ring%3arisk-management（Ring%3 风险管理）

Risk Management Skill

Systematic portfolio-level risk identification, assessment, and mitigation.

Purpose

This skill provides a framework for:

• Portfolio risk identification
• Risk assessment and scoring
• Risk correlation analysis
• Mitigation planning
• RAID log management

Prerequisites

Before risk assessment, ensure:

Risk Management Gates

Gate 1: Risk Identification

Objective: Identify all portfolio-level risks

Actions:

1. Collect project-level risks
2. Identify cross-project risks
3. Capture portfolio-level risks
4. Document assumptions and dependencies

Risk Categories:

Output: docs/pmo/{date}/risk-register.md

Gate 2: Risk Assessment

Objective: Assess probability and impact of each risk

Actions:

1. Assess probability (1-5 scale)
2. Assess impact (1-5 scale)
3. Calculate risk score (P x I)
4. Assign severity level

Risk Severity Matrix:

See shared-patterns/pmo-metrics.md for risk severity matrix.

Output: docs/pmo/{date}/risk-assessment.md

Gate 3: Risk Correlation

Objective: Identify correlated risks across portfolio

Actions:

1. Identify shared risk factors
2. Map risk dependencies
3. Calculate compound risk exposure
4. Flag correlated critical risks

Correlation Types:

Output: docs/pmo/{date}/risk-correlation.md

Gate 4: Response Planning

Objective: Create mitigation plans for significant risks

Actions:

1. Select response strategy per risk
2. Define mitigation actions
3. Assign owners and dates
4. Allocate contingency

Response Strategies:

See shared-patterns/pmo-metrics.md for response types.

Output: docs/pmo/{date}/risk-response-plan.md

Gate 5: RAID Log Update

Objective: Maintain comprehensive RAID log

Actions:

1. Update Risk section
2. Update Assumptions section
3. Update Issues section
4. Update Dependencies section

RAID Categories:

Output: docs/pmo/{date}/raid-log.md

Anti-Rationalization Table

See shared-patterns/anti-rationalization.md for universal anti-rationalizations.

Risk-Specific Anti-Rationalizations

Pressure Resistance

See shared-patterns/pressure-resistance.md for universal pressure scenarios.

Risk-Specific Pressures

Blocker Criteria - STOP and Report

ALWAYS pause and report blocker for:

Cannot Be Overridden

The following requirements are NON-NEGOTIABLE:

If user insists on violating these:

1. Escalate to orchestrator
2. Do NOT proceed with incomplete risk management
3. Document the request and your refusal

Severity Calibration

Risk severity based on probability × impact matrix:

Report all severities. Escalate CRITICAL immediately. Act on HIGH this week.

Output Format

Risk Summary

# Portfolio Risk Summary - [Date]

## Risk Overview

| Metric | Value |
|--------|-------|
| Total Risks | N |
| Critical | N |
| High | N |
| Medium | N |
| Low | N |
| Mitigations Defined | N/N |
| Overdue Actions | N |

## Top Risks

| ID | Risk | Severity | Owner | Status |
|----|------|----------|-------|--------|
| R-001 | [Description] | Critical/High | [Owner] | [Status] |

## Risk Correlations

| Correlation | Risks | Combined Exposure | Action |
|-------------|-------|-------------------|--------|
| [ID] | [Risk IDs] | [Exposure] | [Action] |

## RAID Summary

| Category | Total | New | Closed | Overdue |
|----------|-------|-----|--------|---------|
| Risks | N | N | N | N |
| Assumptions | N | N | N | N |
| Issues | N | N | N | N |
| Dependencies | N | N | N | N |

## Recommendations

1. [Recommendation with rationale]
2. [Recommendation with rationale]

## Decisions Required

1. [Decision needed: Accept/Mitigate/Avoid risk X]

Execution Report

Base metrics per shared-patterns/execution-report.md:

Risk-Specific Details

When Risk Analysis Is Not Needed

MUST: Full risk analysis REQUIRED for the following conditions:

MUST: When in doubt, refresh the risk analysis. Outdated risk data causes preventable failures.