API Risk Management Framework V3

Raise a risk: the full intake process

A working walk through of how a risk moves from any staff member to the board register. Three steps, three people. Click through the whole loop or use the tabs to jump.

Raise a risk

Pinned on the staff intranet. Anyone can flag something, scoring language is optional.

Short title for the risk * In a few words, for example "Reliance on a single IT provider". Describe the risk * What could happen, and what could cause it. Write it as cause and effect if you can.

Which area does it most affect? * How bad could it be? *

How likely do you think it is? * Anything already in place that reduces this risk? Optional. Anything else we should know? Optional.

Behind the scenes: a Power Automate flow (standard connectors only) writes the submission to the Risk Submissions list, stamps it "New", and emails Elaine. No licence cost.

Flow ran › item created in Risk Submissions › status set to New › email sent to erebello@api.org.au

Risk Submissions

Elaine's triage inbox. Intake stays separate from the register so the register stays curated.

0 new

Risk register

The curated board view presented at FRAC. Inherent score, controls, residual score, appetite status.

Ref	Category	Risk statement	Inherent	Residual	Residual rating	Appetite	Owner

Showing 6 representative risks of the 29 in the full register. Newly promoted submissions appear here with their reference. The board sees the count outside appetite up front (the summary tiles above), then the detail.

Demonstration build. The data and questions match the live V3 framework specification. Prepared for the API risk register rebuild, FRAC 18 August 2026.