Determine if the risk from the operation or use of the system or the provision or use of common controls, is acceptable.