I have been attempting to demonstrate why the risk is still considered tolerable and ALARP while the kit is under development
Not applicable in this case, as that phase was completed in the 90s. Was it tolerable and ALARP during the 16 years the Requirement was, apparently, frozen through lack of action? You are compartmentalising the risks to the present day and current initiative to resurrect this old abandoned requirement. That is a typical MAA/MoD ploy and, yet again, seems to be related to the dogma that nothing went wrong pre-1998, and everything was wrong from 1998-2010. The very fact that many infinitely more complex risks were successfully mitigated with effortless competence in these periods is conveniently ignored, especially by the MAA. They never want to ask Why?
The argument presented in this case simply does not stand the legal test, because the “reasonable time” to install the kit was exceeded. By MoD’s own admission it was good to go in 1996. (Withholding this information from inquiries was a separate, illegal act). The risk may have been ”tolerable and ALARP” for, say, the 2 years necessary to launch procurement and begin embodiment; but the failure (flat refusal) to meet this obligation created other, equally critical, risks. (Corporate, Management, Financial etc.) While I acknowledge nothing is more critical than loss of life, the existence of and refusal to mitigate these other risks demonstrably led to other accidents and deaths. THEY are definitely not tolerable and ALARP. Risk Management rules demand one assesses these risks in the round.
The status of the risks associated with CWS itself changed as soon as it became obvious the “reasonable time” would be exceeded. The probability of the risk (not fitting CWS on time) occurring became 100% (obviously, in about 2000). In practice one gets a red flag in your Risk Register because “100%” is not an acceptable entry. If the probability is 100%, it is not a risk (in the sense it MUST be mitigated to below 100%; for example, by approving funding). It MUST be escalated; for example, the SofS would need to issue a formal statement that he accepted the consequences. Did he? Was he even advised? How one deals with that is dependent on many factors, but an utterly crucial formal ruling exists whereby the Chief of Defence Procurement AT THIS TIME (Sir Robert Walmsley) upheld the creation of 2nd and 3rd Risk Registers, progressively removing such embarrassing MoD-owned risks, thus concealing the facts from auditors and investigators. Various Ministers have stated they are content with this, which may be of interest to the “Missing Files” inquiry!
tuc, that's all very well when it comes to implementing safety-enhancing modifications. It doesn't read across to the sphere of operations, though. Otherwise, what is the point of a system of risk escalation? When a DDH has applied all reasonably practicable mitigations to an operating risk, but it is still too much for him to bear, he escalates it to the ODH. If the ODH is allowed to tolerate the risk, he can sign as saying so and operations can continue. That process is entirely pointless if the DDH then says "well it's still above my risk threshold, so I'm stopping anyway". Instead, the DDH carries on operating under the ODH's 'top cover', while applying whatever mitigations he can to keep the risk to a reasonably practicable minimum. Which, effectively, is what your junior engineer was doing when unilaterally applying safety enhancements.
Like the MAA/MoD (I know, because I’ve listened in despair at them making this mistake) you seem to confuse Attaining and Maintaining airworthiness, and Fitness for Purpose. I’m talking about the first two; you’re correct if addressing the last. But they (MAA/MoD) don’t have the luxury of despair.
The “Junior Engineer” I mentioned was a civilian Staff Officer grade (in his post, by definition an experienced Engineer), one below the minima required to enter MoD(PE), and was addressing Attaining and Maintaining, which would avoid problems at Front Line and the need for Commanders to consider FFP, except in cases of equipment failure or logistic breakdown. This last sentence, in it’s entirely, is an alien concept in today’s MoD, so I accept very few understand it! But understanding it and perhaps re-introducing the concept, would make the MAA/MoD’s job a lot easier; and I, certainly, would look more kindly upon them for at least trying.