NRC INSPECTION MANUAL NMSS/FCSE

INSPECTION MANUAL CHAPTER 2606

ASSESSMENT OF THE RISK

RESULTING FROM A

POTENTIAL SAFETY NONCOMPLIANCE AT A FUEL CYCLE FACILITY
Issue Date: 04/01/16 i 2606

2606-01 PURPOSE....................................................................................................1

2606-02 OBJECTIVES...............................................................................................1

2606-03 APPLICABILITY ...........................................................................................1

2606-04 DEFINITIONS...............................................................................................1

04.01 Control..........................................................................................................2

04.02 Credited Control ...........................................................................................2

04.03 Enabling Event .............................................................................................2

04.04 Likelihood .....................................................................................................2

04.05 Safety Basis .................................................................................................2

04.06 Safety Concern.............................................................................................3

04.07 Unanalyzed Condition ..................................................................................3

04.08 Uncredited Control........................................................................................3

2606-05 RESPONSIBILITIES AND AUTHORITIES ...................................................3

05.01 Director, Region II, Division of Fuel Facility Inspection (DFFI). .....................3

05.02 Director, FCSE. ............................................................................................3

05.03 Branch Chiefs, DFFI.....................................................................................4

05.04 Branch Chiefs, FCSE. ..................................................................................4

05.05 Fuel Cycle Facility Inspectors. ......................................................................4

05.06 Office of Regulatory Research, Division of Risk Analysis, Director ...............4

2606-06 REQUIREMENTS ........................................................................................4

06.01 Assessing Risk Following a Potential Noncompliance ..................................4

2606-07 REFERENCES...........................................................................................13

Attachment 1: Safety Significance worksheet......................................................... Att1-1

Attachment 2: Sample Safety Significance Worksheet ........................................... Att2-1

Attachment 3: Sample Safety Significance Worksheet ........................................... Att3-1

Attachment 4: Revision History for IMC 2606 ......................................................... Att4-1
Issue Date: 04/01/16 1 2606

2606-01 PURPOSE

This inspection manual chapter (IMC) provides guidance for determining the risk of an 

accident at a fuel cycle facility resulting from a potential noncompliance. Specifically, 

this IMC details an approach to analyze the safety-significance of an upset condition,

control failure, or degraded condition (including an unanalyzed condition) resulting from 

a potential noncompliance using the licensee’s NRC approved safety analysis methods,

as applicable. 

2606-02 OBJECTIVES

This IMC provides the Nuclear Regulatory Commission (NRC) staff with a method to use 

facility safety information to evaluate a potential noncompliance at a fuel cycle facility

based on risk. The considerations in this IMC are only applicable to determining safety 

significance, and may not be used to determine compliance, to assess the root cause, or 

to assess the overall significance (including regulatory significance). The determination 

of risk or safety-significance is an important consideration in determining any appropriate

Agency enforcement action. 

2606-03 APPLICABILITY

This IMC is applicable to fuel cycle licensees licensed under 10 CFR Parts 40 and 70, 

with or without an approved integrated safety analysis (ISA). The process in this IMC is 

a structured analytical method and relies on the use of either the licensee’s NRCapproved ISA methodology or the risk assessment method discussed in Section 2606-

06 of this IMC.

Risk assessment should be based on controls, which may or may not include items 

relied on for safety (IROFS), credited before occurrence of the potential noncompliance. 

For the purposes of this manual chapter, the term, “IROFS” may be used to also 

describe credited controls for 10 CFR Part 40 licensees. Consideration may also be 

given for controls which were not specifically credited for the affected accident sequence

but which were formally established beforehand for other reasons. Engineered features 

and operator actions which were not documented and controlled, consistent with the 

approved methodology and prior to the potential noncompliance, should not, in general, 

be considered. In limited cases, consideration may be appropriate for process 

conditions or the natural and credible course of events when based on a compelling 

argument demonstrating reasonable assurance that such conditions would necessarily 

be present. In no case should the determination of risk rest solely on the natural and 

credible course of events. 

