Risk register
Every risk with its owner, controls, live signal and rating against the appetite
Likelihood moves with the signal read from the owning service; the residual rating is likelihood times impact. Beyond the category's appetite the risk escalates to the audit and risk committee, which accepts it for a period or directs a treatment.
Appetite
Set by the audit and risk committee (GL-GA-01)
| Category | Statement | Tolerated rating | Set by |
|---|---|---|---|
| COMPLIANCE | We have very low appetite for breaching a statutory obligation. | 6 (MEDIUM) | Audit and risk committee, 3 August 2026 · 14/09/2026 |
| FINANCIAL | We accept low financial risk; no loss beyond budget tolerance without the council's knowledge. | 9 (MEDIUM) | Audit and risk committee, 3 August 2026 · 14/09/2026 |
| OPERATIONAL | We accept low risk to service standards; a breach of a statutory standard is not tolerated for more than a quarter. | 9 (MEDIUM) | Audit and risk committee, 3 August 2026 · 14/09/2026 |
| REPUTATION | We accept moderate reputational risk when acting lawfully and transparently. | 12 (HIGH) | Audit and risk committee, 3 August 2026 · 14/09/2026 |
| SAFETY | We have no appetite for avoidable harm to people; a safety risk rated high is escalated at once. | 6 (MEDIUM) | Audit and risk committee, 3 August 2026 · 14/09/2026 |
| STRATEGIC | We accept moderate risk in pursuing the community strategic plan's outcomes. | 12 (HIGH) | Audit and risk committee, 3 August 2026 · 14/09/2026 |
| TECHNOLOGY | We accept moderate technology risk in change, and low risk to the evidence chain and data. | 9 (MEDIUM) | Audit and risk committee, 3 August 2026 · 14/09/2026 |
Risks (14)
| Ref | Risk | Category | Service | Owner | Inherent | L × I | Residual | Signal | Reviewed | Status |
|---|---|---|---|---|---|---|---|---|---|---|
| RK-2026-001 | Recovery assistance paid late after a flood | SAFETY | MG-10 | Director, emergency and recovery | 20 | 2 × 4 | 8 MEDIUM | ? / 3mg10 recovery unpaid 10d | 25/08/2026 | OPEN |
| RK-2026-002 | Ministerial correspondence past the standard | REPUTATION | MG-14 | Chief of staff | 16 | 3 × 3 | 9 MEDIUM | ? / 2mg14 correspondence overdue | 25/08/2026 | OPEN |
| RK-2026-003 | Decisions attempted outside delegation | COMPLIANCE | MG-12 | General counsel | 20 | 1 × 5 | 5 MEDIUM | ? / 5mg12 delegation refusals 30d | 25/08/2026 | OPEN |
| RK-2026-004 | Flood gauges offline when needed | SAFETY | MG-10 | Director, emergency and recovery | 20 | 2 × 5 | 10 HIGH | ? / 2mg10 devices offline | 25/08/2026 | OPEN |
| RK-2026-005 | Statutory notices published late | COMPLIANCE | MG-15 | Communications director | 12 | 2 × 3 | 6 MEDIUM | ? / 1mg15 notices late | 25/08/2026 | OPEN |
| RK-2026-006 | Assessor conflicts unresolved before scoring | COMPLIANCE | MG-02 | Grants manager | 16 | 2 × 4 | 8 MEDIUM | ? / 1mg02 conflicts unresolved | 25/08/2026 | OPEN |
| RK-2026-007 | Debt recovery against ratepayers in hardship | OPERATIONAL | MG-04 | Revenue manager | 16 | 2 × 4 | 8 MEDIUM | ? / 1mg04 hardship in recovery | 25/08/2026 | OPEN |
| RK-2026-008 | Overpayment notices without the response period | COMPLIANCE | MG-03 | Director, payments | 20 | 1 × 5 | 5 MEDIUM | ? / 1mg03 overpayments no response period | 25/08/2026 | OPEN |
| RK-2026-009 | Evidence chain integrity lost | TECHNOLOGY | platform | Chief information officer | 15 | 1 × 5 | 5 MEDIUM | ? / 1platform chain broken | 25/08/2026 | OPEN |
| RK-2026-010 | Held decisions waiting too long | OPERATIONAL | platform | Chief operating officer | 12 | 3 × 3 | 9 MEDIUM | ? / 5platform holds over 5d | 25/08/2026 | OPEN |
| RK-2026-011 | Development applications past the statutory period | OPERATIONAL | MG-08 | Director, planning | 12 | 2 × 3 | 6 MEDIUM | ? / 1mg08 da over statutory | 25/08/2026 | OPEN |
| RK-2026-012 | Service requests past the resolution standard | OPERATIONAL | MG-01 | Director, customer service | 9 | 2 × 2 | 4 LOW | ? / 3mg01 sla breaches open | 25/08/2026 | OPEN |
| RK-2026-013 | Expired licences still trading | COMPLIANCE | MG-05 | Director, licensing | 9 | 1 × 3 | 3 LOW | ? / 1mg05 licences expired trading | 25/08/2026 | OPEN |
| RK-2026-014 | Cyber incident takes the platform offline | TECHNOLOGY | platform | Chief information officer | 16 | 2 × 4 | 8 MEDIUM | manual | 06/06/2026 | OPEN |