1- Your organization’s current risk management policy (or nearest equivalent, e.g., risk evaluation, risk reduction, risk assessment Policy, etc.)
2- The organization’s current risk management procedures (or nearest equivalent, e.g., risk assessment procedures, risk evaluation procedures, risk control, etc.).
3- Risk Evaluation and Risk Control Guidance provided to employees (or any other related guidance that exists)
4- Any procedure or guidance or related document existing about how to decide if a risk needs to be reduced or not.
5- Any procedure or guidance or related document existing about how to evaluate if your organization is obliged by the regulations to reduce the identified risk to a lower level or not. In this case, if you use a specific tool like “cost-benefit analysis” or any other tools, it would be truly appreciated to provide those documents as well.
6- Any procedure, guidance, formula, guideline, instruction, direction, prescription, method, or process through which your organization decides if your organization is going to implement a measure to reduce risk, or, you will not implement more risk reduction measures; and in case of not implementing more risk reduction measure, how you justify that risks are reduced to a level As Low As Reasonably Practicable”
