# Legal Risk Scoring

> Score legal risks by severity and likelihood, assign ratings, and document escalation paths.

- Skill: `vm0-ai/legal-risk-scoring` (Agent Skill)
- Install (CLI): `npx skillmds@latest add vm0-ai/legal-risk-scoring`
- Raw SKILL.md: https://api.skillmd.com/api/skills/vm0-ai/legal-risk-scoring/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: vm0-ai (https://skillmd.com/u/vm0-ai)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/vm0-ai/legal-risk-scoring

---


## Scoring Model

### Two-Axis Evaluation Grid

Every legal risk is measured across two independent axes:

**Impact Magnitude** (consequences if the risk becomes reality):

| Rating | Descriptor | Meaning |
|---|---|---|
| 1 | **Trivial** | Minimal disruption; no meaningful financial, operational, or reputational consequence. Absorbed within day-to-day operations. |
| 2 | **Minor** | Contained impact; financial exposure under 1% of the relevant contract or transaction value; brief operational hiccup; no public visibility. |
| 3 | **Substantial** | Tangible impact; financial exposure in the 1-5% range of relevant value; noticeable operational interference; possibility of limited external attention. |
| 4 | **Serious** | Major impact; financial exposure between 5-25% of relevant value; significant operational disruption; probable public scrutiny; potential for regulatory interest. |
| 5 | **Severe** | Existential-level impact; financial exposure exceeding 25% of relevant value; core business operations threatened; material reputational harm; regulatory action anticipated; potential personal exposure for directors and officers. |

**Occurrence Probability** (how likely the risk is to materialize):

| Rating | Descriptor | Meaning |
|---|---|---|
| 1 | **Negligible** | Essentially theoretical; no known precedent in comparable situations; would demand extraordinary circumstances. |
| 2 | **Low** | Conceivable but not anticipated; sparse precedent; requires specific precipitating events. |
| 3 | **Moderate** | Plausible; some analogous situations have materialized; precipitating conditions are foreseeable. |
| 4 | **Elevated** | Expected to happen; clear precedent exists; precipitating conditions are commonplace in analogous contexts. |
| 5 | **Near Certain** | Virtually guaranteed; strong historical pattern; precipitating conditions are already present or imminent. |

### Computing the Score

**Risk Score = Impact Magnitude x Occurrence Probability**

| Score Band | Category | Indicator |
|---|---|---|
| 1-4 | **Baseline Risk** | GREEN |
| 5-9 | **Intermediate Risk** | YELLOW |
| 10-15 | **Elevated Risk** | ORANGE |
| 16-25 | **Acute Risk** | RED |

### Visual Grid

```
                     OCCURRENCE PROBABILITY
               Negligible  Low   Moderate  Elevated  Near Certain
                  (1)      (2)     (3)       (4)        (5)
IMPACT
Severe    (5) |   5    |   10   |   15   |   20   |     25     |
Serious   (4) |   4    |    8   |   12   |   16   |     20     |
Substantial(3)|   3    |    6   |    9   |   12   |     15     |
Minor     (2) |   2    |    4   |    6   |    8   |     10     |
Trivial   (1) |   1    |    2   |    3   |    4   |      5     |
```

## Category Profiles and Response Protocols

### GREEN -- Baseline Risk (Score 1-4)

**Profile**:
- Low-consequence issues with negligible probability
- Routine operational risks with well-established controls already in place
- Familiar risk patterns that the organization regularly manages

**Protocol**:
- **Accept**: Proceed with existing controls in place
- **Log**: Enter into the risk register for ongoing visibility
- **Periodic check**: Revisit during quarterly or annual review cycles
- **No escalation**: The responsible team member manages independently

**Typical scenarios**:
- Vendor agreement with a small deviation from preferred terms in a non-material area
- Standard confidentiality agreement with a reputable counterparty in a familiar jurisdiction
- Routine administrative compliance task with a clear owner and deadline

