Portfolio-level risk management skill for identifying, assessing, and mitigating risks across multiple projects. Maintains RAID logs and tracks risk responses.
Inherits all available tools
Additional assets for this skill
This skill inherits all available tools. When active, it can use any tool Claude has access to.
name: risk-management description: | Portfolio-level risk management skill for identifying, assessing, and mitigating risks across multiple projects. Maintains RAID logs and tracks risk responses.
trigger: |
skip_when: |
Systematic portfolio-level risk identification, assessment, and mitigation.
This skill provides a framework for:
Before risk assessment, ensure:
| Prerequisite | Required For | Source |
|---|---|---|
| Project risk registers | Risk aggregation | Project managers |
| Historical risk data | Pattern identification | Previous projects |
| Stakeholder input | Risk identification | Key stakeholders |
| Impact criteria | Risk scoring | PMO standards |
Objective: Identify all portfolio-level risks
Actions:
Risk Categories:
| Category | Examples |
|---|---|
| Strategic | Market changes, competition, regulation |
| Resource | Key person departure, skill shortage, capacity |
| Technical | Technology obsolescence, integration, security |
| Financial | Budget cuts, cost overruns, currency |
| Schedule | Dependencies, delays, scope creep |
| External | Vendor, regulatory, geopolitical |
Output: docs/pmo/{date}/risk-register.md
Objective: Assess probability and impact of each risk
Actions:
Risk Severity Matrix:
See shared-patterns/pmo-metrics.md for risk severity matrix.
| Impact / Likelihood | Low (1-2) | Medium (3) | High (4-5) |
|---|---|---|---|
| High (4-5) | Medium | High | Critical |
| Medium (3) | Low | Medium | High |
| Low (1-2) | Low | Low | Medium |
Output: docs/pmo/{date}/risk-assessment.md
Objective: Identify correlated risks across portfolio
Actions:
Correlation Types:
| Type | Description | Action |
|---|---|---|
| Shared cause | Same root cause affects multiple projects | Mitigate root cause |
| Sequential | One risk triggers another | Plan cascade response |
| Resource | Same resource/skill shortage | Diversify or hire |
| Vendor | Same vendor dependency | Diversify suppliers |
Output: docs/pmo/{date}/risk-correlation.md
Objective: Create mitigation plans for significant risks
Actions:
Response Strategies:
See shared-patterns/pmo-metrics.md for response types.
| Response | When to Use | Example |
|---|---|---|
| Avoid | Risk unacceptable, can change scope | Remove risky feature |
| Transfer | Risk better managed by others | Insurance, outsource |
| Mitigate | Reduce probability or impact | Testing, redundancy |
| Accept | Cost of mitigation > impact | Document and monitor |
Output: docs/pmo/{date}/risk-response-plan.md
Objective: Maintain comprehensive RAID log
Actions:
RAID Categories:
| Category | Contents | Review Frequency |
|---|---|---|
| Risks | Potential future issues | Weekly |
| Assumptions | Believed true, not verified | At milestones |
| Issues | Current problems requiring action | Daily |
| Dependencies | External inputs/outputs | Weekly |
Output: docs/pmo/{date}/raid-log.md
See shared-patterns/anti-rationalization.md for universal anti-rationalizations.
| Rationalization | Why It's WRONG | Required Action |
|---|---|---|
| "We've seen this risk before" | Context changes. Each occurrence needs fresh assessment. | Assess current state |
| "Low probability, don't document" | Low probability × high impact = significant risk. | Document ALL identified risks |
| "Team will handle it" | Unplanned handling = crisis response. Plan required. | Document response plan |
| "Risk register is up to date" | Registers decay. Continuous validation required. | Validate at every review |
| "That won't happen" | Famous last words. Document and monitor. | Document ALL risks |
See shared-patterns/pressure-resistance.md for universal pressure scenarios.
| Pressure Type | Request | Agent Response |
|---|---|---|
| "Don't include that risk, it will worry people" | "Risk transparency is non-negotiable. Including with mitigation plan to provide balanced view." | |
| "That's been mitigated, remove it" | "Mitigated risks remain in register until formally closed with evidence. Updating status, not removing." | |
| "Risk assessment takes too long" | "Unassessed risks cause larger delays when they materialize. Completing assessment." |
ALWAYS pause and report blocker for:
| Situation | Required Action |
|---|---|
| Critical risk without mitigation plan | STOP. Escalate. Risk cannot be accepted without plan. |
| Multiple correlated critical risks | STOP. Report compound exposure. Wait for portfolio decision. |
| Risk owner not identified | STOP. Unowned risks are unmanaged. Require owner assignment. |
| Assumption invalidated | STOP. Trigger re-planning based on new reality. |
# Portfolio Risk Summary - [Date]
## Risk Overview
| Metric | Value |
|--------|-------|
| Total Risks | N |
| Critical | N |
| High | N |
| Medium | N |
| Low | N |
| Mitigations Defined | N/N |
| Overdue Actions | N |
## Top Risks
| ID | Risk | Severity | Owner | Status |
|----|------|----------|-------|--------|
| R-001 | [Description] | Critical/High | [Owner] | [Status] |
## Risk Correlations
| Correlation | Risks | Combined Exposure | Action |
|-------------|-------|-------------------|--------|
| [ID] | [Risk IDs] | [Exposure] | [Action] |
## RAID Summary
| Category | Total | New | Closed | Overdue |
|----------|-------|-----|--------|---------|
| Risks | N | N | N | N |
| Assumptions | N | N | N | N |
| Issues | N | N | N | N |
| Dependencies | N | N | N | N |
## Recommendations
1. [Recommendation with rationale]
2. [Recommendation with rationale]
## Decisions Required
1. [Decision needed: Accept/Mitigate/Avoid risk X]
Base metrics per shared-patterns/execution-report.md:
| Metric | Value |
|---|---|
| Analysis Date | YYYY-MM-DD |
| Scope | [Portfolio/Projects] |
| Duration | Xh Ym |
| Result | COMPLETE/PARTIAL/BLOCKED |
| Metric | Value |
|---|---|
| risks_identified | N |
| risks_by_severity | C/H/M/L |
| mitigation_plans | N |
| overdue_actions | N |