Project Management Risk Assessment

---
name: project-management-risk-assessment
description: Identify delivery risks — technical, people, schedule, scope, external — and score and mitigate them in a risk register with a likelihood-impact matrix and owners. Use when the user worries about what could derail the project's timeline or scope and wants the risks tracked. Not for legal exposure or security threats; see /legal-risk-assessment or /security-risk-assessment.
metadata:
  argument-hint: "[project] [--skip-checks]"
---

# Risk Assessment

Identify, score, and plan mitigations for risks in "$ARGUMENTS". Brainstorm risks across categories, score each by likelihood and impact, plot on a risk matrix, define mitigation strategies for top risks, assign owners, and set a review cadence.

See also `/legal-risk-assessment` for legal risks scored on a likelihood-impact matrix, or `/security-risk-assessment` for a security risk register built from threat and vulnerability findings.

**Arguments.** `$ARGUMENTS` may contain the project name and optional flags. Take the first token as `<project>` and treat `--skip-checks` as a flag; never include flags in file paths. All paths below use `<project>`. If `--skip-checks` is present, skip the prerequisite check and, **before writing any artifact**, append one line to `.singularskills/log.jsonl`: `{"ts":"<ISO timestamp>","skill":"project-management-risk-assessment","workflow":"project-management","phase":null,"project":"<project>","event":"skipped","artifact":"<artifact file>","note":"<reason or \"none given\">"}`.

## Prerequisites

None — this is a utility skill. It can be run at any time, with or without existing project artifacts.

If `.singularskills/project-management/<project>/` exists, read any available artifacts for context. If it does not exist, proceed based on information the user provides.

## Process

1. **Gather context:**
   - If `.singularskills/project-management/<project>/` exists, read available artifacts for project scope, team, timeline, and stakeholder information
   - Ask the user about the project or initiative if no context is available
   - Understand the project phase — risks differ between early planning, active development, and delivery

2. **Brainstorm risks across categories:**
   - **Technical:** architecture complexity, dependency risks, performance bottlenecks, security vulnerabilities, tech debt, integration challenges, unfamiliar technologies
   - **People:** key-person dependency, skills gaps, team turnover, availability conflicts, onboarding delays, team morale
   - **Schedule:** deadline pressure, dependency chains between workstreams, scope creep, underestimated effort, long feedback loops
   - **Scope:** unclear or changing requirements, conflicting stakeholder priorities, gold-plating, missing acceptance criteria
   - **External:** vendor delays, third-party API changes, market shifts, regulatory changes, competitor moves, budget cuts
   - Aim for 10-20 risks across categories — enough to be thorough without being overwhelming
   - Write each risk as a specific statement: "X may happen, causing Y" (not vague concerns)

3. **Score each risk by likelihood and impact:**
   - **Likelihood** (1-5): 1 = rare, 2 = unlikely, 3 = possible, 4 = likely, 5 = almost certain
   - **Impact** (1-5): 1 = negligible, 2 = minor, 3 = moderate, 4 = major, 5 = severe
   - **Risk score** = likelihood x impact (range 1-25)
   - Document brief rationale for each score — why this likelihood? why this impact level?

4. **Plot on risk matrix and classify:**
   - **High risk (score 15-25):** requires active mitigation, regular monitoring, escalation plan
   - **Medium risk (score 8-14):** needs a mitigation plan, monitor periodically
   - **Low risk (score 1-7):** accept and monitor, revisit if conditions change
   - Present the risk matrix visually as a table with likelihood on one axis and impact on the other

5. **Define mitigation strategy for each high and medium risk:**
   - **Avoid:** eliminate the risk by changing the plan (e.g., drop a risky feature, choose a proven technology)
   - **Transfer:** shift the risk to someone else (e.g., insurance, outsource to a specialist, use a managed service)
   - **Mitigate:** reduce likelihood or impact (e.g., add testing, build a prototype, cross-train team members, add buffer)
   - **Accept:** acknowledge the risk and prepare a contingency plan if it occurs
   - For each mitigation: describe the specific action, estimated effort, and how it reduces the risk score
   - Define trigger conditions — what signals that this risk is materializing?

6. **Assign risk owners:**
   - Each high and medium risk gets a single owner (one person accountable for monitoring and mitigation)
   - The owner does not have to do all the work — they ensure the mitigation plan is executed
   - Match owners to their area of expertise or responsibility

7. **Set review cadence:**
   - **High-risk projects:** weekly risk review (5-10 minutes in standup or dedicated slot)
   - **Normal projects:** biweekly risk review
   - **Stable projects:** monthly risk review
   - At each review: check for new risks, update scores on existing risks, verify mitigations are progressing, close resolved risks

8. **Write the artifact** — save to `.singularskills/project-management/<project>/risk-assessment.md`:
   - **Risk Register** — table with columns: ID, Category, Risk Statement, Likelihood, Impact, Score, Classification, Strategy, Owner
   - **Risk Matrix** — visual matrix showing risk distribution
   - **Mitigation Plans** — detailed plans for each high and medium risk
   - **Review Cadence** — frequency and format for risk reviews
   - **Next Review Date** — when to revisit this assessment

## Output

Risk assessment saved to `.singularskills/project-management/<project>/risk-assessment.md`. Present a summary highlighting:
- Total risks identified and distribution across categories
- Number of high, medium, and low risks
- Top 3 risks with their scores and mitigation strategies
- Recommended review cadence