2606-04 DEFINITIONS

Terms used in this IMC are as defined in NRC regulations and guidance (e.g., NUREG1520, “Standard Review Plan for the Review of a License Application for a Fuel Cycle 
Issue Date: 04/01/16 2 2606

Facility”). Any specialized terms for use in this IMC are defined below.

04.01 Control

A structure, system, component, or operator action, relied on to prevent or mitigate an 

accident of concern. The term “control” implies that the engineered features or 

administrative actions must be formally recognized, documented, implemented, and 

maintained as such by the licensee prior to occurrence of the potential noncompliance, 

and includes items relied on for safety (IROFS), other safety controls (e.g., double 

contingency controls), systems of controls working together to perform a single safety 

function, and formal licensee programs (e.g., fire protection program, chemical safety 

program, material control and accounting program). These controls must be able to 

perform a safety function that would prevent or mitigate an accident of concern. 

04.02 Credited Control

A control that is documented, implemented, and maintained by the licensee’s approved 

methodology, as required by the license for that control, for an accident sequence or 

contingency applicable to the potential noncompliance that occurred.

04.03 Enabling Event

As defined in Nuclear Regulatory Commission Issuances, Volume 61, January – June 

2005, an enabling event is a subsequent event that must take place for the accident 

sequence to proceed to a point where adverse consequences might occur.

04.04 Likelihood

The probability or frequency of occurrence of an accident of concern (e.g., resulting in an 

intermediate or high consequence as specified in 10 CFR 70.61.) Likelihood may be 

expressed in terms of the frequency of an initiating event, the probability of failure of a 

control on demand, or the frequency of an accident. While likelihood may be presented 

in terms of probability or frequency, it may be evaluated quantitatively or qualitatively, in 

accordance with the licensee’s approved methodology. Individual fuel cycle licensees 

define specific likelihood categories (e.g., “highly unlikely,” “unlikely,” “not unlikely,” and 

“credible”) in their safety analyses and ISAs.

04.05 Safety Basis

Licensee safety analyses which ensure compliance with regulatory requirements and the

safe operation of the facility with licensed materials. Safety basis documents include the

ISA, license application and all other safety analyses, technical evaluations, calculations 

and other supporting documentation the licensee used to establish safety limits and

controls.
Issue Date: 04/01/16 3 2606

04.06 Safety Concern

An ongoing condition, as in a continuing operation, in which the risk of an accident of 

concern is determined to be unacceptable for long-term operation (e.g., risk of a highconsequence event is less than “highly unlikely” or that of an intermediate-consequence 

event is less than “unlikely”).

A “significant safety concern” is one in which the risk of a high-consequence event is 

“unlikely” or that of an intermediate-consequence event is “not unlikely.”

An “immediate safety concern” is one in which the risk of a high-consequence event is 

“not unlikely,” or where a high- or intermediate-consequence event has occurred or is 

imminent.

04.07 Unanalyzed Condition

An event or condition that results in the facility’s being in a state that the licensee did not

previously analyze in a licensee’s safety basis documentation (e.g., criticality safety 

analyses, ISA documentation). Unanalyzed conditions do not include events or 

conditions that the licensee considered and dismissed as not credible or considered as 

bounded by another event or condition, provided such events and conditions were 

recognized and formally documented. 

04.08 Uncredited Control

A control that is not recognized or formally documented by the licensee with maintaining 

risk at an acceptable level for an accident sequence or contingency applicable to the 

potential noncompliance that occurred, but which is recognized, documented, 

implemented, and maintained (according to the licensee’s approved methodology) for 

another safety purpose.

2606-05 RESPONSIBILITIES AND AUTHORITIES

05.01 Director, Region II, Division of Fuel Facility Inspection (DFFI).

a. Coordinates resource activities related to the IMC with the Division of Fuel Cycle 

Safety, Safeguards & Environmental Review (FCSE).

b. Communicates safety concerns to appropriate senior management.

