Regardless of the finer points of Risk Management the real problem here is that the MAA in its present form is not the answer.
Primarily because it simply will not acknowledge what the question is.
People didn't die because the regs were wrong. They died because senior staffs issued wasteful policies and then, to generate funding to conceal the waste, issued orders not to implement perfectly good regs (savings at the expense of safety). And to make sure they could not be implemented, withdrew funding. And too many obeyed.
None of this is in doubt. Original papers commencing June 1987 were submitted to Lord Philip. MoD's own auditors confirmed it in reports dated January 1989 and June 1996. Haddon-Cave ignored these reports and claimed the problem commenced in 1998. More recently, the MAA has been claiming 2002. (Allegedly the year Safety Cases were mandated. Contradicted somewhat by the 1992 policy mandating them for modification programmes, like Chinook and Nimrod. The Nimrod Safety Case task was conducted poorly in the early 2000s, but the real problem is that work on it commenced 10 years after it was first directed. And even then, prior to 1992 MoD required industry to have robust "safety arguments" - the only real difference was MoD management was vested in a different department). Sorry to repeat this, but the MAA continue to distort the truth by making these false claims in every presentation they give.
Until MoD/MAA acknowledges the truth, it cannot possibly proceed in the right direction. It has issued rafts of new or updated regs, but how to ensure staff will meet the legal obligation to implement them? This basic problem remains, and the upper echelons of DE&S is choc full of people brought up on the "safety is a waste of money" policy of the 90s/00s.