Purpose
Transform a pile of diligence findings or data room documents into a prioritized, defensible risk register — every material risk surfaced, categorized across seven domains, scored on severity and likelihood, and matched to a concrete mitigant or deal-structure lever. Replaces ad hoc, memory-driven risk-spotting with a systematic sweep that survives investment committee scrutiny.
When to Use
Invoke this skill when the user asks to:
- Review due diligence findings and surface deal risks
- Build or populate a risk register for an acquisition, investment, or merger
- Assess what could derail a deal before signing or close
- Categorize and prioritize findings from a data room
- Flag issues that should affect purchase price, indemnities, or escrow
- Prepare a risk summary for an investment committee or deal team memo
Inputs Required
Before starting, collect:
- Deal type: Acquisition / minority investment / merger / carve-out / LBO
- Target overview: What the business does, sector, geography, approximate revenue or EV
- Diligence findings provided: The documents, summaries, or workstream notes to analyze (financial QoE, legal, tax, commercial, IT, HR, etc.)
- Deal stage: Pre-LOI / post-LOI confirmatory / pre-signing / pre-close
- Materiality threshold: Dollar or % threshold below which a risk is not worth registering (default: 1% of EV or $250K, whichever is lower)
- Known deal-breakers: Any issues already flagged as red lines by the deal team
- Structure flexibility: Can price, escrow, indemnities, or earnouts still be negotiated?
If materiality threshold or structure flexibility is missing, assume a confirmatory-stage deal with negotiable terms and note the assumption.
Instructions
Step 1: Sweep Findings Across Seven Risk Domains
Read every finding provided and assign it to one or more domains. Do not skip a domain because nothing was flagged — explicitly note when a domain appears clean or under-covered, since gaps in diligence are themselves risks.
- Financial: Revenue quality, customer concentration, margin sustainability, working capital normalization, off-balance-sheet items, accounting policy aggressiveness, debt and contingent liabilities, QoE adjustments
- Operational: Key-person dependency in operations, supplier/vendor concentration, capacity constraints, integration complexity, IT systems debt, undocumented processes, churn drivers
- Legal: Litigation (active and threatened), contract assignability/change-of-control clauses, IP ownership and licensing, warranty exposure, undisclosed liabilities, title/asset ownership
- Regulatory: Licenses and permits, antitrust/merger control, sector-specific compliance, sanctions/export controls, pending regulatory change, history of violations
- People: Management retention, equity/comp obligations triggered by the deal, union/labor matters, culture and attrition, succession gaps, employment misclassification
- Cyber: Breach history, security posture, data inventory and privacy compliance (GDPR/CCPA), third-party/vendor security exposure, ransomware readiness
- ESG: Environmental liabilities and remediation, governance red flags, supply-chain labor risk, climate transition exposure, reputational issues
Step 2: Score Each Risk on Severity and Likelihood
For every registered risk, assign two ratings:
- Severity (1–5): Financial and strategic impact if the risk materializes. 5 = deal-breaking or >10% of EV; 4 = material price/structure impact; 3 = manageable but real cost; 2 = minor; 1 = noise. Apply the materiality threshold — drop anything below it.
- Likelihood (1–5): Probability the risk actually materializes given the evidence. 5 = already occurring or near-certain; 3 = plausible; 1 = remote.
Compute a Risk Score = Severity × Likelihood (range 1–25). Flag any risk with Severity 5 as a potential deal-breaker regardless of likelihood.
Step 3: Assign a Confidence Level to Each Assessment
Mark how well-evidenced each risk is:
- High: Directly documented in diligence materials
- Medium: Inferred from partial evidence or industry pattern
- Low: Suspected but diligence is incomplete — recommend a specific follow-up request
Low-confidence high-severity items become open diligence requests, not just register entries.
Step 4: Recommend a Mitigant for Each Risk
Match each risk to the most appropriate lever. Be specific — name the mechanism, not "address this":
- Price: Purchase price reduction or QoE adjustment with rough quantum
- Structure: Escrow, holdback, earnout, deferred consideration
- Contract: Specific indemnity, R&W, covenant, condition to close, or pre-close remediation
- Insurance: R&W insurance, specific contingent risk policy
- Post-close: Integration action, retention package, remediation plan with owner and timeline
- Walk: For unmitigable Severity-5 risks, state it plainly
Step 5: Rank and Synthesize
Order the register by Risk Score descending. Then write a short synthesis: the 3–5 risks that should drive deal decisions, any clustering that signals a systemic problem, and an overall posture recommendation (proceed / proceed with conditions / renegotiate / walk).
Output Format
- Structure: A risk register table followed by an open-items list and a written synthesis
- Length: 900–1,400 words depending on finding volume
- Format: Risk register as a table (columns: ID, Domain, Risk Description, Severity, Likelihood, Risk Score, Confidence, Recommended Mitigant); open diligence requests as a numbered list; synthesis as prose
- Sections: Risk Register (table, ranked by score) → Potential Deal-Breakers (called out separately) → Open Diligence Requests → Synthesis & Posture Recommendation
- Tone: Deal-team principal — precise, evidence-anchored, willing to state a deal-breaker without hedging
Quality Checklist
Before delivering output, verify:
- [ ] All seven risk domains are addressed — each either populated or explicitly noted as clean/under-covered
- [ ] Every register entry has a Severity, Likelihood, computed Risk Score, and Confidence level
- [ ] The register is sorted by Risk Score in descending order
- [ ] Every risk has a specific named mitigant — no entry says only "monitor" or "address"
- [ ] All Severity-5 items appear in the Potential Deal-Breakers section
- [ ] Low-confidence high-severity risks are converted into specific open diligence requests
- [ ] The synthesis names a clear posture recommendation rather than hedging
Notes
- Gaps in diligence are risks — a domain with no findings often means it wasn't examined, not that it's clean. Flag thin coverage explicitly.
- Risk clustering matters more than any single entry: three medium financial findings plus an aggressive accounting policy often signal a systemic quality-of-earnings problem worth a hard price conversation.
- Tie quantum to mitigants wherever the findings allow — "$2M escrow against the disputed tax position" is actionable; "indemnification" is not.
- At pre-LOI stage, weight the register toward what to confirm; at pre-close, weight it toward what must be papered before signing.
How to use this skill
This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.
Installing in Claude Code:
~/.claude/skills/<folder-name>/SKILL.md— auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)<your-project>/.claude/skills/<folder-name>/SKILL.md— auto-loads only when working in that project (recommended for project-specific skills)
Restart Claude Code or open a new session to register.
Using in Claude.ai, ChatGPT, Gemini, or other AI tools:
- Drag this file into a new chat, or copy and paste its contents
- Send your task or request as your next message — the AI will apply the skill where it fits
For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills