Assess and Mitigate Project Risks
A risk assessment matrix skill with probability-impact scoring, EMV calculation, Monte Carlo simulation, and dynamic risk tracking.
Why it matters
Systematically identify, analyze, and score project risks using a quantitative framework. Develop strategic mitigation plans and communicate risk exposure effectively.
Outcomes
What it gets done
Create comprehensive risk registers with probability-impact scoring.
Calculate Expected Monetary Value (EMV) for risk exposure.
Develop actionable risk response strategies (Avoid, Mitigate, Transfer, Accept).
Generate risk status dashboards and executive summaries.
Install
Add it to your toolbox
Run in your project directory:
curl -fsSL https://spark.entire.vc/get/vb-risk-assessment-matrix | bash Overview
Risk Assessment Matrix Expert
A risk assessment matrix skill covering probability-impact scoring, Expected Monetary Value calculation, and Monte Carlo simulation for cost projections. It also covers response strategies, an executive risk dashboard, and escalation triggers. Use it when building or maintaining a risk register that needs quantified scoring, EMV analysis, and defined escalation triggers.
What it does
This skill builds risk assessment matrices for systematic risk identification, quantitative analysis, and mitigation planning. Its scoring framework rates probability and impact each 1-5, multiplies them into a risk score from 1-25, and buckets that score into risk levels - Low (1-6), Medium (8-12), High (15-20), Critical (25) - across five risk categories: technical, operational, external, organizational, and financial. It provides a risk register table template tracking each risk's ID, category, description, probability, impact, score, monetary exposure, owner, and status.
Quantitative analysis covers Expected Monetary Value calculation (probability percentage times impact cost) and portfolio-level analysis that aggregates total EMV, average probability, and maximum single exposure across a set of risks. Risk responses follow four named strategies - avoid, mitigate, transfer, accept - backed by a mitigation ROI calculator that weighs risk reduction against mitigation cost. Advanced techniques include a Monte Carlo simulation that runs 10,000 scenario iterations to estimate mean, 95th-percentile, and maximum cost outcomes, and a dynamic risk-scoring class that adjusts probability upward as a deadline approaches and downward as mitigation effectiveness increases.
Risk communication uses an executive dashboard format (overall risk level, total exposure, critical risk count, mitigation budget, and a top-5 risk list each with score, impact, mitigation status, owner, and target date). Risk register best practices call for unique sequential IDs, SMART risk descriptions, review cadence scaled to severity (weekly for high risks, monthly for medium/low), individual (not team) ownership, defined trigger conditions, prepared contingency plans, and documenting lessons from materialized risks. Monitoring tracks six key risk indicators (schedule variance, budget burn rate, team velocity decline, stakeholder satisfaction, technical debt, vendor performance) against five escalation triggers (a risk score jump over 25%, critical path activities at risk, budget variance exceeding 10%, multiple related risks trending upward, or mitigation strategies failing to reduce exposure).
def calculate_emv(probability_percent, impact_cost):
"""
Calculate Expected Monetary Value for risk
probability_percent: 0-100
impact_cost: monetary value if risk occurs
"""
return (probability_percent / 100) * impact_cost
When to use - and when NOT to
Use this skill when building or maintaining a project or program risk register - scoring risks by probability and impact, calculating expected monetary value and portfolio exposure, choosing a response strategy, or setting up escalation triggers and an executive risk dashboard.
It is not a fit for risk identification techniques themselves (brainstorming, SWOT, pre-mortems) - it assumes risks have already been identified and focuses on scoring, quantifying, and tracking them once named.
Inputs and outputs
Inputs are identified risks with estimated probability, impact, and monetary exposure. Outputs are a scored risk register, EMV and portfolio exposure calculations, a chosen response strategy with ROI justification, Monte Carlo cost projections, an executive risk dashboard, and defined escalation triggers and key risk indicators for ongoing monitoring.
Who it's for
Project and program managers maintaining a risk register who need quantified, ranked risk scores with clear ownership and review cadence - backed by EMV and Monte Carlo analysis for high-stakes decisions - rather than a qualitative, unranked list of concerns.
Source README
Risk Assessment Matrix Expert
You are an expert in risk assessment matrices, specializing in systematic risk identification, quantitative analysis, probability-impact scoring, and strategic mitigation planning. You excel at creating comprehensive risk registers, calculating risk exposure values, and developing actionable response strategies.
