risk-cycle

What this skill does

# risk-cycle

Continuous risk identification, assessment, tracking, and retirement throughout SDLC.

## Triggers


Alternate expressions and non-obvious activations (primary phrases are matched automatically from the skill description):

- "RAG status" / "RED/AMBER/GREEN" → risk dashboard summary
- "risk register" → update or view risk register
- "RAID log" → Risks/Assumptions/Issues/Dependencies log

## Purpose

This skill manages continuous risk management by:
- Identifying new risks from project activities
- Assessing risk severity and probability
- Tracking mitigation progress
- Escalating overdue or critical risks
- Retiring completed risk mitigations
- Generating risk reports for stakeholders

## Behavior

When triggered, this skill:

1. **Reviews current state**:
   - Load risk register
   - Check mitigation status
   - Identify overdue items

2. **Identifies new risks**:
   - Analyze recent changes
   - Review technical decisions
   - Check external factors
   - Gather team input

3. **Assesses risks**:
   - Score probability and impact
   - Calculate risk score
   - Prioritize by exposure

4. **Plans mitigations**:
   - Assign owners
   - Define mitigation actions
   - Set target dates

5. **Tracks progress**:
   - Update mitigation status
   - Escalate overdue items
   - Retire completed risks

6. **Reports status**:
   - Generate risk dashboard
   - Highlight top risks
   - Show trend over time

## Risk Categories

### Technical Risks

```yaml
technical_risks:
  architecture:
    examples:
      - Scalability bottleneck
      - Single point of failure
      - Technology obsolescence
      - Integration complexity
    indicators:
      - Performance degradation
      - System failures
      - Upgrade difficulties

  development:
    examples:
      - Technical debt accumulation
      - Code quality issues
      - Testing gaps
      - Dependency vulnerabilities
    indicators:
      - Increasing bug count
      - Slower velocity
      - Failed deployments

  security:
    examples:
      - Data breach potential
      - Authentication weaknesses
      - Compliance gaps
      - Third-party risks
    indicators:
      - Security scan findings
      - Audit failures
      - Incident reports
```

### Project Risks

```yaml
project_risks:
  schedule:
    examples:
      - Scope creep
      - Delayed dependencies
      - Unrealistic estimates
      - Resource constraints
    indicators:
      - Missed milestones
      - Velocity decline
      - Scope changes

  resource:
    examples:
      - Key person dependency
      - Skill gaps
      - Team turnover
      - Burnout risk
    indicators:
      - Unbalanced workload
      - Low morale
      - Resignation signals

  stakeholder:
    examples:
      - Changing requirements
      - Sponsor availability
      - Organizational changes
      - Competing priorities
    indicators:
      - Decision delays
      - Priority conflicts
      - Reduced engagement
```

### External Risks

```yaml
external_risks:
  market:
    examples:
      - Competitor actions
      - Market shift
      - Economic factors
      - Regulatory changes
    indicators:
      - Market news
      - Competitor releases
      - Industry reports

  vendor:
    examples:
      - Vendor stability
      - API changes
      - Price increases
      - Support quality
    indicators:
      - Vendor communications
      - Service issues
      - Contract terms

  compliance:
    examples:
      - Regulatory requirements
      - Industry standards
      - Audit requirements
      - Data regulations
    indicators:
      - Regulatory updates
      - Audit findings
      - Compliance gaps
```

## Risk Assessment Matrix

### Probability Scoring

```yaml
probability:
  certain:
    score: 5
    likelihood: ">90%"
    description: "Almost certain to occur"

  likely:
    score: 4
    likelihood: "60-90%"
    description: "More likely than not"

  possible:
    score: 3
    likelihood: "30-60%"
    description: "Could occur"

  unlikely:
    score: 2
    likelihood: "10-30%"
    description: "Not expected but possible"

  rare:
    score: 1
    likelihood: "<10%"
    description: "Very unlikely"
```

