# Risk Register Legal

> This skill builds and maintains the legal risk register covering contractual, regulatory, and litigation risks. Use when asked to assess legal risks, create a risk register, or prioritize legal exposures. Also consider when entering new markets or signing material contracts. Suggest when the user is scaling operations without tracking legal risks.

- Skill: `mittuled/risk-register-legal` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add mittuled/risk-register-legal`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mittuled/risk-register-legal/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: mittuled (https://skillmd.com/u/mittuled)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/mittuled/risk-register-legal

---


# risk-register-legal

## Agent: Corporate Counsel

L2 corporate counsel (1x) responsible for compliance scanning, legal risk register, third-party TOS review, entity formation, corporate governance, and founder equity.

Department ethos: [ideal-legal.md](../../../../departments/legal/ideal-legal.md)

## Skill Description

Builds and maintains the legal risk register by identifying, categorizing, and prioritizing contractual, regulatory, IP, and litigation risks across the organization.

## When to Use

- When the company needs a consolidated view of its legal risk exposure for board reporting or investor due diligence.
- When entering a new market, launching a new product, or signing a material contract that introduces new legal risks.
- When a compliance scan or third-party TOS review surfaces risks that need ongoing tracking and mitigation.

## Workflow

1. **Risk Identification**: Gather legal risks from all sources using the risk taxonomy in `references/framework.md` (six categories: contractual, regulatory, IP, employment, litigation, corporate governance). Collect from compliance scans, contract reviews, regulatory changes, employee matters, IP concerns, and pending or threatened claims. Deliverable: raw risk inventory.
2. **Risk Assessment**: Evaluate each risk using the likelihood scale (1-5) and impact scale (1-5) from `references/framework.md`. Calculate risk score (Likelihood x Impact) and map to severity bands (Critical: 15-25, High: 9-14, Medium: 5-8, Low: 1-4). Categorize by type per the risk taxonomy. Assign response type (avoid, mitigate, transfer, accept). Deliverable: assessed risk register with severity matrix.
3. **Mitigation Planning**: Define mitigation actions for each high and critical risk. Assign owners, set deadlines, estimate mitigation costs, and identify risks requiring insurance coverage or external counsel. Deliverable: mitigation plan with ownership assignments.
4. **Register Maintenance**: Update the register per the cadence defined in `references/framework.md` (quarterly review, plus ad hoc triggers for new products, material contracts, regulatory changes, security incidents, litigation, M&A). Track mitigation progress, close resolved risks, and add newly identified risks. Deliverable: updated risk register with change log.
5. **Reporting**: Produce the risk register report using template at `assets/risk-register-template.md`. Follow the board report format in `references/framework.md`: dashboard, top 5 risks, new risks, closed risks, overdue mitigations. Prepare summaries for the board, executive team, and auditors. Deliverable: risk report for stakeholders.

## Anti-Patterns

- **Risk hoarding**: Maintaining the risk register in legal without sharing it with the executive team or board. *Why*: legal risks affect business decisions; stakeholders cannot make informed choices without visibility into the risk landscape.
- **Assessment without mitigation**: Identifying and scoring risks without defining mitigation actions or owners. *Why*: an unactioned risk register provides awareness but no risk reduction, creating a false sense of security.
- **Static severity ratings**: Never re-evaluating risk scores as the business or regulatory environment changes. *Why*: a risk rated low at seed stage (e.g., data privacy) may become critical at scale, and the register must reflect current reality.

## Output

**On success**: Produces an assessed risk register with severity matrix, mitigation plan, and stakeholder report. Delivered quarterly with ad hoc updates for material events.

**On failure**: Report which risk domains could not be assessed (e.g., insufficient contract access, pending litigation under privilege review), what partial coverage exists, and what information is needed. Escalate to General Counsel.

## Related Skills

- [`compliance-scanner`](../compliance-scanner/SKILL.md) -- Compliance gaps identified by the scanner feed into the risk register as regulatory risks.
- [`third-party-tos-reviewer`](../third-party-tos-reviewer/SKILL.md) -- TOS reviews surface contractual risks that the register must track.