flow-risk-management-cycle

What this skill does

# Risk Management Cycle Orchestration Flow

**You are the Core Orchestrator** for continuous risk management throughout the SDLC.

## Your Role

**You orchestrate multi-agent workflows. You do NOT execute bash scripts.**

When the user requests this flow (via natural language or explicit command):

1. **Interpret the request** and confirm understanding
2. **Read this template** as your orchestration guide
3. **Extract agent assignments** and workflow steps
4. **Launch agents via Task tool** in correct sequence
5. **Synthesize results** and finalize artifacts
6. **Report completion** with summary

## Risk Management Overview

**Purpose**: Maintain continuous visibility into project risks, proactively retire technical and business risks before they become blockers, and ensure the team operates with acceptable risk tolerance throughout all SDLC phases.

**Key Activities**:
- Risk identification (business, technical, security)
- Risk assessment (probability × impact scoring)
- Risk mitigation planning (spikes, POCs)
- Risk tracking and monitoring
- Risk retirement validation

**Expected Duration**: 90-minute workshop + 2-5 days for spikes, 10-15 minutes orchestration

## Natural Language Triggers

Users may say:
- "Update risks"
- "Review risks"
- "Manage risks"
- "Risk assessment"
- "Identify new risks"
- "Conduct risk workshop"
- "Retire risks"

You recognize these as requests for this orchestration flow.

## Parameter Handling

### --guidance Parameter

**Purpose**: User provides upfront direction to tailor risk management priorities

**Examples**:
```
--guidance "Focus on security risks, compliance audit in 3 months"
--guidance "Performance risks are critical, need sub-100ms p95 validation"
--guidance "Tight timeline, prioritize Show Stopper risks only"
--guidance "Team lacks DevOps experience, infrastructure risks need extra attention"
```

**How to Apply**:
- Parse guidance for keywords: security, performance, compliance, timeline, team skills
- Adjust agent assignments (add security-architect, privacy-officer for compliance focus)
- Modify risk assessment depth (comprehensive vs. focused on specific categories)
- Influence spike/POC scope (minimal vs. comprehensive validation)

### --interactive Parameter

**Purpose**: You ask 6 strategic questions to understand risk context

**Questions to Ask** (if --interactive):

```
I'll ask 6 strategic questions to tailor risk management to your project's needs:

Q1: What are your top priorities for this risk cycle?
    (e.g., security validation, performance proof, compliance readiness)

Q2: What are your biggest constraints?
    (e.g., tight timeline, limited budget, small team)

Q3: What risks concern you most for this workflow?
    (e.g., technical unknowns, third-party dependencies, regulatory changes)

Q4: What's your team's experience level with this type of activity?
    (Helps me gauge risk assessment calibration and spike scope)

Q5: What's your target timeline?
    (Influences spike duration and mitigation planning depth)

Q6: Are there compliance or regulatory requirements?
    (e.g., HIPAA, SOC2, PCI-DSS - affects security/privacy risk focus)

Based on your answers, I'll adjust:
- Agent assignments (add specialized risk assessors)
- Risk category focus (security-first vs. performance-first)
- Spike/POC scope (minimal vs. comprehensive)
- Workshop agenda emphasis (technical vs. business vs. operational)
```

**Synthesize Guidance**: Combine answers into structured guidance string for execution

### --iteration Parameter

**Purpose**: Track risk cycles per iteration (bi-weekly or per sprint)

**Usage**: `--iteration 3` (Elaboration Iteration 3) or `--iteration Construction-5` (Construction Iteration 5)

## Risk Management Philosophy

**Proactive Risk Management**:
- Risks are identified early, tracked continuously, and retired systematically
- High-risk assumptions are validated via spikes/POCs before committing resources
- Show Stopper risks are escalated immediately and require executive decision
- Risk retirement is a primary objective of Elaboration phase (70%+ retired by ABM)

