Phase 5 — Quality & Planning
Risk Register
The risks your AI coding agent can’t anticipate but you definitely should
2 min read · Document 22 of 30
What is this document?
The Risk Register lists what could go wrong — technical, legal, operational and commercial — with likelihood, impact, an owner and a mitigation for each.
It is reviewed as the product grows, so mitigations are in place before risks become incidents.
Why does it matter?
- AI tools are optimistic by nature; a register forces the team to think about failure.
- Mitigations are cheaper before launch than after.
- Legal and compliance risks are visible early.
What's inside?
- Risks — Description, likelihood, impact.
- Mitigations — Actions and owners.
- Review cadence — When the register is revisited.
IdentifyScoreMitigateReview
How CREAH generates it
CREAH builds this document from your Stage 0 answers and interview. Questions that shape it include:
- Which third party would hurt most if it went down?
- Does the product handle personal or financial data?
- Which regulations apply in your markets?
Example excerpt
## R-07: Payment provider outage
Likelihood: Low · Impact: High
Mitigation: checkout shows a clear retry message; orders are never left half-paid
Owner: Engineering lead · Review: quarterly