Risk Assessment

The Process

Phase 1: Identify Risks

1. Brainstorm risks by category

   • For each category, ask "What could go wrong?"
   • Think from multiple perspectives (user, attacker, operator)
   • Consider both internal and external risks

2. Use risk prompts

   • What if this component fails?
   • What if traffic increases 10x?
   • What if a key person leaves?
   • What if a dependency breaks?
   • What if requirements change?
   • What if we're wrong about our assumptions?
   • What if an attacker targets this?
   • What if the timeline slips?

Phase 2: Analyze Risks

3. Assess likelihood

   • High: Likely to happen (>50%)
   • Medium: Could happen (10-50%)
   • Low: Unlikely but possible (<10%)

4. Assess impact

   • High: Catastrophic (system down, data loss, major cost)
   • Medium: Significant (degraded service, moderate cost)
   • Low: Minor (inconvenience, small cost)

5. Calculate risk score

   Risk Score = Likelihood × Impact
   High × High = Critical (act immediately)
   High × Medium = Major (act soon)
   Medium × High = Major (act soon)
   Medium × Medium = Moderate (plan mitigation)
   Low × anything = Monitor (watch for changes)
   

Phase 3: Plan Mitigation

6. Choose mitigation strategy

   Strategy	When to Use	Example
   Avoid	Risk is too high	Don't use the risky technology
   Reduce	Risk can be lowered	Add monitoring, add tests
   Transfer	Someone else can handle it	Use managed service, get insurance
   Accept	Risk is low or mitigation is too costly	Monitor and have a response plan

7. Create mitigation plan

   | Risk | Likelihood | Impact | Score | Strategy | Mitigation | Owner | Deadline |
   |------|-----------|--------|-------|----------|------------|-------|----------|
   | Risk 1 | High | High | Critical | Reduce | Add monitoring, add fallback | Who | When |
   

Phase 4: Monitor

8. Set up early warning

   • What signals indicate the risk is materializing?
   • How will we detect it early?
   • Who is responsible for monitoring?

9. Review and update

   • Re-assess risks regularly
   • Update based on new information
   • Close risks that are no longer relevant

Risk Assessment Report Template

Risk Assessment: [Target]
Date: [date]
Assessor: [who]

## Executive Summary
- Total risks identified: N
- Critical: N | Major: N | Moderate: N | Low: N
- Overall risk level: [High/Medium/Low]

## Risk Register
[Detailed table of all risks]

## Mitigation Plan
[Specific actions for each risk]

## Monitoring Plan
[How risks will be tracked]

## Residual Risk
[Risk level after mitigation]

Integration

Related skills: decision-framework, strategic-planning, quality-assurance