# Risk

URL: /business/nouns/risk · Id: `noun:risk`

> A Risk is something that could harm a Startup or a Portfolio, scored by likelihood and impact, and treated, accepted, or closed.

A Risk is something that could harm a [Startup](/business/nouns/startup) or a [Portfolio](/business/nouns/portfolio), scored by likelihood and impact, and treated, accepted, or closed.

## Properties
| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `scope` | `string` | Yes | Whose Risk it is: `startup` or `portfolio`, for exposure shared across siblings. |
| `likelihood` | `integer` | Yes | How likely it is within a year, from 1 (rare) to 5 (expected). |
| `impact` | `integer` | Yes | How much harm it does if it happens, from 1 (minor) to 5 (ends the Startup). |
| `treatment` | `string` | No | The chosen response: `treat`, `accept`, `transfer`, or `avoid`. |
| `owner` | [Role](/business/nouns/role) | Yes | The Role that owns the Risk and its next review. |
| `status` | `string` | Yes | `open`, `treated`, `accepted`, or `closed`. A closed Risk is kept forever. |
| `reviewBy` | `date` | No | When the owner next scores it again. |

## Object
```json
{
  "$id": "https://api.sb/ledgerlark.com/risks/risk_1",
  "$type": "Risk",
  "scope": "Example scope",
  "likelihood": 1,
  "impact": 1,
  "treatment": "treat",
  "owner": "role_1",
  "status": "open",
  "reviewBy": "2026-10-22"
}
```

## Relationships
- <a id="rel-portfolio"></a>A Risk **has** one [Portfolio](/business/nouns/portfolio): [Exposure](/business/nouns/exposure) shared across sibling [Startups](/business/nouns/startup), such as one upstream every sibling relies on. `portfolio`, inverse [`risks`](/business/nouns/portfolio#rel-risks).
- <a id="rel-startup"></a>A Risk **has** one [Startup](/business/nouns/startup): the Risks scored for one [Startup](/business/nouns/startup), open and closed. `startup`, inverse [`risks`](/business/nouns/startup#rel-risks).
- <a id="rel-treated-by"></a>A Risk **is treated by** many [Controls](/business/nouns/control): the [Controls](/business/nouns/control) that lower the Risk. Every Control cites the Risks it treats. `treatedBy`, inverse [`treats`](/business/nouns/control#rel-treats).

## Verbs
| Verb | Description | Subject | Event | Class |
| --- | --- | --- | --- | --- |
| [Risk.accept](/business/nouns/risk/accept) | Accept records an officer’s signed Decision to carry a Risk untreated until its next review. | [Founder](/agents/founding/founder) | [`Risk.accepted`](/business/events/Risk.accepted) | One-way: `send`, `do` |
| [Risk.assess](/business/nouns/risk/assess) | Assess scores a Risk’s likelihood and impact from the Startup’s records and sets its next review date. | [Risk Analyst](/agents/operations/risk-analyst) | [`Risk.assessed`](/business/events/Risk.assessed) | Two-way: `try`, `send`, `do` |
| [Risk.close](/business/nouns/risk/close) | Close ends a Risk that can no longer happen and keeps it, with its scores and treatments, forever. | [Risk Analyst](/agents/operations/risk-analyst) | [`Risk.closed`](/business/events/Risk.closed) | One-way: `send`, `do` |
| [Risk.treat](/business/nouns/risk/treat) | Treat links a Risk to the Controls that lower it and records the score it should reach. | [Risk Analyst](/agents/operations/risk-analyst) | [`Risk.treated`](/business/events/Risk.treated) | Two-way: `try`, `send`, `do` |
| <a id="create"></a>[Risk.create](/business/nouns/risk/create) | Creates a Risk. Inherited from [Noun](/business/nouns/noun). | None. | `Risk.created` | Two-way: `try`, `send`, `do` |
| <a id="get"></a>[Risk.get](/business/nouns/risk/get) | Returns one Risk by id. Inherited from [Noun](/business/nouns/noun). | None. | None. | Read: `try`, `do` |
| <a id="list"></a>[Risk.list](/business/nouns/risk/list) | Returns Risks, newest first, one page at a time. Inherited from [Noun](/business/nouns/noun). | None. | None. | Read: `try`, `do` |
| <a id="update"></a>[Risk.update](/business/nouns/risk/update) | Changes the given properties of a Risk. Inherited from [Noun](/business/nouns/noun). | None. | `Risk.updated` | Two-way: `try`, `send`, `do` |

A Risk is never deleted: it ends by [Risk.close](/business/nouns/risk/close), and its records stay.

## Permissions
Which Access level may call each Verb. One-way Verbs wait their delay window.

| Operation | `owner` | `admin` | `member` | `viewer` |
| --- | --- | --- | --- | --- |
| `Risk.create` | Yes | Yes | Yes | No |
| `Risk.get` | Yes | Yes | Yes | Yes |
| `Risk.list` | Yes | Yes | Yes | Yes |
| `Risk.update` | Yes | Yes | Yes | No |
| `Risk.accept` | Yes | No | No | No |
| `Risk.assess` | Yes | Yes | Yes | No |
| `Risk.close` | Yes | No | No | No |
| `Risk.treat` | Yes | Yes | Yes | No |

## Call it

**Ask**

```text
Assess the latest risk.
```

**API**

```bash
curl -X POST https://api.sb/shiftnote.app/risks/risk_1/assess \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"likelihood":1,"impact":1}'
```

```json
{
  "api": "https://api.sb/shiftnote.app",
  "risk": {
    "$id": "https://api.sb/shiftnote.app/risks/risk_1",
    "$type": "Risk",
    "scope": "Example scope",
    "likelihood": 1,
    "impact": 1,
    "owner": "role_1"
  },
  "action": {
    "$id": "https://api.sb/shiftnote.app/actions/action_1",
    "operation": "Risk.assess",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/shiftnote.app/actions/action_1"
  }
}
```

**SDK**

```ts
import { $ } from 'startup-builder'

const risk = await $.Risk.assess({ risk: 'risk_1', likelihood: 1, impact: 1 })
```

**CLI**

```bash
npx startup-builder do Risk.assess --json '{"risk":"risk_1","likelihood":1,"impact":1}'
```

**MCP**

```json
{
  "name": "do",
  "arguments": {
    "code": "return await $.Risk.assess({ risk: 'risk_1', likelihood: 1, impact: 1 })"
  }
}
```

## Example
A [Startup](/business/nouns/startup) relies on one model upstream for every reply. The [Risk Analyst](/agents/operations/risk-analyst) records a Risk with likelihood 3 and impact 4. It treats the Risk with a failover [Control](/business/nouns/control) and sets the next review for the end of the quarter.