Use when generating carve-out risk registers with probability x impact scoring, risk categories, mitigation plans, ownership, and top-risk prioritization.
Generate a project-specific risk register using carve-out risk patterns and templates.
Canonical Sources
BD_Risk-Register_template_en_V1.0_Dec2023.xlsx — the authoritative template for all new projects (V1.0 Dec 2023); use for structure, lookup ranges, and formatting
Existing project risk register generators (e.g. generate_bravo_risk_register.py) — template-handling code reference only; never copy their risk descriptions, categories, owners, dates, or mitigation plans
20240718_FRAME_IT Risk Assessment_completed.csv — FRAME reference data (methodology patterns only; never copy specific risk entries)
The Matrix sheet is template-owned and should not be structurally modified.
When saving with openpyxl, explicitly set black font on yellow-filled matrix cells (FFFFFF00, FFFFFFCC). Theme-inherited font colour may otherwise be lost on save, making yellow cells unreadable in Excel.
Include mitigation, owner, target date, and status per risk.
Use plain ASCII punctuation in generated narrative text where practical. Prefer - over an em dash in scripted workbook text to avoid encoding corruption in Excel-bound outputs.
Critical requirement: Risk identification must be systematic and comprehensive, evaluating all 17 risk categories and identifying realistic threats and opportunities specific to the project. A register with fewer than 15-20 risks (for standard IT carve-outs) is likely under-identified and will not meet M&A governance standards.
Process:
For each of the 17 categories, assess applicability to the project scope:
Not applicable categories (e.g. Market & Competitors, Raw Materials, Intellectual Property for IT-only carve-outs): Document and exclude with clear rationale
Applicable categories: Identify 1–3 realistic threats and 0–2 opportunities per category tied to project-specific factors (carve-out model, timeline, technology landscape, number of sites/users, TSA scope, manufacturing cutover, etc.)
Include at least 2 positive risks (opportunities) where carve-out enables strategic advantage or cost optimization (e.g., standalone infrastructure enables cloud migration, vendor consolidation OpEx savings, independent licensing negotiation leverage)
Ensure risk distribution across categories reflects true exposure: do not over-weight Schedule or under-weight Technology/Security
Risks must be project-specific — grounded in current engagement scope, not generic M&A templates
Positive risks (Opportunities): Where carve-out structure enables strategic advantage, must include response strategy of Exploit (maximize upside) or Enhance (strengthen enablement)
Risk Description Requirements: Detailed Causes and Events
Critical requirement: Risk Cause (column E) and Event (column F) must be detailed and context-specific, not abbreviated or generic.
Cause Column (E) — Root Factors with Project Quantification:
Include specific scope metrics: number of sites, users, applications, systems, timelines
Example INADEQUATE: "ISP leads"
Example ADEQUATE: "ISP lead times for 3 Singapore sites 8-12 weeks; provider allocation constraints; late RFQ submission by Apr 20"
Embed root drivers: supply chain delays, shared infrastructure, compressed UAT windows, change-of-control triggers, shared data boundaries, legacy system interdependencies
Reference specific project dates/milestones: GoLive Nov 7, hypercare Nov 8 - Feb 6, Phase 3 UAT Oct 5-31, QG4 gate Nov 1
Event Column (F) — Specific Failure Scenarios:
Describe the specific failure mechanism (not generic "delayed")
Tie to schedule impact: which phase affected, which milestone at risk, how many days delayed
Example INADEQUATE: "Network unavail"
Example ADEQUATE: "Network infrastructure not provisioned by Aug 1 (Phase 3 UAT target); redundant WAN circuits not available; Go-Live Nov 7 at risk; parallel run capacity insufficient"
Include concrete trigger conditions and impact pathways (GL posting failures → financial close delays, inventory accuracy drifts → revenue impact, support ticket volume 80-120/day vs 40 projected)
Quantify business impact where possible (EUR amounts, operational disruption hours, user population affected)
Best Reference: Examine active-projects/Zebra/Zebra_Risk_Register.xlsx rows 5-14 for professional elaboration pattern showing project-specific risk narratives.
Python Implementation Rules
Always add sys.path.insert(0, os.path.join(os.path.expanduser("~"), "py_packages")) before importing openpyxl.
The correct Python interpreter on this machine is C:/Program Files/px/python.exe.
Do not attempt to read existing .xls files as source data — they may be XML-format XLS which openpyxl cannot parse. Embed risk data directly in the generation script as a Python list/dict structure.
Use load_workbook(template_path) to open BD_Risk-Register_template_en_V1.0_Dec2023.xlsx; populate cells, then wb.save(output_path).
Output file must be .xlsx — never .xls or .csv only.
Generation Rules
Never copy risk entries, descriptions, causes, effects, owners, or mitigation plans from any existing project (Bravo, AlphaX, Falcon, Trinity, Hamburger, or any other).
Generate all risks fresh based on the current project's specific scope, complexity, timeline, carve-out model, and technical landscape (e.g. number of applications, SAP involvement, TSA, number of sites/users).
Keep risks specific to the current engagement parties and scope only.
Do not copy historical project facts (parties, dates, scope) from reference files or other project folders.
Risk register must be comprehensive: Systematically evaluate all 17 risk categories (see "Risk Identification: Comprehensive Category Evaluation" section above); identify 20–30 risks minimum for complex carve-outs; ensure causes and events are detailed and project-specific (not abbreviated).
Prioritize risks by P×I rating and delivery impact.
Ensure top risks align with schedule critical path and quality gates.
Always generate a .xlsx file using BD_Risk-Register_template_en_V1.0_Dec2023.xlsx as the base — not a blank workbook, not the old Risk_analysis_template.xlsx.
The output file must be saved to <ProjectName>/<ProjectName>_Risk_Register.xlsx.
Do not reference AlphaX/AlphaX_Risk_Register_Template.xlsx or Risk_analysis_template.xlsx as the template — they are deprecated.