So, this is something that AOC 1 Group would be required to calculate, and defend at a FAI.
There is a blurring of responsibilities in the MoD between DE&S and the DH that causes problems in this area. The MRP tries to make it clear, but it doesn't work all that well in practice. The DH will say that only they can truly control the risk to life, i.e. the individuals exposure, and they would be right. But it is often DE&S, in combination with the supplier, who really (should) understand the equipment and how it contributes to the risk. So in reality, they need to work together.
I will leave you to decide who should prepare the risk assessment and have to defend at any FAI.
I don't think you need the links below DV, but they may be of benefit to others:
http://www.hse.gov.uk/risk/theory/r2p2.pdf
and
http://www.hse.gov.uk/pubns/indg163.pdf
These are the UK HSE's interpretations of the law and how to comply. Clearly the examples used are much simpler than military aviation, but the basic principles are the same and the law applies equally to simple and complex systems.
Of course the other major problem the MoD has is applying this to different scenarios, e.g. combat or combat support versus routine training etc. The crew of XV230 would have been exposed to pretty much the same (AAR related) risks on a training mission as they were flying over Afghanistan. The main difference is the benefit that is being delivered by taking the risk. That is very hard to measure and why that decision sits with the DH. Of course, if your safety assessment and safety case is so badly flawed that you don't even know or understand the risk, then..................
S-D