
| Transfer | Shift risk to third party (insurance, contract) | Insurable or contractually transferable |
| Accept | Acknowledge and monitor, no active mitigation | Low score or cost of mitigation > cost of risk |

### Mitigation Template
```
Risk ID: R-[NNN]
Risk: [Description]
Current score: [Likelihood × Impact]

Mitigation plan:
  Strategy: [Avoid / Reduce / Transfer / Accept]
  
  Actions:
    1. [Specific action] — Owner: [Name] — Due: YYYY-MM-DD
    2. [Specific action] — Owner: [Name] — Due: YYYY-MM-DD
  
  Target score after mitigation: [Likelihood × Impact]
  
  Monitoring:
    Indicator: [What signals that this risk is materializing?]
    Trigger: [Score or event that triggers escalation]
    Review cadence: [Monthly / Quarterly]
    
  Contingency (if risk materializes):
    [Steps to take if the risk event occurs]
```

---

## Business Continuity Plan (BCP)

### BCP Scope Definition
- **Recovery Time Objective (RTO)**: Maximum acceptable time to restore operations
- **Recovery Point Objective (RPO)**: Maximum acceptable data loss (time window)
- **Minimum Business Continuity Objective (MBCO)**: Minimum operational capacity acceptable

### Critical Process Inventory
| Process | RTO | RPO | Owner | Backup procedure |
|---------|-----|-----|-------|-----------------|
| Customer payments processing | 1 hour | 0 (no data loss) | Finance | [Procedure link] |
| Customer-facing application | 4 hours | 1 hour | Engineering | [Runbook link] |
| Employee payroll | 1 business day | 24 hours | HR/Finance | [Procedure link] |
| Internal communication | 4 hours | N/A | IT | [Runbook link] |
| Customer support queue | 8 hours | 4 hours | Support | [Procedure link] |

### BCP Activation Criteria
- Physical office inaccessible for > 1 day
- Primary cloud provider down for > 2 hours
- Core database corrupted or unavailable
- Key personnel unavailable for > 1 week
- Cybersecurity incident affecting production systems

### BCP Response Structure
```
1. Incident detection and assessment (0–30 min)
   - Who discovered it?
   - Is the BCP triggered? (meets activation criteria?)
   - Notify BCP coordinator

2. BCP activation (30–60 min)
   - Notify BCP team via [emergency channel]
   - Activate backup systems / procedures
   - Open war room (virtual or physical)

3. Operations in continuity mode
   - Run critical processes via backup procedures
   - Communicate status to employees every [N] hours
   - Communicate status to customers per external comms plan

4. Recovery
   - Restore primary systems following runbooks
   - Validate data integrity before switching back
   - Controlled handoff from backup to primary

5. Post-incident
   - Document timeline and decisions
   - Post-mortem within 5 business days
   - Update BCP with lessons learned
   - Test updated plan within 90 days
```

---

## Insurance Considerations

### Common Coverage Types for Tech Companies
| Policy | What it covers | When essential |
|--------|---------------|----------------|
| Cyber liability | Data breaches, ransomware, notification costs, legal defense | Always |
| E&O (Errors & Omissions) | Claims arising from product or service failures | B2B SaaS |
| D&O (Directors & Officers) | Personal liability of executives and board members | Any funded company |
| General liability | Third-party bodily injury, property damage | Always |
| Workers' compensation | Employee injury | Required by law in most states |
| Employment practices liability | Wrongful termination, harassment, discrimination claims | 25+ employees |
| Business interruption | Lost income during covered outage | Post-Series B |
| Property | Physical assets (equipment, leasehold improvements) | If significant physical assets |

### Coverage Review Triggers
- After each funding round (limits should scale with company size)
- When entering new markets or geographies
- After a significant product launch (new risk profile)
- Upon hiring first employees with fiduciary duties
- Annually with broker review

---

## Risk Governance

### Risk Committee Cadence
| Level | Participants | Frequency | Focus |
|-------|-------------|-----------|-------|
| Executive | CEO, CFO, CTO, General Counsel | Monthly | High / Critical risks |
| Board risk committee | 2 board members + CFO | Quarterly | Strategic and financial risks |
| Department | Dept heads | Quarterly | Function-specific risks |

### Risk Review Agenda (Monthly Executive)
```
1. New risks identified this period (10 min)
2. Critical and High risk status updates (15 min)
3. Risks approaching materialization — early signals (10 min)
4. Mitigation action item review — on track? (10 min)
5. Risk appetite discussion — any policy updates needed? (5 min)
```

### Risk Appetite Statement
```
[Company] accepts:
- [Category] risks up to score [N] without mitigation
- Financial exposure up to $[X] per individual risk event

[Company] does NOT accept:
- Risks to customer data security without active mitigation
- Risks that would result in regulatory sanctions
- Risks that could cause more than [N] days of service disruption
```