GREEN -- Low Risk (Score 1-4) (+3)

GREEN -- Low Risk (Score 1-4)

Characteristics:

• Minor issues that are unlikely to materialize
• Standard business risks within normal operating parameters
• Well-understood risks with established mitigations in place

Recommended Actions:

• Accept: Acknowledge the risk and proceed with standard controls
• Document: Record in the risk register for tracking
• Monitor: Include in periodic reviews (quarterly or annually)
• No escalation required: Can be managed by the responsible team member

Examples:

• Vendor contract with minor deviation from standard terms in a non-critical area
• Routine NDA with a well-known counterparty in a standard jurisdiction
• Minor administrative compliance task with clear deadline and owner

YELLOW -- Medium Risk (Score 5-9)

Characteristics:

• Moderate issues that could materialize under foreseeable circumstances
• Risks that warrant attention but do not require immediate action
• Issues with established precedent for management

Recommended Actions:

• Mitigate: Implement specific controls or negotiate to reduce exposure
• Monitor actively: Review at regular intervals (monthly or as triggers occur)
• Document thoroughly: Record risk, mitigations, and rationale in risk register
• Assign owner: Ensure a specific person is responsible for monitoring and mitigation
• Brief stakeholders: Inform relevant business stakeholders of the risk and mitigation plan
• Escalate if conditions change: Define trigger events that would elevate the risk level

Examples:

• Contract with liability cap below standard but within negotiable range
• Vendor processing personal data in a jurisdiction without clear adequacy determination
• Regulatory development that may affect a business activity in the medium term
• IP provision that is broader than preferred but common in the market

ORANGE -- High Risk (Score 10-15)

Characteristics:

• Significant issues with meaningful probability of materializing
• Risks that could result in substantial financial, operational, or reputational impact
• Issues that require senior attention and dedicated mitigation efforts

Recommended Actions:

• Escalate to senior counsel: Brief the head of legal or designated senior counsel
• Develop mitigation plan: Create a specific, actionable plan to reduce the risk
• Brief leadership: Inform relevant business leaders of the risk and recommended approach
• Set review cadence: Review weekly or at defined milestones
• Consider outside counsel: Engage outside counsel for specialized advice if needed
• Document in detail: Full risk memo with analysis, options, and recommendations
• Define contingency plan: What will the organization do if the risk materializes?

Examples:

• Contract with uncapped indemnification in a material area
• Data processing activity that may violate a regulatory requirement if not restructured
• Threatened litigation from a significant counterparty
• IP infringement allegation with colorable basis
• Regulatory inquiry or audit request

RED -- Critical Risk (Score 16-25)

Characteristics:

• Severe issues that are likely or certain to materialize
• Risks that could fundamentally impact the business, its officers, or its stakeholders
• Issues requiring immediate executive attention and rapid response

Recommended Actions:

• Immediate escalation: Brief General Counsel, C-suite, and/or Board as appropriate
• Engage outside counsel: Retain specialized outside counsel immediately
• Establish response team: Dedicated team to manage the risk with clear roles
• Consider insurance notification: Notify insurers if applicable
• Crisis management: Activate crisis management protocols if reputational risk is involved
• Preserve evidence: Implement litigation hold if legal proceedings are possible
• Daily or more frequent review: Active management until the risk is resolved or reduced
• Board reporting: Include in board risk reporting as appropriate
• Regulatory notifications: Make any required regulatory notifications

Examples:

• Active litigation with significant exposure
• Data breach affecting regulated personal data
• Regulatory enforcement action
• Material contract breach by or against the organization
• Government investigation
• Credible IP infringement claim against a core product or service