**Risk Categorization**:
- **Show Stopper (P0)**: Project cannot proceed without resolution (score 21-25)
- **High (P1)**: Major impact to schedule, scope, or quality (score 16-20)
- **Medium (P2)**: Moderate impact, workarounds available (score 11-15)
- **Low (P3)**: Minor impact, can be deferred (score 1-10)

## Artifacts to Generate

**Primary Deliverables**:
- **Risk Identification Workshop Notes**: New risks and status updates → `.aiwg/risks/risk-workshop-{date}.md`
- **Risk Assessment Report**: Prioritized risk list with scoring → `.aiwg/risks/risk-assessment-{date}.md`
- **Updated Risk List**: Current status of all risks → `.aiwg/risks/risk-list.md`
- **Spike Results**: POC findings for high-priority risks → `.aiwg/risks/spike-{risk-id}-results.md`
- **Risk Retirement Report**: Validation evidence and metrics → `.aiwg/risks/risk-retirement-report.md`
- **Risk Escalation Briefs**: Show Stopper risk decisions → `.aiwg/risks/risk-escalation-{risk-id}.md`
- **Risk Status Report**: Stakeholder summary → `.aiwg/risks/risk-status-report-{date}.md`

**Supporting Artifacts**:
- Risk validation documents (analysis-based retirements)
- POC code and benchmarks (working directory)
- Complete audit trails (archived workflows)

## Multi-Agent Orchestration Workflow

### Step 1: Conduct Risk Identification Workshop

**Purpose**: Facilitate regular risk identification session with project team

**Your Actions**:

1. **Check Workshop Frequency**:
   ```
   Read current project phase from .aiwg/intake/project-intake.md or .aiwg/planning/phase-plan-*.md

   Workshop frequency by phase:
   - Inception: Weekly (rapid discovery of unknowns)
   - Elaboration: Bi-weekly (validate architectural risks)
   - Construction: Bi-weekly per iteration (identify delivery risks)
   - Transition: Weekly (production readiness risks)
   ```

2. **Load Current Context**:
   ```
   Read:
   - .aiwg/risks/risk-list.md (current risk status)
   - .aiwg/intake/project-intake.md (project scope and constraints)
   - Recent changes (if accessible via git log or documentation)
   ```

3. **Launch Workshop Facilitation Agents** (parallel):
   ```
   # Agent 1: Project Manager (Workshop Facilitator)
   Task(
       subagent_type="project-manager",
       description="Facilitate risk identification workshop",
       prompt="""
       Read current risk list: .aiwg/risks/risk-list.md

       Facilitate 90-minute risk identification workshop:

       Agenda:
       1. Review Previous Risks (15 min)
          - Status update on existing risks
          - Validate risk retirements
          - Re-assess probabilities and impacts

       2. Identify New Risks (30 min)
          - Technical risks (architecture, performance, scalability)
          - Business risks (requirements changes, resource availability)
          - Security risks (vulnerabilities, compliance)
          - Operational risks (deployment, monitoring, support)
          - External risks (third-party dependencies, vendor delays)

       3. Prioritize Risks (20 min)
          - Score probability (1-5): 1=Rare, 5=Almost Certain
          - Score impact (1-5): 1=Negligible, 5=Catastrophic
          - Calculate risk score: Probability × Impact (1-25)
          - Categorize: Show Stopper (21-25), High (16-20), Medium (11-15), Low (1-10)

       4. Plan Mitigation Actions (20 min)
          - Show Stopper: Immediate action plan, executive escalation
          - High: Spike/POC to validate assumptions (1-3 days)
          - Medium: Monitoring plan, deferred action
          - Low: Accept and monitor

       5. Assign Ownership (5 min)
          - Each risk assigned to specific owner
          - Due dates for spikes and mitigation actions
          - Re-assessment date scheduled

       Risk Identification Prompts:
       - "What technical unknowns remain?"
       - "What assumptions are we making that could be