Core rules
Every risk has an owner, probability, impact, mitigation plan, and due date.
Aging risks trigger escalation based on severity + time.
Risk burn-down is tracked as a first-class signal.
Anti-patterns to avoid
“Watching” a risk without a mitigation and due date.
Closing risks without evidence that the trigger is retired.

