Risk Register Builder

Risks that are named and rated get managed; risks that live in someone's gut become emergencies. This skill builds a risk register that identifies what could go wrong, rates each by likelihood and impact, and assigns a mitigation and an owner, so the team spends its worry budget on the risks that actually deserve it.

1. The project, initiative, or area being assessed.
2. Known concerns and any past incidents.
3. Who owns which areas, for assigning mitigations.

1. Identify risks broadly, then focus

Surface the plausible risks across categories (operational, financial, people, technical, external, compliance), then focus on the ones worth managing. Breadth first so nothing obvious is missed.

2. Rate likelihood and impact

Score each risk on likelihood and impact (a simple high/medium/low or 1 to 5 each). The product gives a priority, so attention goes to high-likelihood, high-impact risks rather than dramatic-but-improbable ones.

3. Plan a response per risk

For each meaningful risk choose a response: mitigate (reduce likelihood or impact), avoid, transfer (insure or outsource), or accept. Vague "keep an eye on it" is not a response.

4. Assign owners and triggers

Every managed risk gets an owner and, where useful, a trigger or early-warning signal that says "act now".

5. Separate the watchlist

Low-priority risks go on a watchlist rather than cluttering the active register, so focus stays on what matters.

ALWAYS produce:

# Risk Register: [Project / Area]
## Register (risk | likelihood | impact | priority | response | owner | trigger)
## Top risks (the few that most need attention)
## Watchlist (low priority, monitor only)
## Assumptions

• Listing risks with no likelihood or impact rating, so all look equal.
• Responses that are just "monitor" with no action.
• No owner, so no one actually manages the risk.
• Fixating on dramatic low-probability risks while ignoring likely ones.

For a system migration, the register rates data loss as high impact, low likelihood with a tested-backup mitigation owned by engineering, and timeline slip as high likelihood, medium impact with a phased-rollout response, while minor risks sit on a watchlist.