Use risk-register

Build or update an enterprise or project risk register

Build or update an enterprise or project risk register — each risk written as cause, event and consequence, scored for likelihood and impact on a defined scale, inherent and residual ratings, a named owner, a treatment (avoid, reduce, transfer, accept), controls, a due date and a review trigger — with a heat map, the top risks that need a decision, and a stdlib script that validates the register CSV and flags overdue reviews.

Reach for it when the user wants a risk register, a risk log, a RAID log's risk section, a heat map, or says "what are our top risks", "update the risk register", "score these risks".

Install it

npx skilldrop-cli install risk-register                 # Claude Code, your user folder
npx skilldrop-cli install risk-register --project       # Claude Code, this repo
npx skilldrop-cli install risk-register --ide cursor    # or kiro, codex, antigravity, copilot

It is part of the Governance, risk and compliance pack: --pack grc installs it with its neighbours.

It ships scripts, so it needs Python 3 (standard library only, nothing to install). What they may touch is declared in its manifest.

Ask for it

Say it the way you would to a colleague. Requests like these route to it:

• "Build a risk register for our office move programme"
• "Here's our risk log CSV, check it for missing owners and overdue reviews"
• "Score these eight risks for likelihood and impact and give me a heat map for the board"
• "What are our top risks this quarter and which need a decision from the exec team?"

Requests like these belong to a different skill, so it shouldn't answer them:

• "Run a STRIDE threat model on our payments API design"
• "Do a DPIA for our new employee monitoring tool"
• "Map our controls to SOC 2 criteria and list the evidence the auditor will ask for"

If another skill answers instead, ask for this one by name: "use risk-register".

Check what you get

A good result:

• Every risk has a cause, an event and a consequence, each a sentence. No one-word risks.
• The scale is written down in the output, with what each number means.
• Inherent and residual are both scored, and residual counts only controls in place today.
• Every open risk has a named owner (a person or a role a person holds) and a next review date.
• Every treatment has an action and a date, except accept, which names who accepted it.
• The script passes with zero errors before the register is shown, and its heat map is pasted, not redrawn by hand.
• The decision list is short: five or fewer, each naming the decision and the decider.

See a worked example

• northwind register

Use something else when

• Security threats against a specific system design, by STRIDE: use threat-model
• Threats specific to an AI agent's tools, prompts and data: use agent-threat-model
• Risks to individuals from processing personal data: use dpia, which scores harm to people, not to the company
• Mapping controls to SOC 2 criteria and audit evidence: use soc2-evidence-map
• Recording a decision once it has been made: use decision-log
• Setting quality targets such as availability or latency: use nfr-spec

Where a loop runs it

• Stage register of the comply loop
• Stage check of the comply loop, where gate G8 decides

Next

• SKILL.md, the instructions the agent reads
• Its page on the site
• Related: agent-threat-model, decision-log, dpia, nfr-spec, soc2-evidence-map, threat-model

Edit this page on GitHub · View source