You are a risk management specialist. I need a comprehensive Risk Assessment Matrix to identify, evaluate, prioritize, and mitigate risks for strategic decision-making. **RISK ASSESSMENT CONTEXT:** Subject: [PROJECT/INITIATIVE/BUSINESS/PRODUCT NAME] Industry: [INDUSTRY] Assessment Scope: [e.g., "Product launch," "Market expansion," "Technology implementation," "M&A transaction," "Strategic initiative"] Time Horizon: [e.g., "12 months," "Project duration," "3-year strategic plan"] Risk Appetite: [e.g., "Conservative," "Moderate," "Aggressive"] Key Stakeholders: [Who needs to review/approve this assessment?] --- **REQUIRED OUTPUT FORMAT:** **1. RISK IDENTIFICATION (Comprehensive Risk Inventory)** Identify 15-25 risks across these 6 categories: **🔴 STRATEGIC RISKS** Risks that threaten core business objectives or competitive position • Market/Competitive Risks (new entrants, market shifts, competitive threats) • Business Model Risks (disruption, obsolescence, value proposition erosion) • Strategic Execution Risks (initiative failure, resource misallocation) **🟠 OPERATIONAL RISKS** Risks related to internal processes, systems, and execution • Process Failures (quality issues, efficiency breakdowns) • Supply Chain Risks (vendor failures, logistics disruptions) • Talent/People Risks (key person dependency, skill gaps, turnover) • Technology/System Risks (downtime, technical failures, cybersecurity) **🟡 FINANCIAL RISKS** Risks impacting financial performance or viability • Revenue Risks (customer loss, pricing pressure, market contraction) • Cost/Budget Risks (overruns, input cost inflation) • Liquidity/Cash Flow Risks (working capital strain, funding gaps) • Financial Market Risks (FX, interest rates, economic downturn) **🟢 COMPLIANCE/LEGAL RISKS** Risks related to regulations, legal obligations, or governance • Regulatory Compliance (new regulations, enforcement actions) • Contractual Risks (breach, disputes, liability) • Intellectual Property Risks (patent challenges, IP theft) • Data Privacy/Security Compliance (GDPR, CCPA, breach liability) **🔵 REPUTATIONAL RISKS** Risks that could damage brand, trust, or stakeholder relationships • Brand/PR Risks (negative publicity, social media backlash) • Customer Trust Risks (data breaches, service failures) • ESG/Sustainability Risks (environmental impact, social responsibility failures) • Stakeholder Relationship Risks (investor, partner, or employee confidence erosion) **🟣 EXTERNAL/ENVIRONMENTAL RISKS** Risks arising from external factors beyond organizational control • Macroeconomic Risks (recession, inflation, unemployment) • Geopolitical Risks (trade wars, sanctions, political instability) • Natural Disasters/Climate Risks (extreme weather, pandemic) • Technology Disruption (emerging tech rendering current approach obsolete) **For each risk, provide:** • Risk ID: [Unique identifier, e.g., "STR-01"] • Risk Name: [Concise title] • Description: [What could go wrong? Be specific] • Trigger Events: [What would cause this risk to materialize?] • Impact Statement: [What are the consequences if this occurs?] --- **2. RISK EVALUATION (Likelihood × Impact Scoring)** For each identified risk, assess: **LIKELIHOOD (Probability of Occurrence)** Rate 1-5: • 1 = Very Low (0-10% probability) • 2 = Low (10-30% probability) • 3 = Medium (30-50% probability) • 4 = High (50-70% probability) • 5 = Very High (70-100% probability) **IMPACT (Severity of Consequences)** Rate 1-5 across multiple dimensions: **Financial Impact:** • 1 = Negligible (<$10K or <1% revenue/budget) • 2 = Minor ($10K-$100K or 1-5% revenue/budget) • 3 = Moderate ($100K-$500K or 5-10% revenue/budget) • 4 = Major ($500K-$2M or 10-25% revenue/budget) • 5 = Catastrophic (>$2M or >25% revenue/budget) **Operational Impact:** • 1 = Negligible (minimal disruption) • 2 = Minor (localized disruption, <1 week) • 3 = Moderate (significant disruption, 1-4 weeks) • 4 = Major (severe disruption, 1-3 months) • 5 = Catastrophic (long-term disruption, >3 months or business closure) **Reputational Impact:** • 1 = Negligible (no external visibility) • 2 = Minor (limited negative attention) • 3 = Moderate (regional/industry negative press) • 4 = Major (national negative press, customer trust erosion) • 5 = Catastrophic (brand crisis, widespread trust loss, executive resignations) **Strategic Impact:** • 1 = Negligible (no effect on strategic objectives) • 2 = Minor (slight delay or adjustment to plans) • 3 = Moderate (significant objective delay or scope reduction) • 4 = Major (key objective failure, strategic pivot required) • 5 = Catastrophic (business model failure, existential threat) **COMPOSITE IMPACT SCORE** = Average of (Financial + Operational + Reputational + Strategic) / 4 **RISK SCORE** = Likelihood × Composite Impact (Scale: 1-25) --- **3. RISK PRIORITIZATION MATRIX (Visual Heat Map)** Create a 5×5 Risk Matrix plotting Likelihood (Y-axis) vs. Impact (X-axis): ``` LIKELIHOOD ↑ 5 | [🟥][🟥][🟥][🟥][🟥] CRITICAL RISKS 4 | [🟧][🟧][🟥][🟥][🟥] 3 | [🟨][🟧][🟧][🟥][🟥] 2 | [🟩][🟨][🟧][🟧][🟥] 1 | [🟩][🟩][🟨][🟧][🟧] LOW RISKS +-------------------------→ IMPACT 1 2 3 4 5 ``` **RISK TIERS:** • 🟥 **CRITICAL (Risk Score 15-25):** Immediate action required; executive escalation • 🟧 **HIGH (Risk Score 9-14):** Priority mitigation; active monitoring • 🟨 **MEDIUM (Risk Score 5-8):** Planned mitigation; regular monitoring • 🟩 **LOW (Risk Score 1-4):** Accept or monitor; no active mitigation **List risks by tier:** • **CRITICAL RISKS:** [List Risk IDs + Names] • **HIGH RISKS:** [List Risk IDs + Names] • **MEDIUM RISKS:** [List Risk IDs + Names] • **LOW RISKS:** [List Risk IDs + Names] --- **4. RISK MITIGATION STRATEGIES** For each CRITICAL and HIGH risk, develop mitigation plan: **Risk ID: [e.g., STR-01]** **Risk Name:** [Name] **Current Risk Score:** [Likelihood × Impact = Score] **MITIGATION STRATEGY:** **Strategy Type:** [Select one or more] • **Avoid:** Eliminate the risk by not proceeding with the activity • **Reduce:** Implement controls to lower likelihood or impact • **Transfer:** Shift risk to third party (insurance, outsourcing, contracts) • **Accept:** Acknowledge risk and prepare contingency response **Specific Actions:** 1. [Action 1: What will be done?] 2. [Action 2: ...] 3. [Action 3: ...] **Responsible Owner:** [Who is accountable?] **Timeline:** [When will actions be completed?] **Budget/Resources:** [What resources are required?] **Residual Risk Assessment:** • **Post-Mitigation Likelihood:** [1-5] • **Post-Mitigation Impact:** [1-5] • **Residual Risk Score:** [New Score] • **Risk Reduction:** [Original Score → Residual Score = X% reduction] **Contingency Plan (If Risk Materializes):** • **Early Warning Indicators:** [How will you detect this risk occurring?] • **Response Actions:** [What will you do if it happens?] • **Recovery Timeline:** [How long to recover?] • **Escalation Protocol:** [Who gets notified? When?] --- **5. RISK MONITORING & REPORTING FRAMEWORK** **Risk Dashboard KPIs:** • **Total Risk Count:** [Number] • **Critical Risks:** [Number] (Target: 0-2) • **High Risks:** [Number] (Target: <5) • **Average Risk Score:** [Score] (Target: <6.0) • **Risk Trend:** [Increasing/Stable/Decreasing] **Monitoring Cadence:** • **Critical Risks:** Weekly review • **High Risks:** Bi-weekly review • **Medium Risks:** Monthly review • **Low Risks:** Quarterly review **Risk Review Process:** 1. **Risk Owner Updates:** Status, new developments, mitigation progress 2. **Score Reassessment:** Update Likelihood/Impact based on new information 3. **New Risk Identification:** Scan for emerging risks 4. **Mitigation Effectiveness:** Are actions reducing risk as expected? 5. **Escalation:** Flag risks requiring leadership intervention **Reporting Structure:** • **Weekly Executive Summary:** Critical risks + top 3 changes • **Monthly Risk Report:** Full matrix + mitigation status • **Quarterly Risk Review:** Strategic risk deep-dive + risk appetite reassessment --- **6. RISK APPETITE & TOLERANCE DEFINITION** Define organizational risk thresholds: **Risk Appetite Statement:** "We are willing to accept [Conservative/Moderate/Aggressive] risk levels in pursuit of [STRATEGIC OBJECTIVES]." **Risk Tolerance Thresholds:** • **Strategic Risks:** [e.g., "No more than 2 Critical strategic risks at any time"] • **Financial Risks:** [e.g., "No single risk >10% of annual revenue"] • **Operational Risks:** [e.g., "No operational disruption >2 weeks acceptable"] • **Reputational Risks:** [e.g., "Zero tolerance for brand crisis events"] **Escalation Triggers:** • **Automatic Executive Escalation:** Any risk scoring 20+ (Very High Likelihood × Very High Impact) • **Board Notification:** Aggregate risk score >100 OR 5+ Critical risks • **Crisis Management Activation:** Catastrophic impact event (Impact = 5) materializes --- **FRAMEWORK PRINCIPLES:** 1. **Comprehensive Risk Inventory** — Cast wide net across 6 risk categories to avoid blind spots; identify 15-25 risks minimum 2. **Multi-Dimensional Impact Assessment** — Evaluate impact across Financial, Operational, Reputational, Strategic dimensions (not just financial) 3. **Quantitative Scoring Discipline** — Use consistent 1-5 scales for Likelihood and Impact; calculate composite Risk Scores for objective prioritization 4. **Tiered Response Strategy** — Focus resources on Critical/High risks; accept or monitor Low risks 5. **Residual Risk Management** — Mitigation doesn't eliminate risk; assess residual risk post-mitigation and plan contingencies 6. **Dynamic Risk Monitoring** — Risks evolve; establish regular review cadence to update scores and identify emerging risks --- **DELIVERABLE CHECKLIST:** ✅ 15-25 risks identified across 6 categories with detailed descriptions ✅ Likelihood (1-5) and Composite Impact (1-5) scores for each risk ✅ Risk Score calculation (Likelihood × Impact) for prioritization ✅ 5×5 Risk Matrix heat map with risks plotted by tier ✅ Mitigation strategies for all Critical and High risks ✅ Residual risk assessment post-mitigation ✅ Contingency plans for top 5 risks ✅ Risk monitoring dashboard and reporting framework