---
name: legal-risk-assessment
description: Use when asked to assess legal risk — identifying, evaluating, and prioritizing an organization's exposure to legal liability, regulatory action, or dispute — as the framework that turns legal-due-diligence and legal-compliance-audit findings into prioritized action.
---

# Legal Risk Assessment

Legal risk assessment identifies, evaluates, and prioritizes an
organization's exposure to legal liability, regulatory action, or
dispute — turning raw findings (from [[legal-due-diligence]],
[[legal-compliance-audit]], or other sources) into a prioritized picture
of what actually needs attention.

## General process

1. **Identify risks** — list specific legal risks facing the
   organization, drawn from compliance audits, due diligence,
   litigation history, and known industry/regulatory exposure.
2. **Assess likelihood and impact** — for each risk, estimate how
   likely it is to materialize and how severe the consequences would be
   if it does.
3. **Prioritize** — rank risks by combined likelihood and impact, not
   by which is most visible or easiest to address.
4. **Develop mitigation strategies** — for high-priority risks,
   identify concrete steps to reduce likelihood, reduce impact, or
   transfer the risk (e.g. via insurance or contractual allocation).
5. **Monitor and reassess** — risk profiles change as the business,
   regulatory environment, and case law evolve.

## Why prioritization matters

Organizations face far more theoretical legal risks than they can
practically address with equal attention; the value of a structured
risk assessment is directing limited resources toward the risks that
combine meaningful likelihood with meaningful impact, rather than
spreading effort evenly or reactively chasing whichever risk was most
recently in the news.

## Common pitfalls

- **Assessing risks in isolation from business context** — a legal risk
  assessment disconnected from what the business actually does and
  where it's growing tends to miss emerging risk areas.
- **Treating likelihood and impact as equally weighted without
  justification** — a low-likelihood, catastrophic-impact risk and a
  high-likelihood, minor-impact risk need different mitigation
  strategies, not identical treatment.
- **No mechanism to reassess as circumstances change** — new
  regulations, new business lines, or new case law can shift a risk's
  priority significantly; a static, one-time assessment goes stale.
- **Confusing risk identification with risk elimination** — the goal of
  the assessment is informed prioritization and mitigation, not the
  unrealistic expectation of eliminating legal risk entirely.

## Learn more

- [[legal-due-diligence]], [[legal-compliance-audit]] for common sources of risk-assessment input.
- [[risks-actions-issues-decisions]] for a general project-risk-tracking tool applicable alongside legal-specific risk assessment.