API Risk Management Framework V3

Raise a risk: the full intake process

A working walk through of how a risk moves from any staff member to the board register. Three steps, three people. Click through the whole loop or use the tabs to jump.

Raise a risk

Pinned on the staff intranet. Anyone can flag something, scoring language is optional.

Short title for the risk * In a few words, for example "Reliance on a single IT provider". Describe the risk * What could happen, and what could cause it. Write it as cause and effect if you can.

Which area does it most affect? * How bad could it be? *

How likely do you think it is? * Anything already in place that reduces this risk? Optional. Anything else we should know? Optional.

Behind the scenes: a Power Automate flow (standard connectors only) writes the submission to the Risk Submissions list, stamps it "New", and emails Elaine. No licence cost.

Flow ran › item created in Risk Submissions › status set to New › email sent to erebello@api.org.au

Risk Submissions

Elaine's triage inbox. Intake stays separate from the register so the register stays curated.

0 new

Heat map: all risks, residual position

Likelihood by consequence. Colour is the residual rating band. First issue of the rebuilt register, so movement tracking begins next cycle.

Risk register: curated view

The board detail view presented at FRAC. Inherent score, controls, residual score, appetite status.

Ref	Category	Risk statement and key controls	Inherent	Residual	Residual rating	Appetite	Owner

Demonstration build, 16 July 2026. Content matches Risk Register V3 as updated 16/07/2026 (including the August 2026 penetration testing window). Illustrative walkthrough only, not connected to any live system. Prepared for the API risk register rebuild, FRAC 18 August 2026.