Risk Assessment
Make uncertainty legible before it becomes a surprise. Separate known risks, known unknowns, and unknown unknowns; choose mitigate, accept, avoid, or transfer with clear triggers.
When to Use
- Launching changes, signing commitments, or operating under tight SLAs.
- Decisions where failure modes are plausible but not yet quantified.
Workflow
- List risks by source (technical, people, vendor, legal, security, reputation); include “silent” dependencies.
- Probability × impact: use coarse bands (e.g., low/med/high) if data is thin; note confidence in each rating.
- Plot on a matrix; highlight top-right cluster as the review set.
- Scenarios: sketch best / base / worst; name drivers that flip between them.
- Pre-mortem: “It’s six months from now and we failed—why?” generate failure stories, then back-map preventions.
- Black swan probe: where would a single external shock dominate? Avoid false precision; flag monitoring needs.
- Strategies per risk: mitigate (reduce P or I), accept (explicit owner), avoid (change approach), transfer (insurance, contract).
- Escalation triggers: define observable signals and who decides when to pivot or stop.
- Risk appetite: align tactics with how much downside the team/org can absorb this quarter.
Examples
Example 1: New integration: probability/impact on auth outages; pre-mortem on credential rotation; mitigation runbooks + on-call threshold.
Example 2: Vendor dependency: scenario on vendor exit; contract and data portability as mitigation; executive trigger if SLA breaches twice.
1---2name: risk-assessment-23description: Risk Assessment4---5# Risk Assessment67Make uncertainty legible before it becomes a surprise. Separate known risks, known unknowns, and unknown unknowns; choose mitigate, accept, avoid, or transfer with clear triggers.89## When to Use10- Launching changes, signing commitments, or operating under tight SLAs.11- Decisions where failure modes are plausible but not yet quantified.1213## Workflow141. **List risks** by source (technical, people, vendor, legal, security, reputation); include “silent” dependencies.152. **Probability × impact**: use coarse bands (e.g., low/med/high) if data is thin; note confidence in each rating.163. **Plot** on a matrix; highlight top-right cluster as the review set.174. **Scenarios**: sketch best / base / worst; name drivers that flip between them.185. **Pre-mortem**: “It’s six months from now and we failed—why?” generate failure stories, then back-map preventions.196. **Black swan probe**: where would a single external shock dominate? Avoid false precision; flag monitoring needs.207. **Strategies per risk**: mitigate (reduce P or I), accept (explicit owner), avoid (change approach), transfer (insurance, contract).218. **Escalation triggers**: define observable signals and who decides when to pivot or stop.229. **Risk appetite**: align tactics with how much downside the team/org can absorb this quarter.2324## Examples25**Example 1:** New integration: probability/impact on auth outages; pre-mortem on credential rotation; mitigation runbooks + on-call threshold.2627**Example 2:** Vendor dependency: scenario on vendor exit; contract and data portability as mitigation; executive trigger if SLA breaches twice.
sethdford