05.02 Director, FCSE.

a. Coordinates resource activities related to this IMC with Region II, DFFI

b. Provides technical resources to facilitate determination of safety concerns and 

significance.

c. Communicates safety concerns to appropriate senior management.
Issue Date: 04/01/16 4 2606

05.03 Branch Chiefs, DFFI.

a. Provide on-site inspection resources to perform the assessment of safety 

concerns and significance.

b. Communicates safety concerns and significance as determined by inspectors to 

FCSE and appropriate senior management.

05.04 Branch Chiefs, FCSE.

a. Provide inspection and technical review resources as needed to facilitate 

determination of safety concerns and safety significance.

b. Communicate safety concern and significance determinations to DFFI and 

appropriate senior management.

05.05 Fuel Cycle Facility Inspectors.

a. Apply this IMC to determine whether there is a safety concern related to a 

potential noncompliance.

b. Apply this IMC to determine the safety significance of a potential 

noncompliance.

c. Coordinate with FCSE staff as needed to gather the technical information 

necessary to determine whether there is a safety concern and assess the safety 

significance of a potential noncompliance.

d. Communicate safety concerns and significance determinations to appropriate 

licensee and NRC management.

05.06 Office of Regulatory Research, Division of Risk Analysis, Director

Coordinates technical resources, as needed, to assist DFFI and FCSE in reaching 

consensus on technical issues associated with the assessment.

2606-06 REQUIREMENTS

06.01 Assessing Risk Following a Potential Noncompliance

This IMC describes a method for assessing risk based on a licensee’s safety evaluation 

of the accident sequence or contingency involving the potential noncompliance that 

occurred. The process for assessing the risk consists of (1) identifying the accident 

sequences or contingencies affected by the potential noncompliance, (2) determining the 

controls and other considerations applicable to those accident sequences or 

contingencies, including degraded or failed controls and those remaining available and 
Issue Date: 04/01/16 5 2606

reliable, (3) assessing the consequence of the sequences or contingencies based on the 

previous determination, and (4) assessing the likelihood of the consequence to 

determine the risk following the potential noncompliance. The consideration of likelihood 

may be done quantitatively, qualitatively, or deterministically. This process is discussed 

in further detail below. Attachments 1, 2, and 3 provide blank and sample assessment 

forms that can be used to follow the process and communicate the results. 

a. Identify the Accident Sequences or Contingencies

The staff will determine from the licensee’s safety basis documentation (e.g., 

criticality safety evaluations, ISA) the accident sequences or contingencies

associated with the abnormal condition or control failure that occurred. If the 

licensee’s safety basis documentation does not specifically identify the affected

accident sequences or contingencies, such as may occur when an unanalyzed 

condition is discovered, the NRC staff should first identify whether the event or 

condition is similar to another sequence or contingency that was analyzed. In 

addition, the staff should evaluate the potential for applicability to other 

sequences and contingencies that may also be affected.

Section 06.01 (c) and (d) will discuss assessing consequence and likelihood in 

terms of what events and controls may be considered, and to what extent.

b. Identification and Consideration for Controls

Licensees subject to the regulations of Subpart H of 10 CFR Part 70 are 

required to designate as IROFS engineered or administrative controls necessary 

to meet the 10 CFR 70.61 performance requirements. Whether all necessary 

controls have been designated as IROFS is, therefore, a matter of compliance; 

however the safety significance of a noncompliance is influenced by the quality 

of the management measures applied to a control, such as how the control is 

treated in the licensee’s configuration management program. For the more 

detailed assessment of safety significance following the initial assessment, the 

staff should consider and credit all formally established and documented 

controls applicable to the situation and commensurate with their availability and 

reliability, depending on the management measures applied to them. 

Previously, it was common to discuss crediting IROFS versus other safety 

controls and whether “full credit” or “partial credit” for a given type of control 

should be applied to them, as in the case of controls which are failed or 

degraded. This IMC revises that approach. Specifically, the amount of risk 

reduction should not be based solely on the type of control, except as a crude 

and bounding estimate, but rather should also take into account all relevant 

characteristics (what NUREG-1520 calls “availability and reliability qualities”). 

