risk-register-builder

Overview

Systematically identifies risks for a project or initiative across multiple categories, scores each risk using a probability × impact matrix, assigns ownership, develops mitigation strategies and contingency plans, and produces a living risk register in spreadsheet and/or HTML format. Includes a risk heatmap visualization, top-risks dashboard, and templates for ongoing risk review meetings.

Workflow

<Definition - Risk Scoring> Probability (1-5): 1=Rare (<10%), 2=Unlikely (10-25%), 3=Possible (25-50%), 4=Likely (50-75%), 5=Almost Certain (>75%) Impact (1-5): 1=Negligible (<1% budget), 2=Minor (1-5% budget), 3=Moderate (5-15% budget), 4=Major (15-30% budget), 5=Critical (>30% budget, project failure) Risk Score = Probability × Impact (1-25) Risk Level: Critical (20-25), High (12-19), Medium (6-11), Low (1-5) </Definition - Risk Scoring>

<Definition - Risk Categories>

• Technical: Architecture/design flaws, integration failures, performance, security, technology obsolescence, data quality
• Schedule: Unrealistic estimates, dependency delays, scope creep, resource gaps, approval bottlenecks, testing underestimation
• Budget: Cost overruns, unforeseen expenses, vendor price changes, currency impact, scope without budget adjustment
• Resource: Key person dependency, skill gaps, attrition, competing priorities, vendor reliability, knowledge transfer gaps
• Scope: Requirements ambiguity, stakeholder misalignment, feature creep, changing priorities, regulatory changes, late-discovered requirements
• External: Market changes, regulatory/compliance changes, vendor failure, economic conditions, force majeure, reputation risks </Definition - Risk Categories>

<Definition - Response Strategies>

• Avoid: Eliminate the risk by removing the cause or changing the plan
• Mitigate: Reduce probability or impact through specific actions
• Transfer: Shift ownership to a third party (insurance, outsourcing, contracts)
• Accept: Acknowledge the risk and prepare a contingency plan if it materializes </Definition - Response Strategies>

<Workflow - Router description="Determine what the user needs and dispatch to the correct workflow." tools=[] triggers=["build a risk register", "identify project risks", "risk assessment", "what could go wrong", "risk matrix"]

1. [Decide] Are all required inputs available?

   • {{project}} is provided → proceed to <Workflow - Gather>
   • {{project}} is missing → [Ask user] "What project or initiative do you need a risk register for?" Validate: project input is populated before proceeding. If fails: Re-ask for the project name and a one-line description, then re-evaluate.

2. [Decide] Were supporting documents provided?

   • {{existing_docs}} is provided → <Workflow - Gather> step 1
   • No documents → <Workflow - Gather> step 2

</Workflow - Router>

<Workflow - Gather description="Understand project context and collect sufficient information for meaningful risk identification." tools=[file_read, file_read_pdf, file_read_docx] triggers=["Project description provided"]

1. [Agent] If {{existing_docs}} provided, read each document using file_read, file_read_pdf, or file_read_docx. Extract: cost figures, timelines, team info, dependencies, prior risks, constraints. Validate: Each document loaded successfully and yielded usable context. If fails: Report which document could not be read and continue with the remaining context, noting the gap to the user.

2. [Decide] Is project context sufficient to identify meaningful risks (not just generic items)?

   • Yes (have timeline, budget/scale, team, dependencies, objectives) → <Workflow - Assess>
   • No → step 3

3. [Ask user] "To build a useful risk register, I need a bit more context:"

   • What's the timeline and key milestones?
   • What's the approximate budget or scale?
   • What's your biggest concern right now?
   • Any external dependencies (vendors, partners, regulators)? Validate: At least timeline + one other dimension provided. If fails: Re-ask for the missing dimensions, explaining that vague context produces generic risks.

</Workflow - Gather>

<Workflow - Assess description="Identify risks, score them, and develop mitigation plans." tools=[run_python] triggers=["Sufficient project context available"]

1. [Think] Based on project context and {{risk_categories}}, identify risks across each active category. Generate at least 3 per category, 15+ total when all categories are active. Ensure risks are specific to THIS project, not generic templates.

2. [Think] Score each risk using <Definition - Risk Scoring>. Assign probability and impact with brief justification. Calculate risk score and level. Ensure realistic spread, not all Medium.

3. [Think] For each High and Critical risk, develop a response plan per <Definition - Response Strategies>:

   • Strategy type (Avoid/Mitigate/Transfer/Accept)
   • Specific mitigation actions
   • Contingency plan (Plan B if risk materializes)
   • Trigger indicator (early warning sign)
   • Risk owner (role responsible)
   • Review frequency
   • Residual risk score (after mitigation) Validate: No High/Critical risk has only "monitor" as its mitigation. If fails: Rewrite the weak mitigation with specific actions per Rule 2 before continuing.

4. [Agent] Store the complete risk data structure in run_python for use by output workflows. Validate: Data includes all fields for every risk, and the count meets the Rule 5 floor for active categories. If fails: Return to step 1 and add the missing risks or fields.

</Workflow - Assess>

<Workflow - Output description="Generate deliverables in the requested format." tools=[run_python, file_write, open_in_session_tab] triggers=["Risk data complete"]

1. [Decide] What output format was requested via {{output_format}}?

   • "xlsx" → step 2 only
   • "html" → step 3 only
   • "both" (default) → steps 2 and 3

2. [Agent] Generate Excel workbook at artifacts/risk-register-[project-slug].xlsx using run_python with xlsxwriter:

   • Tab 1 "Risk Register": Full register table (ID, Category, Description, Probability, Impact, Score, Level, Owner, Strategy, Mitigation, Contingency, Trigger, Status, Review Date)
   • Tab 2 "Heatmap Data": 5×5 matrix layout
   • Tab 3 "Summary": Counts by category/level, top risks
   • Tab 4 "Review Log": Template for recording review meetings
   • Tab 5 "Settings": Scoring definitions and thresholds
   • Apply: conditional formatting (red/orange/yellow/green by level), data validation dropdowns, frozen header row, auto-filters, print area Validate: File created, formulas work, dropdowns functional. If fails: Output as CSV with formatting instructions and tell the user which workbook features could not be applied.

3. [Agent] Generate HTML dashboard at artifacts/risk-dashboard-[project-slug].html using run_python + file_write:

   • Risk Heatmap (5×5 grid with risks plotted)
   • Risk Distribution (bar chart by category and level)
   • Top 5 Risks (card layout with details)
   • Category Breakdown (radar/spider chart)
   • Executive summary (total risks, critical count, overall rating) Validate: HTML renders correctly, risk counts match register. If fails: Simplify to a table-based summary and note the reduced fidelity to the user.

4. [Agent] Open deliverables using open_in_session_tab. Validate: Each generated deliverable opens in a session tab. If fails: Report the file paths so the user can open them manually.

5. [Ask user] Present summary and recommendations per <Template - Delivery Summary>:

   • Total risks, breakdown by level, top risk, overall project risk rating
   • File paths for each deliverable produced
   • Recommended review cadence (weekly for high-risk projects, biweekly otherwise)
   • The Rule 11 validation note
   • Offer: "Would you like me to set up a recurring reminder or create a risk review meeting agenda template?"

</Workflow - Output>

<Template - Delivery Summary> Risk Register Complete: [Project Name]

Summary:

• Total Risks Identified: [N]
• Critical: [n] | High: [n] | Medium: [n] | Low: [n]
• Top Risk: [description] (Score: [X]/25)
• Overall Project Risk Rating: [Low/Moderate/High/Very High]

Deliverables:

• Dashboard: artifacts/risk-dashboard-[slug].html
• Excel Register: artifacts/risk-register-[slug].xlsx

Recommended review cadence: [Weekly/Biweekly] for active risks

Note: These scores and ratings are decision-support estimates, not professional advice. Validate high-stakes decisions with qualified project-risk, financial, or compliance professionals before acting. </Template - Delivery Summary>