legal-risk-assessment-green-low-risk-score-1-4

# GREEN -- Low Risk (Score 1-4) (+3)

## GREEN -- Low Risk (Score 1-4)


**Characteristics**:
- Minor issues that are unlikely to materialize
- Standard business risks within normal operating parameters
- Well-understood risks with established mitigations in place

**Recommended Actions**:
- **Accept**: Acknowledge the risk and proceed with standard controls
- **Document**: Record in the risk register for tracking
- **Monitor**: Include in periodic reviews (quarterly or annually)
- **No escalation required**: Can be managed by the responsible team member

**Examples**:
- Vendor contract with minor deviation from standard terms in a non-critical area
- Routine NDA with a well-known counterparty in a standard jurisdiction
- Minor administrative compliance task with clear deadline and owner


## YELLOW -- Medium Risk (Score 5-9)


**Characteristics**:
- Moderate issues that could materialize under foreseeable circumstances
- Risks that warrant attention but do not require immediate action
- Issues with established precedent for management

**Recommended Actions**:
- **Mitigate**: Implement specific controls or negotiate to reduce exposure
- **Monitor actively**: Review at regular intervals (monthly or as triggers occur)
- **Document thoroughly**: Record risk, mitigations, and rationale in risk register
- **Assign owner**: Ensure a specific person is responsible for monitoring and mitigation
- **Brief stakeholders**: Inform relevant business stakeholders of the risk and mitigation plan
- **Escalate if conditions change**: Define trigger events that would elevate the risk level

**Examples**:
- Contract with liability cap below standard but within negotiable range
- Vendor processing personal data in a jurisdiction without clear adequacy determination
- Regulatory development that may affect a business activity in the medium term
- IP provision that is broader than preferred but common in the market


## ORANGE -- High Risk (Score 10-15)


**Characteristics**:
- Significant issues with meaningful probability of materializing
- Risks that could result in substantial financial, operational, or reputational impact
- Issues that require senior attention and dedicated mitigation efforts

**Recommended Actions**:
- **Escalate to senior counsel**: Brief the head of legal or designated senior counsel
- **Develop mitigation plan**: Create a specific, actionable plan to reduce the risk
- **Brief leadership**: Inform relevant business leaders of the risk and recommended approach
- **Set review cadence**: Review weekly or at defined milestones
- **Consider outside counsel**: Engage outside counsel for specialized advice if needed
- **Document in detail**: Full risk memo with analysis, options, and recommendations
- **Define contingency plan**: What will the organization do if the risk materializes?

**Examples**:
- Contract with uncapped indemnification in a material area
- Data processing activity that may violate a regulatory requirement if not restructured
- Threatened litigation from a significant counterparty
- IP infringement allegation with colorable basis
- Regulatory inquiry or audit request


## RED -- Critical Risk (Score 16-25)


**Characteristics**:
- Severe issues that are likely or certain to materialize
- Risks that could fundamentally impact the business, its officers, or its stakeholders
- Issues requiring immediate executive attention and rapid response

**Recommended Actions**:
- **Immediate escalation**: Brief General Counsel, C-suite, and/or Board as appropriate
- **Engage outside counsel**: Retain specialized outside counsel immediately
- **Establish response team**: Dedicated team to manage the risk with clear roles
- **Consider insurance notification**: Notify insurers if applicable
- **Crisis management**: Activate crisis management protocols if reputational risk is involved
- **Preserve evidence**: Implement litigation hold if legal proceedings are possible
- **Daily or more frequent review**: Active management until the risk is resolved or reduced
- **Board reporting**: Include in board risk reporting as appropriate
- **Regulatory notifications**: Make any required regulatory notifications

**Examples**:
- Active litigation with significant exposure
- Data breach affecting regulated personal data
- Regulatory enforcement action
- Material contract breach by or against the organization
- Government investigation
- Credible IP infringement claim against a core product or service