However, JTO makes a hugely valid point if he is correct that some officers are saying a risk/threat is deemed ALARP when all they have done is identified the problem but not actually mitigated/addressed it (ie no funding).
Spot on. This is directly linked to my comment above that it became common practice to regard Risk Management as simply the identification and recording of risk, without mitigating them.
I recall one Shrivenham type who, when the subject came up, always shouted out "What software do you use?" Post 1996, the answer was "Pandora" as that was MoD's own tool. His reply was always "Pandora's rubbish". That was all he'd been taught on a Defence Administration MBA - to fill in the boxes in Pandora. But of course filling in the boxes doesn't actually create a mitigation plan or implement it. The concept of mitigation was completely alien to him (an otherwise quite intelligent young man). To us dinosaurs, it merely confirmed our thoughts on people who are given huge responsibility while being allowed to skip 5 or 6 grades. Flip's super-shineys!
This culture was widespread in MoD(PE) and then DPA, largely because our 2/4 Stars (2 Star was the same one as Nimrod and Chinook) refused to allocate resources to mitigation. If you insisted on mitigating risk, you had to do so in your own time, at home and with no funding. Not much has changed and I'm not sure the MAA has the authority to force change.