Every organisation needs to understand and manage its risks, both on an ongoing basis and when it changes something. Risk management can be thought of as comprising three related activities, which map to questions about safety-related change: