risk-assessment

/risk-assessment — Financial Risk Assessment

What This Command Does

Conducts a structured financial risk assessment covering market risk, credit risk, operational risk, liquidity risk, and strategic risk. Produces a risk register with heat map, quantified exposure estimates, and a prioritized mitigation plan. Aligned with COSO ERM, ISO 31000, or Basel frameworks.

When to Use

• Annual enterprise risk assessment
• Board risk committee reporting
• Pre-transaction risk evaluation
• Regulatory risk assessment requirements
• Insurance coverage review
• Business continuity planning

How It Works

1. Risk Identification: Systematic identification of financial risks across categories
2. Risk Assessment: Evaluates likelihood and impact on a 5x5 matrix
3. Quantification: Estimates financial exposure (VaR, stress loss, expected loss)
4. Control Evaluation: Assesses effectiveness of existing controls and mitigants
5. Residual Risk: Maps residual risk after controls
6. Mitigation Planning: Proposes additional mitigants for unacceptable residual risks
7. Monitoring: Defines KRIs (Key Risk Indicators) and escalation triggers

Example Usage

Input:

/risk-assessment entity:"GlobalParts Manufacturing" scope:enterprise framework:coso

Output:

# Enterprise Risk Assessment — GlobalParts Manufacturing
## Framework: COSO ERM | Scope: Enterprise | Date: 2026-03-14

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
## Risk Heat Map Summary
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

         Impact →  Negligible  Minor  Moderate  Major  Severe
Likelihood ↓
Almost Certain                                         [R7]
Likely                                  [R3]    [R1]
Possible                       [R5]     [R4]    [R2]
Unlikely                       [R6]             [R8]
Rare                                            [R9]

Critical risks (red zone): R1, R2, R7
High risks (orange zone): R3, R4
Moderate risks (yellow zone): R5, R8
Low risks (green zone): R6, R9

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
## Risk Register — Top Risks
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

### R1: Supply Chain Disruption (CRITICAL)
| Dimension       | Assessment                                  |
|-----------------|---------------------------------------------|
| Category        | Operational Risk                            |
| Likelihood      | Likely (4/5)                                |
| Impact          | Major (4/5) — EUR 8M–15M revenue at risk    |
| Inherent score  | 16/25                                       |
| Current controls| Dual sourcing for 40% of components         |
| Control effectiveness | Partial                               |
| Residual score  | 12/25                                       |
| Exposure (1yr)  | EUR 5M–10M (probability-weighted)           |

Mitigation plan:
1. Expand dual sourcing to 80% of critical components (Q3 2026)
2. Increase safety stock for single-source items to 45 days (Q2 2026)
3. Qualify alternative suppliers in different geographies
Estimated cost: EUR 800K | Residual risk after: 6/25

### R2: FX Exposure — EUR/CNY (CRITICAL)
| Dimension       | Assessment                                  |
|-----------------|---------------------------------------------|
| Category        | Market Risk                                 |
| Likelihood      | Possible (3/5)                              |
| Impact          | Major (4/5) — EUR 3M–6M margin impact       |
| Inherent score  | 12/25                                       |
| Current controls| Natural hedge (30% of exposure)             |
| Residual score  | 9/25                                        |
| VaR (95%, 1yr)  | EUR 4.2M                                    |

Mitigation plan:
1. Implement rolling 12-month FX hedge program (60% of exposure)
2. Negotiate CNY-denominated supplier contracts where possible
3. Quarterly hedge ratio review linked to order book visibility
Estimated cost: EUR 120K (hedge premium) | Residual risk after: 4/25

### R7: Cybersecurity / Ransomware (CRITICAL)
| Dimension       | Assessment                                  |
|-----------------|---------------------------------------------|
| Category        | Operational Risk                            |
| Likelihood      | Almost Certain (5/5)                        |
| Impact          | Severe (5/5) — EUR 10M+ (production stop)   |
| Inherent score  | 25/25                                       |
| Current controls| Basic firewall, antivirus, weekly backups   |
| Control effectiveness | Weak                                  |
| Residual score  | 20/25                                       |

Mitigation plan:
1. IMMEDIATE: Implement EDR solution and 24/7 SOC monitoring
2. Daily encrypted offsite backups with tested restore procedures
3. Cyber insurance (EUR 10M coverage)
4. Employee security awareness training program
Estimated cost: EUR 350K/yr | Residual risk after: 8/25

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
## Aggregate Risk Exposure
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

| Risk Category    | Gross Exposure | Controls | Net Exposure | % Revenue |
|------------------|---------------|----------|-------------|-----------|
| Market risk      | EUR 8.5M      | 35%      | EUR 5.5M    | 2.2%      |
| Operational risk | EUR 22.0M     | 25%      | EUR 16.5M   | 6.6%      |
| Credit risk      | EUR 3.2M      | 60%      | EUR 1.3M    | 0.5%      |
| Liquidity risk   | EUR 5.0M      | 50%      | EUR 2.5M    | 1.0%      |
| **Total**        |**EUR 38.7M**  |          |**EUR 25.8M**| **10.3%** |

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
## Key Risk Indicators (KRIs)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

| KRI                          | Current | Amber   | Red     |
|------------------------------|---------|---------|---------|
| Single-source component %    | 60%     | > 50%   | > 70%   |
| FX hedge ratio               | 30%     | < 40%   | < 20%   |
| Customer concentration (top 5)| 38%    | > 40%   | > 50%   |
| Days cash on hand            | 45      | < 30    | < 15    |
| Cybersecurity incidents/month| 12      | > 10    | > 25    |

### Next Review: Q3 2026 | Board Risk Committee: Q2 2026