### YELLOW -- Intermediate Risk (Score 5-9)

**Profile**:
- Issues of moderate consequence that could arise under realistic conditions
- Risks deserving active attention without requiring emergency response
- Situations where precedent provides a management roadmap

**Protocol**:
- **Reduce exposure**: Deploy targeted controls or negotiate improved terms
- **Active surveillance**: Review monthly or upon occurrence of defined trigger events
- **Thorough documentation**: Capture the risk, all mitigation steps, and decision rationale in the register
- **Designated owner**: A specific individual holds accountability for tracking and mitigation
- **Stakeholder communication**: Relevant business contacts are informed of the risk and the mitigation approach
- **Escalation triggers**: Define specific conditions that would push this risk to a higher category

**Typical scenarios**:
- Agreement with a liability ceiling below the preferred level but within a negotiable range
- Vendor processing personal data in a territory with uncertain adequacy status
- Regulatory development that may affect a business line over the medium term
- IP provision that is broader than optimal but consistent with market practice

### ORANGE -- Elevated Risk (Score 10-15)

**Profile**:
- Weighty issues with a realistic chance of materializing
- Risks capable of producing significant financial, operational, or public-facing harm
- Situations demanding senior-level attention and structured mitigation

**Protocol**:
- **Senior counsel involvement**: Brief the head of legal or designated senior attorney
- **Structured mitigation plan**: Build a concrete, time-bound plan to reduce the risk
- **Leadership awareness**: Ensure relevant business leaders understand the risk and the recommended path
- **Frequent review**: Weekly check-ins or milestone-based reassessment
- **External counsel assessment**: Engage outside specialists for domain-specific guidance as warranted
- **Detailed written analysis**: Produce a full risk memorandum covering analysis, alternatives, and recommendations
- **Contingency planning**: Define the response playbook if the risk materializes

**Typical scenarios**:
- Agreement containing uncapped indemnification in a material obligation area
- Data processing operation that may violate regulatory requirements without restructuring
- Credible litigation threat from a significant counterparty
- Intellectual property infringement allegation with a plausible basis
- Formal regulatory inquiry or audit notification

### RED -- Acute Risk (Score 16-25)

**Profile**:
- The most consequential issues, with high or near-certain probability of materializing
- Risks that threaten fundamental business viability, expose officers and directors, or endanger key stakeholders
- Demands immediate executive engagement and rapid mobilization

**Protocol**:
- **Immediate executive briefing**: Notify General Counsel, C-suite, and Board as the situation warrants
- **Outside counsel retention**: Engage specialized external lawyers without delay
- **Dedicated response team**: Stand up a cross-functional team with clearly defined roles and authority
- **Insurance notification**: Alert carriers where coverage may apply
- **Crisis protocols**: Activate crisis management procedures when reputational exposure exists
- **Evidence preservation**: Institute a litigation hold if legal proceedings are a possibility
- **Continuous monitoring**: Daily or more frequent status reviews until resolved or downgraded
- **Board-level reporting**: Include in governance risk reporting as appropriate
- **Regulatory communication**: File any mandatory regulatory notifications

**Typical scenarios**:
- Pending litigation with substantial financial exposure
- Personal data breach affecting regulated information
- Active regulatory enforcement proceeding
- Material breach of or against the organization under a significant contract
- Government investigation
- Infringement claim targeting a core product or revenue-generating service

