Action 2 has three sub-actions that shall be followed: identify risks and potential impacts through a risk assessment of the proposed change; decide how the risk and its controls can be managed as far as reasonable practicability allows; and decide whether the change is needed, justified and has support. The operator shall assess the risks and impacts that arise or could arise from making the change and shall document the controls, which should cover the audits, expertise, resources and staff used to manage safety risks and the procedures by which the adequacy of those controls is monitored, reviewed and revised. The law sets specific requirements for documenting the risk assessment and the controls chosen, and the assessment should follow the operator's own risk management procedures.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.