Back to Guides

Guide Origin: Official | ArcKit Version: [VERSION]

/arckit:risk builds an HM Treasury Orange Book–aligned risk register with scoring, treatment, and monitoring.

Inputs & Timing

Pre-requisite Reason
Stakeholder analysis Provides owners and governance forums
Principles & requirements Identify compliance and delivery risks
Business case / plan Supplies cost, schedule, and dependency data

Run after stakeholder analysis and before /arckit:sobc so the business case incorporates risk-adjusted actions.

Command

/arckit:risk Create risk register for <project>

Output: projects/<id>/ARC-<id>-RISK-v1.0.md plus heatmap images.

Register Layout

Column Description Notes
Risk ID & Category Strategic, Operational, Financial, Compliance, Reputational, Technology Categories align with Orange Book
Description & Cause Concise summary plus trigger Use “Cause → Event → Effect” wording
Inherent Score Likelihood × Impact (1–5) before controls Colour-coded heatmap
Treatment (4Ts) Tolerate / Treat / Transfer / Terminate Include action owner, due date
Residual Score Post-mitigation rating Must sit within risk appetite
Monitoring Review cadence, indicators, linkage to backlog Reference JIRA/ServiceNow ticket if applicable

Workflow

1. Run /arckit:risk
2. Review top 10 risks with delivery team
3. Assign actions (treat/transfer) and update backlog
4. Escalate risks breaching appetite to governance board
5. Re-run monthly or when major changes occur

Heatmap Interpretation

  • 20–25 (Critical) → Immediate escalation to SRO/board; consider stop/pause.
  • 13–19 (High) → Action plan with owner and deadline agreed in next governance meeting.
  • 6–12 (Medium) → Monitor, plan mitigations if trend worsens.
  • 1–5 (Low) → Accept; document rationale.

Linkages

  • Optimism bias adjustments in /arckit:sobc.
  • Compliance actions in /arckit:secure, /arckit:dpia, /arckit:ai-playbook.
  • Project plan contingencies via /arckit:plan.
  • Continuous monitoring in /arckit:analyze and /arckit:story.