## Formal Documentation Standards

### Risk Assessment Memorandum

Every formal evaluation should follow this structure:

```

## Legal Risk Evaluation

**Prepared**: [date]
**Analyst**: [name of person conducting the evaluation]
**Subject**: [description of the matter under review]
**Privilege designation**: [Yes/No -- mark as attorney-client privileged where applicable]

### 1. Risk Statement
[Precise, concise articulation of the legal risk]

### 2. Factual Background
[Relevant facts, chronology, and business context]

### 3. Scoring Analysis

#### Impact Magnitude: [1-5] - [Descriptor]
[Supporting rationale including potential financial exposure, operational consequences, and reputational dimensions]

#### Occurrence Probability: [1-5] - [Descriptor]
[Supporting rationale including precedent, triggering conditions, and current circumstances]

#### Composite Score: [Number] - [GREEN/YELLOW/ORANGE/RED]

### 4. Aggravating Factors
[Elements that amplify the risk]

### 5. Countervailing Factors
[Elements that dampen the risk or contain exposure]

### 6. Mitigation Alternatives

| Alternative | Effectiveness | Resource Demand | Recommended? |
|---|---|---|---|
| [Option A] | [High/Med/Low] | [High/Med/Low] | [Yes/No] |
| [Option B] | [High/Med/Low] | [High/Med/Low] | [Yes/No] |

### 7. Recommended Course of Action
[Specific recommendation with supporting rationale]

### 8. Post-Mitigation Risk Level
[Projected risk category after implementing recommended measures]

### 9. Ongoing Monitoring Plan
[Frequency and method of review; conditions that would trigger reassessment]

### 10. Immediate Next Steps
1. [Task - Responsible party - Due date]
2. [Task - Responsible party - Due date]
```

### Risk Register Format

For entry into the team's centralized risk tracker:

| Field | Content |
|---|---|
| Identifier | Unique tracking code |
| Discovery Date | When the risk first came to light |
| Summary | Brief characterization |
| Domain | Contract / Regulatory / Litigation / IP / Data Privacy / Employment / Corporate / Other |
| Impact Rating | 1-5 with descriptor |
| Probability Rating | 1-5 with descriptor |
| Composite Score | Calculated value |
| Category | GREEN / YELLOW / ORANGE / RED |
| Accountable Person | Individual responsible for monitoring |
| Active Controls | Mitigations currently deployed |
| Disposition | Open / Mitigated / Accepted / Closed |
| Next Review | Scheduled reassessment date |
| Remarks | Supplementary context |

## Criteria for Engaging Outside Counsel

### Situations Requiring External Representation

- **Filed litigation**: Any lawsuit brought by or against the organization
- **Government proceedings**: Any inquiry from a regulatory agency, government body, or law enforcement
- **Criminal risk**: Any scenario involving potential criminal liability for the entity or its people
- **Capital markets implications**: Any matter that could affect securities disclosures or regulatory filings
- **Governance-level matters**: Any issue necessitating board notification or board-level approval

### Situations Strongly Favoring External Engagement

- **Uncharted legal territory**: Questions lacking settled authority where the organization's position could establish precedent
- **Multi-jurisdictional complexity**: Matters spanning unfamiliar or conflicting legal regimes
- **Outsized financial stakes**: Exposure exceeding the organization's defined risk appetite thresholds
- **Specialist knowledge gaps**: Subject areas not covered by in-house expertise (antitrust, anti-corruption, patent prosecution, etc.)
- **Major regulatory shifts**: New legal frameworks that require compliance program construction or significant adaptation
- **Strategic transactions**: Mergers, acquisitions, or major deals requiring diligence, structuring, and regulatory clearance

### Situations Worth Evaluating for External Support

- **Significant contractual disputes**: Substantial disagreements over interpretation with important business partners
- **Workforce claims**: Actual or threatened claims involving discrimination, harassment, wrongful termination, or retaliation
- **Data security events**: Incidents that may trigger mandatory notification duties
- **IP conflicts**: Infringement allegations (inbound or outbound) involving material products or services
- **Coverage disagreements**: Disputes with insurance carriers over claim coverage

### Selecting the Right Firm

When recommending outside engagement, prompt the user to weigh:
- Subject matter depth and track record
- Familiarity with the relevant jurisdiction
- Industry sector experience
- Conflict clearance status
- Fee structure expectations (hourly, flat, blended, contingency)
- Firm diversity commitments
- Pre-existing relationships (panel membership, prior engagements)