Production · Risk Management

Risk Intake Pipeline

Automated the full lifecycle of security risk management: from a self-service Slack form anyone in the company can submit, through security team review, to a fully populated risk register and Linear tracking issue. Built with Claude Cowork skills, Slack workflows, and Google Apps Script.

Role
Designer & Operator
Built With
Claude Cowork
Status
Live in Production
Tools
Slack · Linear · Google Sheets
Risk management lived in a spreadsheet and one person's head
The risk register is a 33-column Google Sheet. Each risk needs a row in the spreadsheet and a corresponding Linear issue for triage. Column A of each row has to be hyperlinked to its Linear issue as the source of truth for tracking status. Before this project, populating a single risk meant clicking through dozens of cells, creating a Linear issue with a specific description template, then manually hyperlinking the cell. 15 to 20 minutes per risk if everything went smoothly. Reporting a risk meant knowing who to tell and hoping they would log it.
Anyone can submit a risk from Slack
A Slack workflow form in a public channel. No security expertise required. Describe what you see, where it came from, and which systems are affected. The pipeline handles the rest.
Slack | #risk-intake
# risk-intake Submit security risks for the GRC team to review W Workflow Today 10:15 AM Submit a Security Risk Describe the risk and the GRC team will review it. What is the concern? Third-party analytics SDK has broad data access permissions but no DPA on file. Collecting user behavioral data. Where did this come from? Vendor security review for Q3 onboarding Which product or system? Employer Platform Systems affected User analytics, event tracking Submit The security team will review and rate this risk.
Security team rates in a private thread
Submissions arrive in a private review channel. The reviewer adds the ratings that require security judgment: likelihood, impact, risk response, and owner. A checkmark reaction approves it for processing.
Slack | #risk-review (private)
🔒 risk-review Security team only R Risk Intake Bot Today 10:16 AM New Risk Submission Concern: Third-party analytics SDK has broad data access permissions but no DPA on file Source: Vendor security review for Q3 onboarding Product: Employer Platform Systems: User analytics, event tracking Thread S Stanley 10:22 AM Likelihood: Likely | Impact: Moderate | Confidentiality: High Response: Mitigate | Owner: Privacy Team | Status: Open Risk Pipeline 9:00 AM next day R-026 created. Linear issue RIS-51 linked. Register row populated.
From form submission to tracked risk, no spreadsheet clicks
The pipeline separates judgment from mechanics. Humans provide the security assessment. The system handles data entry, issue creation, and linking.
01

Slack Submission

Anyone fills out a simple form in #risk-intake. Six fields capture enough context for a full risk assessment. No security expertise required.

02

Private Review

The submission posts to #risk-review, visible only to the security team. Each submission arrives as a structured message with all form fields populated.

03

Security Rating

The reviewer adds the calls that require judgment: likelihood, impact dimensions, risk response strategy, and owner. These go in a thread reply.

04

Approval

A checkmark reaction marks the submission as approved. The pipeline picks it up on the next scheduled run.

05

Linear Issue

The system creates a Linear issue in the Risk project with a structured description: risk details, assessment table, controls, and treatment plan.

06

Register Population

Google Apps Script populates all 28+ non-formula columns in a single execution. No cell-by-cell clicking. Every field lands in the right column.

07

Hyperlink Binding

Column A of the risk register row gets a rich-text hyperlink to the Linear issue. This is the source of truth for whether a risk is being tracked.

08

Confirmation

The pipeline replies in the review thread with the risk ID, Linear issue link, and a clipboard emoji reaction to mark it complete.

Skills, scripts, and scheduled tasks
The risk-assessment skill encodes the full column structure, risk statement patterns, rating scales, and Apps Script templates. Claude reads the skill and follows the patterns. A scheduled task processes approved submissions every weekday morning.
Why Apps Script over UI automation

Early attempts to populate the spreadsheet involved clicking into each cell and typing values. This was fragile: the Name Box did not navigate reliably, cells sometimes did not activate, dropdowns were finicky. A single Apps Script function writes all 28+ columns in one execution. If your workflow involves Google Sheets and you are automating through the UI, stop and write an Apps Script instead.

🤖

Risk Assessment Skill

Encodes the 33-column register structure, risk statement patterns, Linear description templates, rating scales, and Apps Script templates. Supports structured and quick-intake modes.

Scheduled Processing

Weekday mornings at 9am, the pipeline scans #risk-review for approved submissions. Each one gets a Linear issue, a populated register row, and a confirmation reply.

💬

Slack Workflow

A public-channel workflow form collects risk submissions from anyone in the company. Structured fields feed directly into the review pipeline.

🔗

Linear MCP

Creates issues in the Risk project with structured descriptions. Links risk IDs to the register via column A hyperlinks.

📄

Google Apps Script

Two functions: one writes all non-formula columns in a single execution, the other sets rich-text hyperlinks programmatically. No manual cell navigation.

📊

Google Sheets

The risk register: 33 columns across four sections covering identification, assessment, treatment, and monitoring. Formula columns calculate residual risk automatically.

33 columns, four sections, zero manual entry
Each risk in the register follows a structured format. The skill knows which columns are formulas (skip them), which are dropdowns (use exact values), and which spacer columns separate the sections.
Risk Register Structure
SECTION COLUMNS POPULATED BY Identification Risk ID, Statement, Description, Category, Source, Owner Apps Script Assessment Likelihood, Impact (C/I/A), Inherent Risk, Control Effectiveness Human (reviewer) Treatment Response, Treatment Plan, Residual Risk, Target Date Human (reviewer) Monitoring Review Date, Status, Notes, Linear Issue Link Apps Script Formula columns (Inherent Risk Score, Residual Risk Score) are skipped during population. Spacer columns separate sections.
What the automation handles
📥

Self-Service Intake

Anyone in the company can submit a security risk from Slack. No security expertise required, no knowledge of the register structure or tracking tools.

📋

Register Population

Apps Script writes all 28+ non-formula columns in a single execution. Risk statement, ratings, owner, treatment plan, and monitoring fields all land in the right cells.

🔗

Linear Tracking

Every risk gets a Linear issue with a structured description template. Column A of the register hyperlinks to the issue as the single source of truth.

📝

Risk Statements

The skill generates structured risk statements: "[Threat] increases the risk of [Event], leading to [Impact]." Consistent language across the register.

Daily Processing

A scheduled task runs every weekday morning. Approved submissions from the previous day are processed automatically alongside existing GRC triage work.

🔨

Quick Intake Mode

Drop in raw notes, a Slack thread, or a pentest finding. The skill drafts the full risk assessment in one response for the reviewer to confirm.

What it's built with
Claude Cowork Cowork Skills Scheduled Tasks Slack Workflows Slack MCP Linear MCP Google Apps Script Google Sheets openpyxl (backfill)
Impact
1
Session to backfill the full register
0
Spreadsheet clicks per new risk
6
Form fields to full assessment
33
Register columns, auto-populated