AI Prompts for Risk Managers (Risk Registers, Assessments & Incident Reports)

Copy-paste prompt

You are a risk manager writing a new entry for an enterprise risk register. The risk to document is: [DESCRIBE RISK — e.g. "key supplier insolvency", "data breach via third-party vendor", "regulatory non-compliance in new market"]. Write a complete risk register entry with the following fields: (1) Risk ID and Title, (2) Risk Category (e.g. Operational / Financial / Strategic / Compliance / Reputational), (3) Risk Description — two to three sentences explaining what the risk is and how it could materialize, (4) Likelihood (1–5 scale with rationale), (5) Impact (1–5 scale with rationale), (6) Risk Rating (Likelihood × Impact with label: Low / Medium / High / Critical), (7) Current Controls in place, (8) Control Effectiveness (Adequate / Partially Adequate / Inadequate), (9) Residual Risk after controls, (10) Recommended Actions with owner and target date, (11) Risk Owner. Format as a structured document suitable for insertion into a risk register.

Copy-paste prompt

You are a risk manager writing a risk assessment report for [DESCRIBE SCOPE — e.g. a new product launch, a regulatory change, an IT migration project, a business unit]. The assessment covers the period: [DATE RANGE]. Key risks identified include: [LIST 3–5 RISKS with brief descriptions]. For each risk, provide: (1) risk description and potential trigger events, (2) likelihood and impact ratings (1–5) with justification, (3) existing controls and their effectiveness, (4) residual risk level, (5) recommended risk treatment (Accept / Mitigate / Transfer / Avoid) with specific actions. Conclude with an overall risk profile summary and a prioritized action plan. Format as a formal report with an executive summary, risk detail sections, and an appendix risk matrix.

Copy-paste prompt

You are a risk manager writing a post-incident summary report. The incident details are: [DESCRIBE INCIDENT — what happened, when, which systems or teams were affected, and the immediate business impact]. The confirmed or suspected root cause is: [ROOT CAUSE]. Immediate response actions taken were: [DESCRIBE RESPONSE]. Write a structured incident summary with: (1) Incident Overview — what happened and when, (2) Impact Assessment — financial, operational, reputational, or regulatory impact, (3) Root Cause Analysis — primary and contributing causes, (4) Response Timeline — key actions taken from detection to resolution, (5) Lessons Learned — what should have been caught earlier and by what control, (6) Corrective Actions — specific remediation steps with owners and due dates, (7) Risk Register Update — whether this incident warrants a new or updated risk register entry. Tone: factual, objective, action-oriented.

Copy-paste prompt

You are a risk manager preparing a board-level risk briefing. The organization is: [COMPANY TYPE/INDUSTRY/SIZE]. The briefing covers the period: [QUARTER/DATE RANGE]. The top risks to highlight are: [LIST 4–6 RISKS with one-line descriptions]. For the briefing, write: (1) an opening paragraph summarizing the overall risk environment and any significant changes since the last board review, (2) a risk summary table with columns: Risk | Category | Current Rating | Change vs Prior Period | Key Mitigations, (3) a spotlight section on the top two or three risks requiring board attention — each with context, why it's elevated, and what management is doing, (4) a closing paragraph on the risk appetite check — whether the organization's current risk exposure is within or outside its stated risk appetite. Tone: concise, board-appropriate, no jargon.

Copy-paste prompt

You are a risk manager completing a third-party risk assessment for a vendor or partner. The third party is: [VENDOR NAME/TYPE — e.g. cloud infrastructure provider, payroll processor, raw material supplier]. The relationship involves: [DESCRIBE WHAT THEY DO FOR YOU — data access, critical service delivery, supply of goods, etc.]. Key information about the third party: [PASTE RELEVANT DETAILS — size, location, any known issues, certifications held]. Assess the following risk domains and provide a rating (Low / Medium / High) with justification for each: (1) Data Security & Privacy Risk, (2) Operational Continuity Risk (can they fail and take us down?), (3) Financial Stability Risk, (4) Regulatory & Compliance Risk, (5) Reputational Risk, (6) Concentration Risk (are we over-reliant on them?). Conclude with an overall third-party risk rating, a recommended due diligence tier (Enhanced / Standard / Basic), and the top three risk mitigation actions. Format as a structured assessment form.