DV,
Considering that a Cat C airprox is defined by the UK Airprox Board as one in which 'No risk of collision existed', I am certain that both MoD and MAA would consider the risk associated with that event both Tolerable and ALARP. Indeed, until 3 years ago, Cat C was also assigned to airproxes which the board considered to be 'non-events' (Cat E was only introduced in 2011). The Tornado mid-air collision risk is broken into three categories, Mil-Mil, Mil-GA and Mil-CAT, and Mil-CAT is considered the most unlikely. One very good reason for this is that CAT aircraft are all equipped with TCAS and at least one member of a Tornado formation will always be wearing a Mode 3/C squawk. If the analysis was being done purely on Mil-CAT collisions, there would be absolutely no case for fitment of CWS to Tornado. CWS is being fitted to address the Mil-Mil and Mil-GA risks, of which the former is (no surprise) the most likely.
To further illustrate how unreasonable it would be to ground the Tornado fleet for lack of a CWS, just consider what other mid-air collision mitigations must have already been discounted in reaching the current declaration of ALARP. For example, the ODH could insist that all Tornado flying be conducted under Instrument Flight Rules and ban autonomous low flying, while requiring the aircraft to be in continuous receipt of a Radar-based air traffic service. That would eliminate the mid-air collision risk almost at a stroke. But, it is not considered reasonably practicable, given the need for operational training to maintain readiness for the aircraft's declared roles (although training for low-intensity operations could probably take place under such constraints). Despite the impracticality, you can be totally assured that such a step would be taken in preference to grounding the fleet. Your suggestion that grounding is the only thing that would make the risk ALARP is totally unrealistic.
Your comparison with the Nimrod fuel system risk is also inappropriate; that risk arose from a physical characteristic of the airframe, and modification was the only possible fix. However, CWS is not the only mitigation to the mid-air collision risk. If the programme failed tomorrow, alternative steps could be taken to keep the risk below the tolerability threshold. Nimrod didn't have that luxury.
I also outlined in simple terms the process by which one can mitigate such risks, even in the face of rejection by higher committee. I imagine this did not go down well in MAA/MoD, because it goes against the notion, repeated above, that transference of risk to the SofS or a more senior rank/grade somehow absolves the junior of any obligation. One has an over-riding duty of care.
tuc, that's all very well when it comes to implementing safety-enhancing modifications. It doesn't read across to the sphere of operations, though. Otherwise, what is the point of a system of risk escalation? When a DDH has applied all reasonably practicable mitigations to an operating risk, but it is still too much for him to bear, he escalates it to the ODH. If the ODH is allowed to tolerate the risk, he can sign as saying so and operations can continue. That process is entirely pointless if the DDH then says "well it's still above my risk threshold, so I'm stopping anyway". Instead, the DDH carries on operating under the ODH's 'top cover', while applying whatever mitigations he can to keep the risk to a reasonably practicable minimum. Which, effectively, is what your junior engineer was doing when unilaterally applying safety enhancements.