Rather than attempting to give partial credit when there are reduced 

management measures, credit will be given appropriate to the type of control 

(whether an IROFS or other formally established and documented safety 

control), taking into account the management measures that were actually 

applied to it (as opposed to what were required to be applied).
Issue Date: 04/01/16 6 2606

Other than considering how a control is treated in the licensee’s management 

measures programs, the staff should make no distinction between IROFS and 

other formal controls with regard the detailed assessment of safety significance. 

The staff may also consider other characteristics of controls, as appropriate. 

The staff should consider all relevant information so as to arrive at the most 

realistic determination of safety significance. Therefore, enabling events and 

the natural and credible course of events may also be credited if the licensee’s 

approved ISA methodology allows this accreditation. The licensee must justify 

enabling events and the natural and credible course of events based on 

experimental measurements, physical arguments, the nature of the process, 

etc., when there is adequate assurance that the credited event or condition will 

be present when needed.

The staff should not give credit, however, for “as-found” conditions, by which is 

meant conditions the licensee does not ensure via formal controls or such other 

considerations as described above. In cases where an accident did not actually 

occur, there will be some physical reason that can be found to explain this fact. 

The staff should not credit such factors if the licensee does not ensure or 

formally control them. For example, the staff should not credit the fact that only 

a small amount of material was present at the time of a potential noncompliance 

if much larger amounts of material are routinely present or allowed under 

existing plan procedures.

For assessing significance, the staff may credit events and conditions which 

were identified after the fact, such as controls for other accident sequences or 

contingencies. This is the case even if a licensee has not recognized the impact 

of these events or conditions on the safety significance. The staff has discretion 

whether to consider such events and conditions. The NRC is not under any 

obligation to consider any events or conditions that the licensee has not used to 

justify the safety significance. The licensee is responsible for safety, identifying 

controls and justifying their applicability, availability, reliability, and pedigree. 

The burden is on the licensee and not the NRC staff to justify reducing the 

safety significance based on such events and conditions, and the staff should 

not expend undue resources in doing so. Giving consideration to after-the-fact 

events and conditions (including uncredited controls) in assessments of safety 

significance is a separate consideration from determining compliance because 

the expectation is that licensees analyze and control sequences and 

contingencies prior to operating a process. Any after-the-fact events or 

conditions put forward by the licensee or otherwise considered by the staff 

should be carefully evaluated and the justification for their applicability to the 

sequence or contingency in question documented.

Having determined that a given control or specific event and conditions are

applicable and should be considered in assessing safety significance, the staff 

should then determine how much credit is warranted. The only relevant 

consideration—as with deciding whether it should be considered as discussed in 

the previous paragraphs—is the degree of assurance the staff has that the 
Issue Date: 04/01/16 7 2606

control or event will be present when needed to perform its safety function. The 

amount of credit or risk reduction appropriate to a control or event, regardless of 

whether it was identified as an IROFS or safety control, depends primarily on 

the management measures and ISA methodology that are actually applied to it 

Controls not designated as IROFS may still be subject to relevant management 

measures in accordance with license commitments (e.g., configuration control, 

maintenance, training, procedures) according to the ISA methodology. With 

regard to assessing safety significance, any difference between IROFS and 

controls that are not IROFS lies only in the difference in management measures 

applied to these two classes of items. This is a separate question from that of 

compliance with the regulatory requirements.

In cases where the control has failed or is degraded—meaning its reliability and 

availability are reduced—because the licensee has applied improper 

management measures, the staff may find it appropriate to credit the control to a 

lesser extent than would be the case when all management measures were 

appropriately applied. To assess how much credit is warranted, the staff should 

use the licensee’s own safety analysis methods (including the licensee’s ISA 

methodology) to determine how much credit would be given based on the 

management measures that were actually applied. In so doing, the staff must

adhere to any limitations and caveats of the method to give the appropriate 

credit.