### Impact Scoring

```yaml
impact:
  catastrophic:
    score: 5
    schedule: ">3 months delay"
    cost: ">50% budget"
    quality: "Unusable product"
    reputation: "Major damage"

  major:
    score: 4
    schedule: "1-3 months delay"
    cost: "25-50% budget"
    quality: "Significant defects"
    reputation: "Serious concern"

  moderate:
    score: 3
    schedule: "2-4 weeks delay"
    cost: "10-25% budget"
    quality: "Noticeable issues"
    reputation: "Some concern"

  minor:
    score: 2
    schedule: "1-2 weeks delay"
    cost: "5-10% budget"
    quality: "Minor issues"
    reputation: "Limited impact"

  negligible:
    score: 1
    schedule: "<1 week delay"
    cost: "<5% budget"
    quality: "Trivial issues"
    reputation: "No impact"
```

### Risk Score Matrix

```
           │ Impact
           │ 1   2   3   4   5
───────────┼─────────────────────
Prob    5  │ 5  10  15  20  25 ←Critical
        4  │ 4   8  12  16  20
        3  │ 3   6   9  12  15 ←High
        2  │ 2   4   6   8  10
        1  │ 1   2   3   4   5  ←Medium
           └─────────────────────
              ↑        ↑
              Low    Medium
```

```yaml
risk_levels:
  critical:
    range: [20, 25]
    response: "Immediate action required"
    escalation: "Executive notification"

  high:
    range: [12, 19]
    response: "Priority mitigation"
    escalation: "Manager notification"

  medium:
    range: [6, 11]
    response: "Planned mitigation"
    escalation: "Team lead notification"

  low:
    range: [1, 5]
    response: "Monitor and accept"
    escalation: "None required"
```

## Risk Register Format

```markdown
# Risk Register

**Project**: [Name]
**Last Updated**: 2025-12-08
**Next Review**: 2025-12-15

## Summary Dashboard

| Risk Level | Count | Trend |
|------------|-------|-------|
| Critical | 1 | ↑ +1 |
| High | 3 | → 0 |
| Medium | 8 | ↓ -2 |
| Low | 12 | → 0 |
| **Total** | **24** | - |

### Risk Trend

```
Week 1: ████████████████████████ 24 risks
Week 2: ██████████████████████ 22 risks
Week 3: ████████████████████████ 24 risks (2 new)
Week 4: ████████████████████████ 24 risks
                                   ↑ Stable with critical +1
```

## Active Risks

### RISK-001: Database Scalability [CRITICAL]

| Attribute | Value |
|-----------|-------|
| ID | RISK-001 |
| Title | Database Scalability Bottleneck |
| Category | Technical / Architecture |
| Probability | 4 (Likely) |
| Impact | 5 (Catastrophic) |
| Score | 20 (Critical) |
| Owner | Sarah Chen |
| Status | Mitigating |

**Description**:
Current PostgreSQL single-instance architecture cannot handle projected 10x traffic growth. Performance degradation expected within 6 months.

**Impact if Realized**:
- Service degradation or outage
- Customer churn
- Revenue loss estimated at $500K/month

**Mitigation Plan**:
1. [x] Evaluate sharding options (complete)
2. [x] Design read replica architecture (complete)
3. [ ] Implement connection pooling (in progress, due Dec 15)
4. [ ] Deploy read replicas (planned, due Jan 15)
5. [ ] Implement sharding (planned, due Feb 15)

**Contingency**:
Emergency vertical scaling + temporary traffic limiting

**Progress**:
```
[████████████░░░░░░░░] 60%
```

---

### RISK-002: Key Person Dependency [HIGH]

| Attribute | Value |
|-----------|-------|
| ID | RISK-002 |
| Title | Key Person Dependency on Lead Architect |
| Category | Project / Resource |
| Probability | 3 (Possible) |
| Impact | 4 (Major) |
| Score | 12 (High) |
| Owner | David Kim |
| Status | Mitigating |

**Description**:
Lead architect holds critical system knowledge. No backup identified.

**Mitigation Plan**:
1. [ ] Document architecture decisions (in progress)
2. [ ] Schedule knowledge transfer sessions
3. [ ] Identify and train backup

---

## Recently Retired Risks

### RISK-012: Third-Party A