Risk assessment

Overview

Risk not identified is risk not managed. This skill makes technical and delivery risk explicit so it can be mitigated, accepted, or escalated — before it surprises you.

When to Use

• Before estimating a project
• Before starting a large migration or refactor
• Before a major deployment
• When a project has been "almost done" for two weeks

Process

Step 1: List all risks

Brainstorm: what could go wrong? Include: technical unknowns, external dependencies, team knowledge gaps, deadline pressure, infrastructure, security, data integrity.

Step 2: Score each risk

For each risk: Likelihood (1–3) × Impact (1–3) = Risk Score (1–9). Prioritize scores ≥ 6.

Step 3: Classify risks

• Known known: You know about it and understand it. Mitigate.
• Known unknown: You know there's something you don't know. Research it.
• Unknown unknown: You don't know what you don't know. Add buffer and run pre-mortems.

Step 4: Design mitigations

For each high-score risk: what is the mitigation? What is the fallback? Who owns it?

Step 5: Pre-mortem

Imagine it's 3 months from now and the project failed. What went wrong? Work backwards. This surfaces unknown unknowns.

Step 6: Define go/no-go criteria

For the deployment or launch: what conditions must be true to proceed? What conditions force a delay?

Verification Requirements

• All risks identified and scored
• High-score risks have documented mitigations
• Pre-mortem conducted
• Go/no-go criteria defined
• Risk log tracked throughout the project