risk-register-first-pass
Use this when there is no register, or when the register is a generic list that would fit any company. You get two files in a new folder, ./risk-register-first-pass/: a spreadsheet you can open in Excel listing 20 to 40 risks specific to the company, each with an owner, scores and a proposed treatment (risk-register.csv), and a short notes document with the scoring rules, the reasoning behind the top scores and the questions for each owner (risk-notes.md). This skill drafts for a human to review and sign; this skill never marks a control effective. Risk acceptance is a decision for named owners, never for the agent.
Inputs to gather
Read what exists before asking anything: the scope statement, the asset or service inventory, the architecture overview, the vendor list, incident and near-miss logs, previous audit or penetration test findings, customer security questionnaires the company has answered, and the policies. Then ask the reader, in one message: what would hurt the company most in the next year (lost data, downtime, a failed audit, a lost customer, a fine), which three suppliers they could not run without, and who signs off on spending.
Step 1: agree the method before scoring
If the company already has a risk method, use it as written and note where it is vague. If not, draft a minimal one in the notes document (risk-notes.md) and get the reader's yes before scoring:
- Likelihood 1 to 5, each level anchored to a frequency the team can recognise (1 = not expected in five years, 3 = about once a year, 5 = several times a year).
- Impact 1 to 5, each level anchored to the company's own numbers: revenue or contract value at risk, hours of downtime, number of people whose data is involved, regulatory exposure.
- Risk score = likelihood x impact. An acceptance threshold the leadership agrees, for example 8 or below may be accepted by the owner, above 8 needs a treatment plan or a recorded leadership decision. State the acceptance criteria in words too (what makes a retained risk tolerable, which impact dimension dominates) and mark them for leadership approval.
- Reassessment: the full register every 12 months, and a targeted pass after a major incident, a new critical supplier or a scope change.
Anchors in money and hours are what make two people score the same risk the same way. A method without anchors produces a register where everything is a 3.