# Risk management

Probo supports two related ways to reason about risk: a risk register for tracked business or security risks, and structured risk assessments for modeling systems, threats, scenarios, and their resulting risks.

## Risk register

A risk record describes a risk, its current state, and the context needed to evaluate it. Risks can be linked to:

- measures that reduce or monitor the risk;
- obligations that make treatment necessary;
- third-party assessments that identify vendor exposure;
- risk-assessment scenarios that explain how the risk may occur.

Keep the risk statement understandable without relying on a score alone. Record the affected activity or asset, the undesirable event, and the likely consequence.

## Threat-based assessments

A risk assessment can contain scopes, nodes, boundaries, processes, threats, and scenarios. Scenarios connect threats to one or more risks and make the assessment’s reasoning reviewable. Scope diagrams can be exported as Mermaid for use in technical review.

Assessments and register entries have separate lifecycles: the assessment documents analysis, while linked risks are the items the organization tracks and treats over time.

## Publication and review

Publishing risk records creates a reviewed list without preventing continued program operation. Revisit risks when systems, vendors, controls, or business assumptions change. Use measures and tasks for treatment work instead of placing implementation details only in the risk description.

## Automation

- [CLI risk](/docs/developers/cli/commands/risk) — Manage risk register entries with prb risk
- [CLI risk analysis](/docs/developers/cli/commands/risk-analysis) — Work with threat-based risk assessments
- [MCP risks](/docs/developers/api/mcp/tools/catalog/risks) — Query and update risks from supported AI tools
- [MCP risk assessments](/docs/developers/api/mcp/tools/catalog/risk-assessments) — Operate structured risk assessments through MCP
- [n8n Risk](/docs/developers/api/n8n/resources/risk) — Automate risk register operations in n8n
- [n8n Risk Analysis](/docs/developers/api/n8n/resources/risk-analysis) — Automate risk assessment operations in n8n