Where risks cannot be managed within an individual’s delegated responsibility, the risk shall be formally referred using the DE&S risk referral procedure.