Risk heat map builder · free AI skill

Builds a structured risk heat map scoring each identified risk on a 5x5 likelihood-by-impact matrix, assigning low/medium/high/critical ratings, producing a ranked priority list, and recommending a treatment approach…

Purpose

Turn a raw list of identified risks into a scored 5x5 heat map with consistent likelihood/impact ratings, a ranked priority order, and a recommended treatment approach for each — so a risk manager can move directly from identification to decision without hand-building the matrix or arbitrating scores manually.

When to Use

Invoke this skill when the user asks to:

Build a risk heat map or risk matrix from a list of risks
Score risks by likelihood and impact
Prioritize or rank a set of identified risks
Assign risk ratings (low/medium/high/critical) to a risk register
Decide which risks to accept, mitigate, transfer, or avoid
Prepare a risk assessment summary for a review, board, or audit

Inputs Required

Before starting, collect:

Risk list: The identified risks — one line each, with a short description
Likelihood inputs: Probability of each risk occurring (qualitative such as "rare/likely," a 1–5 rating, or a % — any format)
Impact inputs: Severity if the risk materializes (qualitative, 1–5, or a described consequence)
Risk domain/context: What the risks relate to (project, operational, financial, cybersecurity, compliance, etc.)
Risk appetite (optional): The organization's tolerance threshold — where "acceptable" ends
Existing controls (optional): Any mitigations already in place per risk, to score residual rather than inherent risk
Time horizon (optional): The period the assessment covers

If likelihood or impact is provided only as free text, normalize each to a 1–5 score and state the mapping used. If risk appetite is not given, treat High and Critical as above tolerance by default and note the assumption.

Instructions

Step 1: Normalize Likelihood and Impact to a 1–5 Scale

Convert every input to a consistent 1–5 rating using these anchors:

Likelihood (L)

1 — Rare: Not expected within the horizon; would be surprising (<5%)
2 — Unlikely: Could occur but not expected (5–25%)
3 — Possible: Might occur at some point (25–50%)
4 — Likely: Expected to occur (50–80%)
5 — Almost Certain: Expected to occur repeatedly or imminently (>80%)

Impact (I)

1 — Insignificant: Negligible effect; absorbed in normal operations
2 — Minor: Small, localized disruption; easily recovered
3 — Moderate: Noticeable disruption; requires management attention
4 — Major: Significant harm to objectives, finances, or reputation
5 — Severe: Threatens viability, safety, or major obligations

For each risk, state the assigned L and I and one phrase of justification. If the user provided ratings directly, honor them; only reinterpret free text.

Step 2: Calculate Score and Assign Rating

For each risk, compute Risk Score = Likelihood × Impact (range 1–25) and assign a rating band:

Low (green): Score 1–4
Medium (yellow): Score 5–9
High (orange): Score 10–15
Critical (red): Score 16–25

Apply one override rule: any risk with Impact = 5 is at minimum High, even if likelihood is low — catastrophic consequences never sit in green.

Step 3: Render the 5x5 Heat Map

Produce a 5x5 grid with Impact on the columns (1→5, left to right) and Likelihood on the rows (5→1, top to bottom, so highest likelihood sits at top). In each cell, place the score and the risk IDs that fall there. Label the color band of each cell (Low/Medium/High/Critical). This gives an at-a-glance visual of clustering.

Step 4: Build the Scored Risk Table

Create a table with one row per risk containing: Risk ID, Risk (short name), Likelihood (1–5), Impact (1–5), Score, Rating, and Existing Controls (if provided). Assign sequential IDs (R1, R2, …) for reference throughout.

Step 5: Rank the Priority List

Order all risks descending by score. Break ties by higher impact first, then higher likelihood. Number the ranking 1..N. Flag every risk above the risk appetite threshold as "Above tolerance — requires action."

Step 6: Recommend a Treatment Approach per Risk

Assign each risk one of four treatments with a one-line rationale:

Avoid: Eliminate the activity causing the risk — for Critical risks where mitigation can't bring it to tolerance
Mitigate: Reduce likelihood or impact through controls — the default for High and many Critical risks worth retaining
Transfer: Shift the financial consequence via insurance, contracts, or outsourcing — for high-impact, low-controllability risks
Accept: Monitor without action — for Low and lower-Medium risks within appetite

For each recommended treatment, name one concrete next action (e.g., "add MFA," "purchase cyber liability cover," "add contractual indemnity clause").

Step 7: Summarize the Risk Profile

Write a 3–5 sentence summary: how many risks fall in each band, where the concentration sits on the map, the top 3 risks demanding immediate attention, and the overall posture (e.g., "profile is impact-heavy — several low-likelihood but severe risks warrant transfer").

Output Format

Structure: Normalized scoring rationale → 5x5 heat map grid → scored risk table → ranked priority list → treatment recommendations → risk profile summary
Length: 700–1,100 words plus tables (scales with number of risks)
Format: Tables for the heat map, scored register, and priority list; short prose for the summary
Sections: Scoring Scale Used → Heat Map (5x5) → Scored Risk Register → Ranked Priorities → Treatment Recommendations → Risk Profile Summary
Tone: Risk analyst — precise, evidence-based, decision-oriented; no hedging on ratings

Quality Checklist

Before delivering output, verify:

[ ] Every risk has a Likelihood (1–5), Impact (1–5), Score (L×I), and Rating
[ ] Rating bands match the score exactly (1–4 Low, 5–9 Medium, 10–15 High, 16–25 Critical)
[ ] The Impact = 5 override is applied — no severe-impact risk sits in Low
[ ] The 5x5 grid places every risk in exactly one cell and cell counts equal the total risk count
[ ] The priority list is sorted descending by score with ties broken correctly
[ ] Every risk has one treatment (accept/mitigate/transfer/avoid) with a concrete next action

Notes

Score residual risk (after existing controls) when controls are provided, and label it as such; score inherent risk only when no controls are given
When likelihood and impact inputs conflict in format across risks, normalize all to 1–5 first so the matrix stays internally consistent
Critical risks should always carry either a Mitigate or Avoid recommendation — never Accept — regardless of appetite
If the user provides more than ~25 risks, keep the full table but limit the narrative summary to the top 10 by score to stay actionable

How to use this skill

This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.

Installing in Claude Code:

~/.claude/skills/<folder-name>/SKILL.md — auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)
<your-project>/.claude/skills/<folder-name>/SKILL.md — auto-loads only when working in that project (recommended for project-specific skills)

Restart Claude Code or open a new session to register.

Using in Claude.ai, ChatGPT, Gemini, or other AI tools:

Drag this file into a new chat, or copy and paste its contents
Send your task or request as your next message — the AI will apply the skill where it fits

For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills