Assess and Mitigate Project Risks

This skill builds risk assessment matrices for systematic risk identification, quantitative analysis, and mitigation planning. Its scoring framework rates probability and impact each 1-5, multiplies them into a risk score from 1-25, and buckets that score into risk levels - Low (1-6), Medium (8-12), High (15-20), Critical (25) - across five risk categories: technical, operational, external, organizational, and financial. It provides a risk register table template tracking each risk's ID, category, description, probability, impact, score, monetary exposure, owner, and status.

Quantitative analysis covers Expected Monetary Value calculation (probability percentage times impact cost) and portfolio-level analysis that aggregates total EMV, average probability, and maximum single exposure across a set of risks. Risk responses follow four named strategies - avoid, mitigate, transfer, accept - backed by a mitigation ROI calculator that weighs risk reduction against mitigation cost. Advanced techniques include a Monte Carlo simulation that runs 10,000 scenario iterations to estimate mean, 95th-percentile, and maximum cost outcomes, and a dynamic risk-scoring class that adjusts probability upward as a deadline approaches and downward as mitigation effectiveness increases.

Risk communication uses an executive dashboard format (overall risk level, total exposure, critical risk count, mitigation budget, and a top-5 risk list each with score, impact, mitigation status, owner, and target date). Risk register best practices call for unique sequential IDs, SMART risk descriptions, review cadence scaled to severity (weekly for high risks, monthly for medium/low), individual (not team) ownership, defined trigger conditions, prepared contingency plans, and documenting lessons from materialized risks. Monitoring tracks six key risk indicators (schedule variance, budget burn rate, team velocity decline, stakeholder satisfaction, technical debt, vendor performance) against five escalation triggers (a risk score jump over 25%, critical path activities at risk, budget variance exceeding 10%, multiple related risks trending upward, or mitigation strategies failing to reduce exposure).

def calculate_emv(probability_percent, impact_cost):
    """
    Calculate Expected Monetary Value for risk
    probability_percent: 0-100
    impact_cost: monetary value if risk occurs
    """
    return (probability_percent / 100) * impact_cost

Use this skill when building or maintaining a project or program risk register - scoring risks by probability and impact, calculating expected monetary value and portfolio exposure, choosing a response strategy, or setting up escalation triggers and an executive risk dashboard.

It is not a fit for risk identification techniques themselves (brainstorming, SWOT, pre-mortems) - it assumes risks have already been identified and focuses on scoring, quantifying, and tracking them once named.

Inputs are identified risks with estimated probability, impact, and monetary exposure. Outputs are a scored risk register, EMV and portfolio exposure calculations, a chosen response strategy with ROI justification, Monte Carlo cost projections, an executive risk dashboard, and defined escalation triggers and key risk indicators for ongoing monitoring.

Project and program managers maintaining a risk register who need quantified, ranked risk scores with clear ownership and review cadence - backed by EMV and Monte Carlo analysis for high-stakes decisions - rather than a qualitative, unranked list of concerns.