Risk, a potential occurrence of some undesirable event, can be dangerous if not adequately identified and dealt with early on during software development. However, identifying risks can be difficult, hence oftentimes resulting in a particular software system that is unable to address risks, especially critical ones adequately. This paper proposes an ontology-based framework for performing risk analysis with the Augmented Reference Model -The Reference Model augmented with risk analysis. The Reference Model emphasizes that the user requirements are met through the collaboration between the system and the events occurring in its environment -i.e., not by the system alone, hence the term "collaborative system." We also offer an activity-oriented ontology to carry out risk analysis by identifying risks from negating the events in the environment and system. Such negations of the requirements, specifications, and domain events generate a graph-like representation, called Risk Analysis Graph (RAG), to help perform risk analysis. To validate our framework, we have performed two experiments using questionnaires to identify risks and use the risk analysis tool to generate RAG for performing risk analysis. We feel that at least these experiments show that RAG helps identify risks -especially the critical and uncommon ones that we would not have thought of.