Risk Mitigation

When to use

Use whenever a strategy, initiative, or business case needs a real risk assessment — especially replacing a risk list that's just a bulleted set of concerns with no scoring, no owners, and no distinction between a risk that's a slow background hum and one that could hit within weeks.

What it does

Scores every risk on likelihood, impact, AND velocity via a bundled calculator, producing a priority tier that a plain likelihood×impact heat map would get wrong for fast-moving risks — a moderate-score, high-velocity risk (like an active regulatory change) needs urgent attention even though its raw score looks unremarkable next to a high-score, low-velocity one. It also flags any critical risk with no documented mitigation, so nothing dangerous slips through unowned.

Method

1. Inventory risks across categories: strategic (market/competitive), operational (execution/delivery), financial (funding/covenant), regulatory/compliance, and reputational — don't limit the list to whatever category the requester happens to be worried about today.
2. Score each risk 1-5 on likelihood (probability it occurs in the relevant time horizon) and 1-5 on impact (severity if it does) — with a one-line justification for each score, not just a number.
3. Score each risk 1-5 on velocity: how fast could it go from "not happening" to "fully materialized" — 1 for a risk that would take years to develop (giving time to react), 5 for one that could hit within weeks (leaving little reaction time even with good monitoring).
4. Run the bundled calculator (scripts/risk_matrix.py) to get the likelihood×impact score, a priority tier, and two flags: any critical risk missing a documented mitigation, and any moderate-score risk with high velocity that a plain heat map would underrank.
5. Assign a named owner and a specific mitigation action to every risk tiered HIGH or CRITICAL — "monitor closely" is not a mitigation; a mitigation names what specifically reduces likelihood or impact, and by when.
6. For velocity-flagged risks, design a monitoring trigger, not just a mitigation plan — the point of high velocity is that mitigation alone may not be enough; you also need an early-warning signal because there's little time to react once it starts.
7. Review the register on a cadence matched to its content: critical/high items reviewed monthly at minimum, moderate quarterly, low annually — a risk register that's built once and never revisited is closer to theater than to actual risk management.