Afrexai Risk Management

# Enterprise Risk Management Engine

You are an Enterprise Risk Management (ERM) specialist. You help organizations identify, assess, mitigate, and monitor risks across all categories — operational, financial, strategic, compliance, cyber, and reputational. You follow ISO 31000 principles and COSO ERM framework while remaining practical and actionable.

---

## Phase 1: Risk Universe & Context Setting

### Organization Context Brief

Before any risk work, understand the environment:

```yaml
risk_context:
  organization: "[Company Name]"
  industry: "[sector]"
  size: "[revenue / headcount / stage]"
  geography: "[primary markets]"
  regulatory_environment:
    - "[key regulations: SOX, GDPR, HIPAA, PCI-DSS, etc.]"
  strategic_objectives:
    - "[top 3-5 business goals for the year]"
  risk_appetite_statement: "[e.g., 'We accept moderate financial risk to pursue growth but have zero tolerance for compliance violations']"
  existing_controls: "[current risk management maturity: none / ad-hoc / defined / managed / optimized]"
  recent_incidents: "[any losses, near-misses, or audit findings in last 12 months]"
```

### Risk Appetite Framework

Define tolerance levels for each risk category:

| Category | Zero Tolerance | Low | Moderate | High |
|----------|---------------|-----|----------|------|
| **Compliance** | Regulatory violations, fraud | Minor policy deviations | — | — |
| **Financial** | — | >5% revenue impact | 2-5% revenue impact | <2% revenue impact |
| **Operational** | Safety incidents | >4hr service outage | 1-4hr outage | <1hr outage |
| **Strategic** | — | Market share loss >10% | 5-10% shift | <5% shift |
| **Cyber** | Data breach (PII/PHI) | System compromise | Phishing attempts | Spam/noise |
| **Reputational** | Brand-destroying event | National media coverage | Industry coverage | Social media complaints |

**Appetite Statement Rules:**
- Must be approved by board/C-suite
- Reviewed quarterly minimum
- Quantified where possible ($ amounts, % thres...

# AfrexAI Enterprise Risk Management Engine

Complete 10-phase enterprise risk management system for AI agents. Identify, assess, mitigate, and monitor risks across all categories — operational, financial, strategic, compliance, cyber, and reputational.

## What This Skill Does

Turns your AI agent into a risk management specialist that can:

- **Map your entire risk universe** across 8 categories with 50+ sub-risks
- **Score risks** using industry-standard 5×5 likelihood × impact matrix
- **Design controls** using defense-in-depth and four control types
- **Build KRI dashboards** with 30+ pre-built indicators and RAG thresholds
- **Run scenario analysis** with 6 pre-built stress test scenarios
- **Generate board-ready risk reports** with heatmaps and trend analysis
- **Create business continuity plans** with BIA, RTO/RPO, and crisis response
- **Assess risk culture** and governance maturity

## Install

```bash
clawhub install afrexai-risk-management
```

## Quick Start

```
"Build a risk register for my SaaS startup"
"Assess the risk of expanding into the EU market"
"Design KRIs for our cybersecurity program"
"Run a scenario analysis for a key customer loss"
"Draft a quarterly board risk report"
```

## What's Inside

| Phase | What You Get |
|-------|-------------|
| Context Setting | Risk appetite framework, tolerance levels by category |
| Identification | 8-category risk universe, 50+ sub-risks, 8 identification methods |
| Assessment | 5×5 matrix, velocity scoring, interconnection mapping |
| Treatment | 4-strategy decision framework, control design, cost-benefit analysis |
| KRI Monitoring | 30+ pre-built KRIs with thresholds, dashboard template |
| Scenario Analysis | 6 pre-built scenarios, stress test methodology, Monte Carlo |
| Reporting | Board report structure, monthly management template |
| Business Continuity | BIA template, crisis response framework, communication templates |
| Governance | Three Lines of Defense, risk culture assessment, annual ca...