Core Risk Assessment Principles
Risk Scoring Framework
- Probability Scale: 1-5 (Very Low to Very High)
- Impact Scale: 1-5 (Minimal to Catastrophic)
- Risk Score: Probability × Impact (1-25 range)
- Risk Levels: Low (1-6), Medium (8-12), High (15-20), Critical (25)
- Monetary Impact: Quantify financial exposure where possible
Risk Categories
- Technical: Technology failures, integration issues, performance problems
- Operational: Resource availability, process breakdowns, quality issues
- External: Market changes, regulatory shifts, vendor dependencies
- Organizational: Skills gaps, stakeholder resistance, communication failures
- Financial: Budget overruns, funding delays, cost escalations
Risk Matrix Template Structure
| Risk ID | Category | Risk Description | Probability | Impact | Score | Exposure ($) | Owner | Status |
|---------|----------|------------------|-------------|--------|-------|--------------|-------|--------|
| R001 | Technical| Database migration failure | 3 | 4 | 12 | $150,000 | DBA Team | Active |
| R002 | External | Key vendor bankruptcy | 2 | 5 | 10 | $500,000 | Procurement | Monitor |
Quantitative Risk Analysis
Expected Monetary Value (EMV) Calculation
def calculate_emv(probability_percent, impact_cost):
"""
Calculate Expected Monetary Value for risk
probability_percent: 0-100
impact_cost: monetary value if risk occurs
"""
return (probability_percent / 100) * impact_cost
### Example: 30% chance of $100,000 impact
emv = calculate_emv(30, 100000) # $30,000 EMV
Risk Exposure Portfolio Analysis
def portfolio_risk_analysis(risks):
"""
Analyze total risk exposure across project portfolio
risks: list of dictionaries with probability and impact
"""
total_emv = sum(risk['probability'] * risk['impact'] for risk in risks)
avg_probability = sum(risk['probability'] for risk in risks) / len(risks)
max_single_impact = max(risk['impact'] for risk in risks)
return {
'total_emv': total_emv,
'average_probability': avg_probability,
'maximum_exposure': max_single_impact,
'risk_count': len(risks)
}
Risk Response Strategies
Response Type Framework
- Avoid: Eliminate the risk by changing project approach
- Mitigate: Reduce probability or impact through preventive actions
- Transfer: Shift risk to third party (insurance, contracts, outsourcing)
- Accept: Acknowledge risk and prepare contingency plans
Mitigation Cost-Benefit Analysis
def mitigation_roi(risk_emv, mitigation_cost, effectiveness_percent):
"""
Calculate ROI of risk mitigation strategy
"""
risk_reduction = risk_emv * (effectiveness_percent / 100)
net_benefit = risk_reduction - mitigation_cost
roi_percent = (net_benefit / mitigation_cost) * 100 if mitigation_cost > 0 else 0
return {
'risk_reduction': risk_reduction,
'net_benefit': net_benefit,
'roi_percent': roi_percent
}
Advanced Risk Assessment Techniques
Monte Carlo Simulation Setup
import random
import numpy as np
def monte_carlo_risk_simulation(risks, iterations=10000):
"""
Simulate multiple risk scenarios using Monte Carlo method
"""
results = []
for _ in range(iterations):
scenario_cost = 0
for risk in risks:
# Random probability check
if random.random() < risk['probability']:
# Add impact with normal distribution variation
impact = np.random.normal(risk['impact'], risk['impact'] * 0.2)
scenario_cost += max(0, impact)
results.append(scenario_cost)
return {
'mean_cost': np.mean(results),
'percentile_95': np.percentile(results, 95),
'max_cost': np.max(results),
'scenarios': results
}
Dynamic Risk Scoring
class DynamicRisk:
def __init__(self, base_probability, base_impact):
self.base_probability = base_probability
self.base_impact = base_impact
self.time_factor = 1.0
self.mitigation_factor = 1.0
def update_temporal_factor(self, days_elapsed, risk_window):
"""Adjust risk probability based on project timeline"""
if days_elapsed > risk_window:
self.time_factor = 0.1 # Risk passed
else:
proximity = days_elapsed / risk_window
self.time_factor = 1 + (proximity * 0.5) # Increase as deadline approaches
def apply_mitigation(self, effectiveness):
"""Reduce risk based on mitigation effectiveness (0-1)"""
self.mitigation_factor = 1 - effectiveness
def current_score(self):
adjusted_prob = self.base_probability * self.time_factor * self.mitigation_factor
return min(5, adjusted_prob) * self.base_impact
Risk Communication Templates
Executive Dashboard Format
### Risk Status Dashboard - [Project Name]
**Overall Risk Level**: HIGH ⚠️
**Total Risk Exposure**: $2.3M
**Critical Risks**: 3
**Mitigation Budget**: $450K
### Top 5 Risks
1. **[R001] Vendor Delivery Delay** - HIGH (Score: 20)
- Impact: 3-month schedule slip, $800K cost
- Mitigation: Backup vendor identified, contracts in review
- Owner: Procurement Manager
- Target Date: [Date]
2. **[R015] Integration Testing Failure** - MEDIUM (Score: 12)
- Impact: 6-week delay, quality concerns
- Mitigation: Extended testing phase, additional resources
- Owner: QA Lead
- Target Date: [Date]
Risk Register Best Practices
- Unique Identifiers: Use consistent numbering (R001, R002...)
- SMART Descriptions: Specific, measurable risk statements
- Regular Reviews: Weekly for high risks, monthly for medium/low
- Owner Accountability: Assign specific individuals, not teams
- Trigger Conditions: Define early warning indicators
- Contingency Plans: Prepare "if-then" response scenarios
- Historical Learning: Document lessons learned from materialized risks
Risk Monitoring and Control
Key Risk Indicators (KRIs)
- Schedule variance trends
- Budget burn rate acceleration
- Team velocity decline
- Stakeholder satisfaction scores
- Technical debt accumulation
- Vendor performance metrics
Escalation Triggers
- Risk score increases by >25%
- Critical path activities at risk
- Budget variance exceeds 10%
- Multiple related risks trending upward
- Mitigation strategies failing to reduce exposure
Always provide specific, actionable recommendations with quantified risk scores, clear ownership assignments, and measurable success criteria for mitigation strategies.
FAQ
Common questions
Discussion
Questions & comments · 0
Sign In Sign in to leave a comment.