em-risk-management v0.3.0 Delivery

Catching and managing delivery risk. Detect & score 5x5, review & close, run a read-only hygiene scan, and write executive escalation emails - resolving the shared Risk Matrix from config and recipients from the org directory.

Problem it solves: a disciplined, PRINCE2-aligned risk lifecycle on one shared Risk Matrix - so delivery, relationship and people risks are logged, scored consistently, owned, reviewed on the right cadence, and surfaced to leadership before they bite.

Lifecycle em-risk-detector (catch & score)→ em-risk-reviewer (manage & close) · em-risk-hygiene (scan) · em-risk-escalator (escalate)
em-risk-detectorUser skillMedium · ~20-80k

Scans any input (transcripts, notes, emails, free text) for risk signals across Customer, Delivery and People domains; scores each on the 5x5 matrix; drafts a PRINCE2 Cause/Event/Effect; dedups against open risks; then logs a new row after confirmation.

When to use it
log a riskidentify risksassess risksflag this as a riskcheck for risks
How it works
  1. Resolve config and rosterReads the Risk Matrix and engagement / account DBs from the manifest and loads the EM owner names.
  2. Detect signals across domainsScans the input for risk signals across the customer, delivery, and people domains.
  3. Score on the 5x5 matrixScores each risk on Probability (1-5) and Impact (1-5), computes Risk Score = P x I, and maps it to a risk level.
  4. Draft the PRINCE2 descriptionWrites the Cause / Event / Effect structure, prepending a PROACTIVE / CONFIDENTIAL banner for unconfirmed signals.
  5. Confirm before any writeSearches the Risk Matrix for related open risks, presents the finding, and waits for the EM before writing to Notion.
Example
You say
A 1:1 transcript with Sam (Acme Robotics senior engineer): "I keep getting recruiter pings and the comp gap is real - I haven't decided anything, but you should know."
You get back
A proposed People risk - Probability 2 (proactive cap), Impact 4, Score 8 → Medium - with a Cause/Event/Effect description and a suggested comp-review mitigation, held for the EM's yes/no/edit before any Risk Matrix write.

Gotcha: It logs only a potential future event - never a task, a bug, or something that already happened.

Gotcha: Owner is required with no default, and unconfirmed proactive signals are capped at Probability 1-2.

Reference - what it brings, its process, and what it needs
BringsA raw conversation becomes a properly scored, structured, owner-assigned risk - with a gate that refuses malformed descriptions and a dedup check.
Process
  1. Detect signals across the three domains.
  2. Score Probability × Impact → Risk Level.
  3. Draft PRINCE2 Cause/Event/Effect.
  4. Dedup, confirm, then log (or comment on an existing risk).
NeedsNotion MCPrisk_matrix_dborg-directory
em-risk-reviewerUser skillLight · ~5-20k

Manages existing risks - reviews open risks by account, posts standardized review comments, does targeted single-risk updates, recommends status transitions, and closes risks with documented rationale and a mandatory resolution date.

When to use it
review risksreview the account risksupdate a riskpost an update on a riskclose a risk
How it works
  1. Resolve configReads the Risk Matrix and engagement / account DBs from the manifest.
  2. Filter to active risksSearches the matrix for the account and keeps only risks that are not already closed, resolved, accepted, or impacted.
  3. Post a review commentPresents each risk's current state, asks what changed, and posts a standardized Risk Review Update comment.
  4. Recommend a transitionSuggests Open → Mitigation Planned / In Progress / Resolved / Accepted / Impacted based on the mitigation state.
  5. Close on confirmationOn the EM's yes, updates Status and Internal Status, sets the Resolution Date, posts a closing comment, and logs the changelog.
Example
You say
"close the compliance risk for Acme Robotics - we implemented the control and the vendor audit passed."
You get back
The risk is proposed for Status Resolved / Internal Status Closed with today's Resolution Date and a closing comment; after the EM confirms, the matrix row is updated, the comment posted, and the Account Changelog logged.

Gotcha: A risk is never closed because it went quiet or its date passed - only on a real terminal condition with documented rationale.

Gotcha: The Resolution Date is mandatory on close (distinct from Expected Resolution) because it drives MTTR reporting.

Reference - what it brings, its process, and what it needs
BringsKeeps the register honest - structured updates, score changes that re-sync status / cadence, and disciplined closure that enables MTTR reporting.
Process
  1. Search active risks for the account; flag overdue.
  2. Walk one at a time; ask current state.
  3. Post review comment; recommend a transition.
  4. Close with rationale + resolution date when due.
NeedsNotion MCPrisk_matrix_dbchangelog
em-risk-hygieneRead-onlyLight · ~5-20k

A biweekly read-only scan of the Risk Matrix for one EM (or all). Surveys active risks for gaps - overdue dates, missing owners, PRINCE2 non-compliance, staleness, status mismatch - and produces a prioritized punch list grouped by severity.

Reference - what it brings, its process, and what it needs
BringsA standing "what needs my attention" companion that catches register rot and hands you concrete follow-ups to run through the reviewer.
Process
  1. Pick an EM (or all); scope to active risks.
  2. Run every hygiene check, each with a severity.
  3. Output a punch list grouped by severity.
  4. Suggest reviewer follow-ups. Writes nothing.
NeedsNotion MCP (read)risk_matrix_db
em-risk-escalatorUser skillLight · ~5-20k

Turns a logged or just-detected risk into an executive-summary escalation email - a ready-to-send .eml on the Desktop, addressed to founders / account manager / CTO (or finance lead), centered on a specific leadership ask. Then logs the escalation back to Notion.

Reference - what it brings, its process, and what it needs
BringsRemoves the friction of an exec-readable escalation - resolves recipients, translates PRINCE2 into business language, builds a "what we need from you" ask with a by-when.
Process
  1. Resolve config + org directory; get the risk.
  2. Resolve recipients (finance / CTO / AM routing).
  3. Draft the executive summary (BLUF + ask).
  4. Write the .eml; log the escalation back.
NeedsNotion MCPorg-directoryoutput_directory
em-risk-apply-nowUser skillLight · ~5-20k

On-demand applier for risk approvals that cannot wait for the evening run. Reads the ticked RISK- proposal lines in today's plan approvals block and creates each as a Risk Matrix row - the same create path the evening closer uses - then logs each to the Account Changelog. Applies only items the EM already ticked.

Reference - what it brings, its process, and what it needs
BringsCreates approved risks immediately instead of waiting for the 6:30pm run; idempotent with the closer (changelog source_key dedup) so a later run never double-creates.
Process
  1. Resolve config; read today's plan ticks.
  2. Take only ticked RISK- proposals.
  3. Create each as a Risk Matrix row.
  4. Log each to the Account Changelog.
NeedsNotion MCPrisk_matrix_dbtoday_plan_pagechangelog