ChatGPT prompts for risk assessment

Create a risk assessment for [PROJECT OR OPERATION] over [TIME HORIZON]. The objective, scope, and success criteria are [OBJECTIVE AND SCOPE]. The work plan, systems, people, vendors, and dependencies are [WORK AND DEPENDENCIES]. Known incidents, concerns, controls, and constraints are [KNOWN RISKS AND CONTROLS]. Our risk tolerance and escalation rules are [RISK TOLERANCE].

Use only the supplied facts. Identify risks across delivery, operational, financial, legal or compliance, security or privacy, safety, vendor, reputation, and people categories only where relevant. Do not present a risk as a certainty. Write each risk in cause–event–impact form: “Because [cause], [event] may occur, resulting in [impact].” Distinguish root causes from consequences and avoid duplicating the same exposure under several names.

Produce:
1. A risk register table with ID, category, cause–event–impact statement, affected objective, existing controls, likelihood (1–5), impact (1–5), inherent score, owner, leading indicator or trigger, response, target date, and residual score.

2. A prioritized top-five narrative that explains why each risk is ranked where it is.
3. A response plan separating avoid, reduce, transfer, accept, and contingency actions. For accepted risks, state the decision owner and monitoring cadence.
4. A weekly risk-review agenda and escalation thresholds for risks that change.

Use relative scoring only as a decision aid; do not make legal, security, safety, or insurance determinations. Flag items that require review by a qualified professional or policy owner.

Before answering, check that every high-scoring risk has one accountable owner, a dated response, and a measurable trigger. Also check that controls are not confused with future actions. Ask up to 3 clarifying questions only if a required input is missing.

Assess risks of using [VENDOR] for [SERVICE]. The vendor’s role and data access are [ROLE AND DATA], contractual terms known so far are [TERMS], internal dependencies are [DEPENDENCIES], and our requirements are [REQUIREMENTS]. Produce a vendor risk register covering continuity, information security, privacy, subcontractors, financial exposure, support, and exit planning where applicable. State evidence needed for each unverified item, an owner, and a decision threshold. Do not claim the vendor has a certification or control without evidence. Check that high risks have a mitigation or explicit acceptance owner. Ask up to 3 questions only if inputs are missing.

Prepare a preliminary risk register for [EVENT] at [VENUE] on [DATE]. Expected attendance, audience, and activities are [EVENT DETAILS]; venue information and existing plans are [VENUE CONTROLS]; known hazards and requirements are [HAZARDS AND RULES]. Cover crowd flow, medical response, weather, accessibility, safeguarding, food, transport, equipment, and emergency communications where relevant. Return hazards, existing controls, missing information, response owners, and escalation triggers. This is planning support, not a substitute for venue, medical, fire, or security professionals. Check that each critical item has an assigned professional review path. Ask up to 3 questions only if inputs are missing.

Assess the operational risk of changing [CURRENT PROCESS] to [PROPOSED CHANGE] on [IMPLEMENTATION DATE]. Users affected are [AFFECTED USERS], rollout and rollback details are [ROLLOUT PLAN], and known controls are [CONTROLS]. Produce a before-and-after risk table, failure modes, leading indicators, rollback triggers, communications owners, and a go/no-go checklist. Separate technical verification from business readiness. Do not assume testing proves every real-world outcome. Check that each rollback trigger is measurable and that the plan names who can authorize rollback. Ask up to 3 questions only if required inputs are missing.