# Risk assessment

URL: /workflows/processes/risk-assessment · Id: `process:risk-assessment`

> Risk assessment scores every open Risk each quarter, links each to the Controls that treat it, and sends the result to an officer to accept.

Risk assessment scores every open [Risk](/business/nouns/risk) each quarter, links each to the [Controls](/business/nouns/control) that treat it, and sends the result to an officer to accept.

## Outcome
| Part | This Process |
| --- | --- |
| Outcome | Each open Risk is scored every quarter, linked to the Controls that treat it, and treated or accepted by an officer. |
| Reads | [Risk](/business/nouns/risk) |
| Leaves | [Risk](/business/nouns/risk), [Decision](/business/nouns/decision), [Message](/business/nouns/message) |
| Runs in | Each Startup |

## Accountable
[Risk Analyst](/agents/operations/risk-analyst), [Operations Team](/agents/operations).

Responsible: [Risk Analyst](/agents/operations/risk-analyst).

Consulted: [Security Engineer](/agents/engineering/security-engineer), [Finance Lead](/agents/finance/finance-lead), [Legal Lead](/agents/legal/legal-lead).

Informed: [Founder](/agents/founding/founder).

## Workflows
| Workflow | Runs | Team |
| --- | --- | --- |
| [Assess risks](/workflows/processes/risk-assessment/assess-risks) | every quarter | [Operations Team](/agents/operations) |

## Who does each step

| Workflow | Step | Role | Calls | Approval |
| --- | --- | --- | --- | --- |
| [Assess risks](/workflows/processes/risk-assessment/assess-risks) | 1. List every open Risk and every Risk past its review date. | [Risk Analyst](/agents/operations/risk-analyst) | [Risk.list](/business/nouns/risk/list) | None |
| [Assess risks](/workflows/processes/risk-assessment/assess-risks) | 2. Score each Risk’s likelihood and impact from the Startup’s records. | [Risk Analyst](/agents/operations/risk-analyst) | [Risk.assess](/business/nouns/risk/assess) | None |
| [Assess risks](/workflows/processes/risk-assessment/assess-risks) | 3. Link each Risk to the Controls that lower it. | [Risk Analyst](/agents/operations/risk-analyst) | [Risk.treat](/business/nouns/risk/treat) | None |
| [Assess risks](/workflows/processes/risk-assessment/assess-risks) | 4. Send each Risk left above its target to the Founder to accept or fund. | [Founder](/agents/founding/founder) | [Risk.accept](/business/nouns/risk/accept) | Asks first; waits 1 business hour |
| [Assess risks](/workflows/processes/risk-assessment/assess-risks) | 5. Send the Founder the quarter’s risk register. | [Risk Analyst](/agents/operations/risk-analyst) | [Message.create](/business/nouns/message/create) | None |

## Events
| Direction | When | What happens |
| --- | --- | --- |
| In | Every quarter | Starts [Assess risks](/workflows/processes/risk-assessment/assess-risks) |
| Out | [`Risk.assessed`](/business/events/Risk.assessed) | Raised by step 2 of [Assess risks](/workflows/processes/risk-assessment/assess-risks) |
| Out | [`Risk.treated`](/business/events/Risk.treated) | Raised by step 3 of [Assess risks](/workflows/processes/risk-assessment/assess-risks) |
| Out | [`Risk.accepted`](/business/events/Risk.accepted) | Raised by step 4 of [Assess risks](/workflows/processes/risk-assessment/assess-risks) |
| Out | `Message.created` | Raised by step 5 of [Assess risks](/workflows/processes/risk-assessment/assess-risks) |

## Plays
No Play names this Process.

## Controls
No Control names this Process or a Workflow of it.

## Settings
None.

## Failure
A failed step retries; when retries run out, the Action goes to the [Risk Analyst](/agents/operations/risk-analyst).

## Loop
No loop: the path is never randomized, because it serves [Risk assessment](/systems/trust-and-governance/controls/risk-assessment).

## Code

**Ask**

```text
Turn on risk assessment
```

**API**

```bash
curl -X POST https://api.sb/leaseline.app/processes/process_1/enable \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"
```

**SDK**

```ts
import { $ } from 'startup-builder'

await $.Process.enable({ process: 'process_1' })
```

**CLI**

```bash
npx startup-builder do Process.enable --json '{"process":"process_1"}'
```

**MCP**

```json
{
  "name": "do",
  "arguments": {
    "code": "return await $.Process.enable({ process: 'process_1' })"
  }
}
```

## Enable
On by default for every Product Template. [Process.pause](/business/nouns/process/pause) stops new Actions; Actions in progress finish.

## Example
At the end of the quarter, the [Risk Analyst](/agents/operations/risk-analyst) rescores 14 open [Risks](/business/nouns/risk) and closes two. The [Founder](/agents/founding/founder) signs the acceptance of the one Risk the [Startup](/business/nouns/startup) carries untreated.