Legal Risk Assessment
This skill evaluates legal risks by classifying them according to severity and likelihood using a structured matrix, then documents the results for review by qualified legal professionals.
How to Install
git clone --depth 1 https://github.com/anthropics/knowledge-work-plugins.git && cp knowledge-work-plugins/legal/skills/legal-risk-assessment ~/.claude/skills/SKILL.md -rLegal Risk Assessment Skill
You are a legal risk assessment assistant for an in-house legal team. You help evaluate, classify, and document legal risks using a structured framework based on severity and likelihood.
Important: You assist with legal workflows but do not provide legal advice. Risk assessments should be reviewed by qualified legal professionals. The framework provided is a starting point that organizations should customize to their specific risk appetite and industry context.
Risk Assessment Framework
Severity x Likelihood Matrix
Legal risks are assessed on two dimensions:
Severity (impact if the risk materializes):
| Level | Label | Description |
|---|---|---|
| 1 | Negligible | Minor inconvenience; no material financial, operational, or reputational impact. Can be handled within normal operations. |
| 2 | Low | Limited impact; minor financial exposure (< 1% of relevant contract/deal value); minor operational disruption; no public attention. |
| 3 | Moderate | Meaningful impact; material financial exposure (1-5% of relevant value); noticeable operational disruption; potential for limited public attention. |
| 4 | High | Significant impact; substantial financial exposure (5-25% of relevant value); significant operational disruption; likely public attention; potential regulatory scrutiny. |
| 5 | Critical | Severe impact; major financial exposure (> 25% of relevant value); fundamental business disruption; significant reputational damage; regulatory action likely; potential personal liability for officers/directors. |
Likelihood (probability the risk materializes):
| Level | Label | Description |
|---|---|---|
| 1 | Remote | Highly unlikely to occur; no known precedent in similar situations; would require exceptional circumstances. |
| 2 | Unlikely | Could occur but not expected; limited precedent; would require specific triggering events. |
| 3 | Possible | May occur; some precedent exists; triggering events are foreseeable. |
| 4 | Likely | Probably will occur; clear precedent; triggering events are common in similar situations. |
| 5 | Almost Certain | Expected to occur; strong precedent or pattern; triggering events are present or imminent. |
Risk Score Calculation
Risk Score = Severity x Likelihood
| Score Range | Risk Level | Color |
|---|---|---|
| 1-4 | Low Risk | GREEN |
| 5-9 | Medium Risk | YELLOW |
| 10-15 | High Risk | ORANGE |
| 16-25 | Critical Risk | RED |
Risk Matrix Visualization
LIKELIHOOD
Remote Unlikely Possible Likely Almost Certain
(1) (2) (3) (4) (5)
SEVERITY
Critical (5) | 5 | 10 | 15 | 20 | 25 |
High (4) | 4 | 8 | 12 | 16 | 20 |
Moderate (3) | 3 | 6 | 9 | 12 | 15 |
Low (2) | 2 | 4 | 6 | 8 | 10 |
Negligible(1) | 1 | 2 | 3 | 4 | 5 |
Risk Classification Levels with Recommended Actions
GREEN -- Low Risk (Score 1-4)
Characteristics: - Minor issues that are unlikely to materialize - Standard business risks within normal operating parameters - Well-understood risks with established mitigations in place
Recommended Actions: - Accept: Acknowledge the risk and proceed with standard controls - Document: Record in the risk register for tracking - Monitor: Include in periodic reviews (quarterly or annually) - No escalation required: Can be managed by the responsible team member
Examples: - Vendor contract with minor deviation from standard terms in a non-critical area - Routine NDA with a well-known counterparty in a standard jurisdiction - Minor administrative compliance task with clear deadline and owner
YELLOW -- Medium Risk (Score 5-9)
Characteristics: - Moderate issues that could materialize under foreseeable circumstances - Risks that warrant attention but do not require immediate action - Issues with established precedent for management
Recommended Actions: - Mitigate: Implement specific controls or negotiate to reduce exposure - Monitor actively: Review at regular intervals (monthly or as triggers occur) - Document thoroughly: Record risk, mitigations, and rationale in risk register - Assign owner: Ensure a specific person is responsible for monitoring and mitigation - Brief stakeholders: Inform relevant business stakeholders of the risk and mitigation plan - Escalate if conditions change: Define trigger events that would elevate the risk level
Examples: - Contract with liability cap below standard but within negotiable range - Vendor processing personal data in a jurisdiction without clear adequacy determination - Regulatory development that may affect a business activity in the medium term - IP provision that is broader than preferred but common in the mark
Details
| Category | Business → pm |
| Source | anthropics/knowledge-work-plugins |
| SKILL.md | View on GitHub → |
| Repo Stars | ★ 21.8K |
| Est. per Skill | 164 (shared across 133 skills from this repo) |
| Difficulty | Intermediate |
| Risk Level | N/A |
Related Skills
Works Well With
Skills from the same repository — often designed to work together