Risk Register Legal

risk-register-legal

Agent: Corporate Counsel

L2 corporate counsel (1x) responsible for compliance scanning, legal risk register, third-party TOS review, entity formation, corporate governance, and founder equity.

Department ethos: ideal-legal.md

Skill Description

Builds and maintains the legal risk register by identifying, categorizing, and prioritizing contractual, regulatory, IP, and litigation risks across the organization.

When to Use

• When the company needs a consolidated view of its legal risk exposure for board reporting or investor due diligence.
• When entering a new market, launching a new product, or signing a material contract that introduces new legal risks.
• When a compliance scan or third-party TOS review surfaces risks that need ongoing tracking and mitigation.

Workflow

1. Risk Identification: Gather legal risks from all sources using the risk taxonomy in references/framework.md (six categories: contractual, regulatory, IP, employment, litigation, corporate governance). Collect from compliance scans, contract reviews, regulatory changes, employee matters, IP concerns, and pending or threatened claims. Deliverable: raw risk inventory.
2. Risk Assessment: Evaluate each risk using the likelihood scale (1-5) and impact scale (1-5) from references/framework.md. Calculate risk score (Likelihood x Impact) and map to severity bands (Critical: 15-25, High: 9-14, Medium: 5-8, Low: 1-4). Categorize by type per the risk taxonomy. Assign response type (avoid, mitigate, transfer, accept). Deliverable: assessed risk register with severity matrix.
3. Mitigation Planning: Define mitigation actions for each high and critical risk. Assign owners, set deadlines, estimate mitigation costs, and identify risks requiring insurance coverage or external counsel. Deliverable: mitigation plan with ownership assignments.
4. Register Maintenance: Update the register per the cadence defined in references/framework.md (quarterly review, plus ad hoc triggers for new products, material contracts, regulatory changes, security incidents, litigation, M&A). Track mitigation progress, close resolved risks, and add newly identified risks. Deliverable: updated risk register with change log.
5. Reporting: Produce the risk register report using template at assets/risk-register-template.md. Follow the board report format in references/framework.md: dashboard, top 5 risks, new risks, closed risks, overdue mitigations. Prepare summaries for the board, executive team, and auditors. Deliverable: risk report for stakeholders.

Anti-Patterns

• Risk hoarding: Maintaining the risk register in legal without sharing it with the executive team or board. Why: legal risks affect business decisions; stakeholders cannot make informed choices without visibility into the risk landscape.
• Assessment without mitigation: Identifying and scoring risks without defining mitigation actions or owners. Why: an unactioned risk register provides awareness but no risk reduction, creating a false sense of security.
• Static severity ratings: Never re-evaluating risk scores as the business or regulatory environment changes. Why: a risk rated low at seed stage (e.g., data privacy) may become critical at scale, and the register must reflect current reality.

Output

On success: Produces an assessed risk register with severity matrix, mitigation plan, and stakeholder report. Delivered quarterly with ad hoc updates for material events.

On failure: Report which risk domains could not be assessed (e.g., insufficient contract access, pending litigation under privilege review), what partial coverage exists, and what information is needed. Escalate to General Counsel.

Related Skills

• compliance-scanner -- Compliance gaps identified by the scanner feed into the risk register as regulatory risks.
• third-party-tos-reviewer -- TOS reviews surface contractual risks that the register must track.