Where a regulation requires risks to be managed, the duty holder must identify reasonably foreseeable hazards, eliminate the risk so far as reasonably practicable, and otherwise minimise it by working down the hierarchy: substitution, isolation or engineering controls, then administrative controls, then personal protective equipment, using combinations where needed. Control measures must be kept effective, fit for purpose, suitable for the work and installed and used correctly, and must be reviewed and revised when they fail, before a change, when a new hazard or risk is identified, when consultation indicates review is needed, or when a health and safety representative requests it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.