legal-risk-scoring

What this skill does

## Scoring Model

### Two-Axis Evaluation Grid

Every legal risk is measured across two independent axes:

**Impact Magnitude** (consequences if the risk becomes reality):

| Rating | Descriptor | Meaning |
|---|---|---|
| 1 | **Trivial** | Minimal disruption; no meaningful financial, operational, or reputational consequence. Absorbed within day-to-day operations. |
| 2 | **Minor** | Contained impact; financial exposure under 1% of the relevant contract or transaction value; brief operational hiccup; no public visibility. |
| 3 | **Substantial** | Tangible impact; financial exposure in the 1-5% range of relevant value; noticeable operational interference; possibility of limited external attention. |
| 4 | **Serious** | Major impact; financial exposure between 5-25% of relevant value; significant operational disruption; probable public scrutiny; potential for regulatory interest. |
| 5 | **Severe** | Existential-level impact; financial exposure exceeding 25% of relevant value; core business operations threatened; material reputational harm; regulatory action anticipated; potential personal exposure for directors and officers. |

**Occurrence Probability** (how likely the risk is to materialize):

| Rating | Descriptor | Meaning |
|---|---|---|
| 1 | **Negligible** | Essentially theoretical; no known precedent in comparable situations; would demand extraordinary circumstances. |
| 2 | **Low** | Conceivable but not anticipated; sparse precedent; requires specific precipitating events. |
| 3 | **Moderate** | Plausible; some analogous situations have materialized; precipitating conditions are foreseeable. |
| 4 | **Elevated** | Expected to happen; clear precedent exists; precipitating conditions are commonplace in analogous contexts. |
| 5 | **Near Certain** | Virtually guaranteed; strong historical pattern; precipitating conditions are already present or imminent. |

### Computing the Score

**Risk Score = Impact Magnitude x Occurrence Probability**

| Score Band | Category | Indicator |
|---|---|---|
| 1-4 | **Baseline Risk** | GREEN |
| 5-9 | **Intermediate Risk** | YELLOW |
| 10-15 | **Elevated Risk** | ORANGE |
| 16-25 | **Acute Risk** | RED |

### Visual Grid

```
                     OCCURRENCE PROBABILITY
               Negligible  Low   Moderate  Elevated  Near Certain
                  (1)      (2)     (3)       (4)        (5)
IMPACT
Severe    (5) |   5    |   10   |   15   |   20   |     25     |
Serious   (4) |   4    |    8   |   12   |   16   |     20     |
Substantial(3)|   3    |    6   |    9   |   12   |     15     |
Minor     (2) |   2    |    4   |    6   |    8   |     10     |
Trivial   (1) |   1    |    2   |    3   |    4   |      5     |
```

## Category Profiles and Response Protocols

### GREEN -- Baseline Risk (Score 1-4)

**Profile**:
- Low-consequence issues with negligible probability
- Routine operational risks with well-established controls already in place
- Familiar risk patterns that the organization regularly manages

**Protocol**:
- **Accept**: Proceed with existing controls in place
- **Log**: Enter into the risk register for ongoing visibility
- **Periodic check**: Revisit during quarterly or annual review cycles
- **No escalation**: The responsible team member manages independently

**Typical scenarios**:
- Vendor agreement with a small deviation from preferred terms in a non-material area
- Standard confidentiality agreement with a reputable counterparty in a familiar jurisdiction
- Routine administrative compliance task with a clear owner and deadline

### YELLOW -- Intermediate Risk (Score 5-9)

**Profile**:
- Issues of moderate consequence that could arise under realistic conditions
- Risks deserving active attention without requiring emergency response
- Situations where precedent provides a management roadmap

**Protocol**:
- **Reduce exposure**: Deploy targeted controls or negotiate improved terms
- **Active surveillance**: Review monthly or upon occurrence of defined trigger events
- **Thorough documentation**: Capture the risk, all mitigation steps, and decision rationale in the register
- **Designated owner**: A specific individual holds accountability for tracking and mitigation
- **Stakeholder communication**: Relevant business contacts are informed of the risk and the mitigation approach
- **Escalation triggers**: Define specific conditions that would push this risk to a higher category

**Typical scenarios**:
- Agreement with a liability ceiling below the preferred level but within a negotiable range
- Vendor processing personal data in a territory with uncertain adequacy status
- Regulatory development that may affect a business line over the medium term
- IP provision that is broader than optimal but consistent with market practice

### ORANGE -- Elevated Risk (Score 10-15)

**Profile**:
- Weighty issues with a realistic chance of materializing
- Risks capable of producing significant financial, operational, or public-facing harm
- Situations demanding senior-level attention and structured mitigation

**Protocol**:
- **Senior counsel involvement**: Brief the head of legal or designated senior attorney
- **Structured mitigation plan**: Build a concrete, time-bound plan to reduce the risk
- **Leadership awareness**: Ensure relevant business leaders understand the risk and the recommended path
- **Frequent review**: Weekly check-ins or milestone-based reassessment
- **External counsel assessment**: Engage outside specialists for domain-specific guidance as warranted
- **Detailed written analysis**: Produce a full risk memorandum covering analysis, alternatives, and recommendations
- **Contingency planning**: Define the response playbook if the risk materializes

**Typical scenarios**:
- Agreement containing uncapped indemnification in a material obligation area
- Data processing operation that may violate regulatory requirements without restructuring
- Credible litigation threat from a significant counterparty
- Intellectual property infringement allegation with a plausible basis
- Formal regulatory inquiry or audit notification

### RED -- Acute Risk (Score 16-25)

**Profile**:
- The most consequential issues, with high or near-certain probability of materializing
- Risks that threaten fundamental business viability, expose officers and directors, or endanger key stakeholders
- Demands immediate executive engagement and rapid mobilization

**Protocol**:
- **Immediate executive briefing**: Notify General Counsel, C-suite, and Board as the situation warrants
- **Outside counsel retention**: Engage specialized external lawyers without delay
- **Dedicated response team**: Stand up a cross-functional team with clearly defined roles and authority
- **Insurance notification**: Alert carriers where coverage may apply
- **Crisis protocols**: Activate crisis management procedures when reputational exposure exists
- **Evidence preservation**: Institute a litigation hold if legal proceedings are a possibility
- **Continuous monitoring**: Daily or more frequent status reviews until resolved or downgraded
- **Board-level reporting**: Include in governance risk reporting as appropriate
- **Regulatory communication**: File any mandatory regulatory notifications

**Typical scenarios**:
- Pending litigation with substantial financial exposure
- Personal data breach affecting regulated information
- Active regulatory enforcement proceeding
- Material breach of or against the organization under a significant contract
- Government investigation
- Infringement claim targeting a core product or revenue-generating service

## Formal Documentation Standards

### Risk Assessment Memorandum

Every formal evaluation should follow this structure:

```

## Legal Risk Evaluation

**Prepared**: [date]
**Analyst**: [name of person conducting the evaluation]
**Subject**: [description of the matter under review]
**Privilege designation**: [Yes/No -- mark as attorney-client privileged where applicable]

### 1. Risk Statement
[Precise