<![CDATA[Indonesia's regional governments have operated under mandatory internal-control risk assessment since Government Regulation No. 60/2008, yet research on the Internal Government Supervisory Apparatus (APIP) tends to isolate a single function, such as audit or fraud detection, rather than trace how one Inspectorate carries risk management across an entire policy cycle. This study examined how the Medan City Inspectorate performs that role across three stages: risk-management planning, risk-based financial oversight, and performance-reporting assistance. The study used a qualitative case-study design. Ten informants, purposively selected from the Inspectorate and a regional planning agency, took part in semi-structured interviews, supplemented by internal risk-management and performance documents. Data were analyzed using the Miles and Huberman model and checked through source and technique triangulation, supplemented by member checking. Results show the Inspectorate acting as coach, facilitator, and evaluator rather than as the party that identifies risk directly: it runs technical guidance before agencies draft their budgets, reviews the risk registers and control plans agencies produce, and feeds high-risk findings into the Annual Supervision Work Program. In financial oversight, the Inspectorate targets audits at high-risk activities and tracks agencies' follow-up on its recommendations. In performance reporting, it verifies reported results against field conditions and aligns risk documents with the regional development plan. Uneven staff understanding of risk concepts, tight budgets, and a compliance-oriented work culture still limit how far these practices reach. The findings indicate that risk management functions as one integrated cycle linking planning, spending, and reporting, rather than as separate audit episodes]]>