For example, assume a licensee follows the index method of NUREG-1520, 

Rev. 2. Using Table A-10, “Failure Probability Index Methods,” a passive 

engineered control may be scored as a -3 to -4 if it has high reliability. If the 

staff determines this control is applicable and the required management 

measures were in place but was not considered by the licensee, then it would 

be appropriate to assign a score commensurate with the approved ISA 

methodology. It is prudent for the staff to always err on the side of conservatism 

when assessing risk not based on the licensee’s own safety analysis, because 

the licensee is primarily responsible for safety. However, if the licensee did not 

apply management measures sufficient to ensure “high reliability” then it would 

be appropriate to reduce the score to greater than -3 (e.g. -2). In addition, Table 

A-10 has the following footnote: “Indices less than (more negative than) -1 

should not be assigned to IROFS unless the configuration management, 

auditing, and other management measures are of high quality, because without 

these measures, the IROFS may be changed or not maintained.” If the licensee 

did not recognize the control (generalizing the criteria because there is no 

essential difference between a control and an IROFS with the same 

management measures) in advance and did not apply the appropriate 

management measures as required by the ISA methodology for the more 

negative scoring, then the staff should adhere to the Table A-10 footnote such 

that a score more negative than -1 would not be appropriate.

As another example, a duration index of -1 would be appropriate based on a 

required monthly surveillance. If the licensee erroneously performed this 
Issue Date: 04/01/16 8 2606

surveillance only once a year, a duration index of 0 should be applied instead. 

As yet another example, if the number of operations performed increases 

tenfold, then the frequency at which an administrative control is presumed to fail 

(which may be expressed as the demand rate times its probability of failure on 

demand) will increase proportionately. These examples are only for illustrative 

purposes and should not be directly applied to future cases because many other 

factors may need to be considered in accordance with the licensee’s approved 

methodology.

It is expected there will be cases in which there is considerable uncertainty as to 

how much credit, particularly for uncredited controls, is warranted. The staff 

should be conservative in such cases, and is under no obligation to consider 

anything not considered in the licensee’s safety analysis.

c. Assess the Consequence

The staff will assess the consequence associated with the accident sequence 

(high, intermediate, or low) as identified in the licensee safety basis 

documentation. For criticality events, the consequence will normally be 

presumed to be high, unless it occurs in a shielded facility where the shielding is 

credited as a mitigative IROFS. For radiological, chemical, and fire events, the 

consequence will be determined in accordance with the licensee’s ISA 

methodology, with appropriate consideration given to any mitigative IROFS 

present. If the potential noncompliance involved the failure or degradation of a 

mitigative IROFS, the consequence may be increased as a result.

If more than one accident sequence or contingency is impacted, the staff must 

evaluate each of them in assessing overall safety-significance. 

If the potential noncompliance occurred at a facility with an ISA, but involved an 

accident sequence or contingency that the licensee did not analyze, the staff 

should attempt to apply the licensee’s approved ISA methodology to assess 

consequence. In so doing, the staff must adhere to any limitations and caveats 

of the methodology to give the appropriate credit. If this cannot be readily 

accomplished, or if the potential noncompliance occurred at a facility without an 

approved ISA, the following table should be used to provide a bounding 

estimate of consequence:
Issue Date: 04/01/16 9 2606

Table 1

Consequence

High Intermediate Low

Accidental criticality.

An acute radiological dose 

of 100 rem or greater, or a 

chemical exposure that 

could endanger the life of 

a worker.

An acute radiological dose 

of 25 rem or greater, or a 

chemical exposure that 

could lead to irreversible 

or other serious longlasting health effects to a 

person outside the 

controlled area (public).

An intake of 30 mg or 

greater of uranium in 

soluble form by any 

individual located outside 

the controlled area 

identified pursuant to 10 

CFR 70.61(f).

