Back to Guides
A short AI-narrated film with English captions. Pressing play loads the YouTube player. Watch on YouTube
Guide Origin: Official | ArcKit Version: [VERSION]
/arckit:risk creates a comprehensive risk register following HM Treasury Orange Book principles for project and operational risk management.
Heading into a gate, a procurement or a board? ArcKit FDE puts a senior architect in your team for five days to produce your principles, requirements, risk register and stakeholder map, at a fixed price. See how ArcKit FDE works.
Inputs
| Artefact | Purpose |
|---|---|
Requirements (ARC-<id>-REQ-v1.0.md) |
Requirements that could be at risk |
| Stakeholder drivers | Business context and risk appetite |
| Architecture diagrams | Technical risks from design |
| Existing risk registers | Organizational risk context |
Command
/arckit:risk Create risk register for <project>
Output: projects/<id>/ARC-<id>-RISK-v1.0.md
Risk Register Structure
| Section | Contents |
|---|---|
| Executive Summary | Overall risk profile and top risks |
| Risk Appetite | Organization's tolerance for risk |
| Risk Categories | Grouping of risks by type |
| Risk Register | Detailed risk entries with scoring |
| Risk Treatments | Mitigation actions and owners |
| Risk Monitoring | Review schedule and escalation |
| Dependencies | Cross-project and external risks |
Orange Book 4Ts Risk Responses
| Response | Description | When to Use |
|---|---|---|
| Tolerate | Accept the risk | Low impact, low likelihood |
| Treat | Mitigate the risk | Reduce likelihood or impact |
| Transfer | Share the risk | Insurance, contracts, third parties |
| Terminate | Avoid the risk | Remove the risk source entirely |
Risk Scoring Matrix
| Likelihood / Impact | Very Low (1) | Low (2) | Medium (3) | High (4) | Very High (5) |
|---|---|---|---|---|---|
| Very High (5) | 5 | 10 | 15 | 20 | 25 |
| High (4) | 4 | 8 | 12 | 16 | 20 |
| Medium (3) | 3 | 6 | 9 | 12 | 15 |
| Low (2) | 2 | 4 | 6 | 8 | 10 |
| Very Low (1) | 1 | 2 | 3 | 4 | 5 |
Risk Categories
| Category | Examples |
|---|---|
| Strategic | Business case viability, stakeholder support |
| Delivery | Timeline, resources, dependencies |
| Technical | Technology maturity, integration complexity |
| Security | Data breaches, cyber threats |
| Financial | Budget overrun, funding uncertainty |
| Compliance | Regulatory, legal, policy requirements |
| Operational | Service availability, support capability |
One-Page Workflow
| Phase | Key Activities | ArcKit Commands |
|---|---|---|
| Discovery | Define requirements and stakeholders | /arckit:requirements, /arckit:stakeholders |
| Identification | Identify and categorize risks | /arckit:risk |
| Assessment | Score and prioritize risks | Review workshop |
| Treatment | Define mitigations and owners | Update risk register |
| Monitoring | Regular review and reporting | Governance meetings |
Review Checklist
- Risk appetite clearly defined and agreed.
- All risk categories considered.
- Each risk has likelihood, impact, and score.
- All high/very high risks have treatment plans.
- Treatment owners and deadlines assigned.
- Dependencies on other projects captured.
- Review schedule established.
- Escalation thresholds defined.
Risk Entry Format
| Field | Description |
|---|---|
| ID | Unique identifier (RISK-001) |
| Title | Brief description |
| Category | Risk category |
| Description | Detailed explanation |
| Cause | What could cause this risk |
| Effect | Impact if risk materializes |
| Likelihood | 1-5 score with rationale |
| Impact | 1-5 score with rationale |
| Inherent Score | Likelihood × Impact (before treatment) |
| Response | Tolerate/Treat/Transfer/Terminate |
| Treatment | Actions to address the risk |
| Owner | Person accountable |
| Residual Score | Score after treatment |
Key Principles
- Risk-Informed Decisions: Use risk to guide project decisions.
- Proportionate Response: Treatment effort matches risk severity.
- Clear Ownership: Every risk has a named owner.
- Regular Review: Risks change; register must be living document.
- Escalation Culture: High risks escalate promptly to senior leaders.