Rail Safety (General) Regulation 2008
4 General requirements for safety management systems
(1) A safety management system of a rail transport operator must:(a) include or provide for all of the matters listed in Schedule 1 that are relevant to the railway operations for which the operator is accredited, or seeking to be accredited, and(b) provide a level of detail with respect to each of these matters that is appropriate, having regard to the scope and nature of those operations and any risks to safety identified as arising or that may arise from the carrying out of the railway operations, and(c) provide for the risk management principles set out in subclauses (2) and (3).(2) If the elimination of a risk to safety is not reasonably practicable, a safety management system must provide for the following measures to be taken:(a) firstly, substituting the hazard giving rise to the risk with a hazard that gives rise to a lesser risk,(b) secondly, isolating the hazard from the person put at risk,(c) thirdly, minimising the risk by engineering means,(d) fourthly, minimising the risk by administrative means (for example, by adopting safe working practices or providing appropriate training, instruction or information),(e) fifthly, using personal protection.(3) A safety management system must provide that a combination of the above measures is required to be taken to minimise the risk to the lowest level reasonably practicable if no single measure is sufficient for that purpose.