An acute chemical 

exposure to an individual 

from licensed material or 

hazardous chemicals 

produced from licensed 

material that has effects as 

outlined in 10 CFR 

70.61(b)(4).

An acute radiological dose 

of 25 rem or greater, or a 

chemical exposure that 

could lead to irreversible or 

other serious long-lasting 

health effects to a worker.

An acute radiological dose 

of 5 rem or greater, or a 

chemical exposure that 

could lead to mild or 

transient health effects to a 

member of the public. 

A 24-hour averaged 

release of radioactive 

material outside the 

restricted area in 

concentrations exceeding 

5000 times the values in 

Table 2 of Appendix B to 

Part 20.

An acute chemical 

exposure to an individual 

from licensed material or 

hazardous chemicals 

produced from licensed 

material that has effects as 

outlined in 10 CFR 

70.61(c)(4).

A chronic radiological or 

chemical exposure due to 

licensed material or an 

acute exposure less than 

intermediate.

d. Assess the Likelihood

The staff will assess the likelihood of the accident sequence or contingency

following the potential noncompliance that occurred. As explained in more detail 

below, the likelihood of interest in assessing safety significance is not the 

likelihood of a sequence from start to finish, but rather the likelihood starting 

from the condition following the occurrence of the potential noncompliance (e.g., 

the conditional likelihood of an accident assuming what actually occurred). Thus 

what is pertinent to this assessment is this conditional or residual risk following

the occurrence of the potential noncompliance, not the change in risk.
Issue Date: 04/01/16 10 2606

If more than one accident sequence or contingency is impacted, the staff must 

evaluate each of them in assessing overall safety-significance. 

If the potential noncompliance occurred at a facility with an ISA, but involved an 

accident sequence or contingency that was not analyzed, the staff should 

attempt to apply the licensee’s approved ISA methodology to assess likelihood. 

In so doing, the staff must adhere to any limitations and caveats of the 

methodology. If this cannot be readily accomplished, or if the potential 

noncompliance occurred at a facility without an approved ISA, the staff should 

use Tables 2 - 4 to provide a bounding estimate of likelihood. Tables 2 and 3

are appropriate when an accident sequence can be readily identified, such as 

an accident sequence that is included in the ISA Summary or involves

radiological, chemical, or fire hazards. Table 2 is relevant to situations in which 

the overall likelihood is assessed quantitatively (including use of a semiquantitative index method such as in Appendix 3-A of NUREG-1520.) Table 3

involves situations in which the overall likelihood is assessed qualitatively based 

on the type of control(s) remaining. Table 4 is appropriate when a contingency 

can be readily identified, as when the potential noncompliance involved a 

criticality event that was analyzed only in a criticality safety evaluation or in 

some other deterministic analysis.1

Table 2 should be used when the accident sequence likelihood, starting from the 

potential noncompliance that occurred and proceeding all the way to an 

accident, is quantitatively or semi-quantitatively (e.g., using the index method 

from NUREG-1520) assessed:

Table 2

Quantitative Likelihood Matrix for Accident Sequences

For use when risk is assessed quantitatively or semi-quantitatively (e.g., index method)

Highly Unlikely Unlikely Not Unlikely

Less than 10-5 per 

event per year

Between 10-4 and 

10-5 per event per 

year

Greater than 10-4

per event per 

year

In determining the residual accident sequence likelihood when applying Table 2, 

the staff should apply the licensee’s methods, if practicable. Otherwise, Table 3 

may be used. Typically, each event or IROFS failure is assigned a likelihood 

score, depending on the type of control, management measures applied, etc.

