risk-management

# Risk Management Skill

Systematic portfolio-level risk identification, assessment, and mitigation.

## Purpose

This skill provides a framework for:
- Portfolio risk identification
- Risk assessment and scoring
- Risk correlation analysis
- Mitigation planning
- RAID log management

---

## Prerequisites

Before risk assessment, ensure:

| Prerequisite | Required For | Source |
|--------------|--------------|--------|
| Project risk registers | Risk aggregation | Project managers |
| Historical risk data | Pattern identification | Previous projects |
| Stakeholder input | Risk identification | Key stakeholders |
| Impact criteria | Risk scoring | PMO standards |

---

## Risk Management Gates

### Gate 1: Risk Identification

**Objective:** Identify all portfolio-level risks

**Actions:**
1. Collect project-level risks
2. Identify cross-project risks
3. Capture portfolio-level risks
4. Document assumptions and dependencies

**Risk Categories:**

| Category | Examples |
|----------|----------|
| **Strategic** | Market changes, competition, regulation |
| **Resource** | Key person departure, skill shortage, capacity |
| **Technical** | Technology obsolescence, integration, security |
| **Financial** | Budget cuts, cost overruns, currency |
| **Schedule** | Dependencies, delays, scope creep |
| **External** | Vendor, regulatory, geopolitical |

**Output:** `docs/pmo/{date}/risk-register.md`

---

### Gate 2: Risk Assessment

**Objective:** Assess probability and impact of each risk

**Actions:**
1. Assess probability (1-5 scale)
2. Assess impact (1-5 scale)
3. Calculate risk score (P x I)
4. Assign severity level

**Risk Severity Matrix:**

See [shared-patterns/pmo-metrics.md](../shared-patterns/pmo-metrics.md) for risk severity matrix.

| Impact / Likelihood | Low (1-2) | Medium (3) | High (4-5) |
|---------------------|-----------|------------|------------|
| **High (4-5)** | Medium | High | Critical |
| **Medium (3)** | Low | Medium | High |
| **Low (1-2)** | Low