(using the licensee’s approved ISA methodology). If the events or failures are 

all independent, they are typically summed to arrive at an overall likelihood 

score for the accident sequence. It is important that the staff’s evaluation 

 

1

The qualifier “quantitative” is meant to describe a method of risk-assessment based on estimating likelihood using 

quantified frequency and probability values. The term “qualitative,” describes a method that estimates likelihood based on 

the logical and mathematical structure of a quantitative method, but which assigns likelihood categories based on 

qualitative criteria rather than quantified values. (The index method lies between these and is considered semiquantitative.) The term “deterministic” describes a method that does not consider likelihood, but rather conservatively 

assumes worst-case conditions and bases acceptability on non-probabilistic criteria (e.g., defense-in-depth, double 

contingency).
Issue Date: 04/01/16 11 2606

adhere to any caveats and limitations in the licensee’s approved ISA 

methodology. Guidance on consideration of factors such as failure frequency 

vs. probability, demand rate, failure duration, etc., may be found in NUREG1520, Chapter 3, Appendices A and B. For example, while a passive 

engineered IROFS may normally receive an Effectiveness of Protection Index of 

-3 to -4, this may depend on the level of management measures applied or on 

other limitations. The staff should therefore ensure that the licensee has 

rigorously followed its own methodology when the potential noncompliance 

involves an analyzed sequence. Similarly, the staff should rigorously follow the 

licensee’s methodology when assessing an unanalyzed sequence. If the staff is 

applying the licensee’s methodology to an unanalyzed sequence, any 

uncertainty in the assignment of likelihood scores should be done conservatively 

(e.g., use the more conservative value when there is a range of scores). 

In addition to ensuring that the appropriate management measures have been 

applied, the staff should verify that frequency and probability are correctly 

distinguished. A different score may be appropriate depending on whether an 

event or failure warrants a Failure Frequency Index or probability of failure, e.g. 

Effectiveness of Protection Index.

Besides applying appropriate scores to individual events or failures, the staff 

should combine the scores correctly. Failure Frequency or Effectiveness of 

Protection Indices must be combined so as to produce an overall accident 

sequence likelihood with the proper units of frequency or probability per event 

per year, to be consistent with Table 2 above. The underlying mathematical 

details are provided in FCSS-ISG-01, “Methods for Qualitative Evaluation of 

Likelihood,” which has been incorporated into NUREG-1520. The staff should 

carefully consider the following three factors, when applicable, which may 

significantly affect the overall accident sequence likelihood: failure duration, 

demand rate, and independence.

The staff should use Table 3 to qualitatively evaluate the accident sequence 

likelihood. This matrix represents the case where there are, at most, two 

controls remaining. The rows represent the condition of one control and the 

columns that of the other:

Table 3

Qualitative Likelihood Matrix for Accident Sequences

For use when risk is assessed qualitatively

No Control ADM AEC PEC

No Control NU NU NU U

ADM NU NU U HU

AEC NU U HU HU

PEC U HU HU HU

ADM = administrative control; AEC = active engineered control; PEC = passive 

engineered control; 

HU = highly unlikely; U = unlikely; NU = not unlikely
Issue Date: 04/01/16 12 2606

Because this table does not take into consideration detailed frequency and 

probability information, it is recognized to be somewhat conservative.

Table 4 should be used when a deterministic or defense-in-depth, rather than a 

probabilistic, analysis is the basis for safety, such as a double contingency 

analysis performed to demonstrate subcriticality under normal and credible 

abnormal conditions. This table assumes the basis for safety is a double 

contingency analysis. If double contingency is based on two controls and no 

information besides the number and type of controls is readily available, the staff 

may use Table 3 in lieu of Table 4. Otherwise, when additional pertinent 

information is available, the staff should use Table 4.

Table 4

Likelihood Matrix for Contingencies

For use when risk is assessed deterministically (e.g., double contingency analysis)

Description Likelihood 

Category

(A) Two independent changes in process conditions exist 

before an accident is possible, each of which is protected 

by one or more of the following:

(1) PEC with all appropriate management measures applied

(2) AEC with all appropriate management measures applied

(3) Enhanced ADM with supporting equipment under 

appropriate management measures

(4) Simple ADM with substantial safety margin (multiple 

independent failures are required to exceed subcritical 

limits)*

(5) External event with a frequency no more than 1 in 100 

years

*NOTE: Item (4) cannot be used for both changes in process 

conditions; it must be combined with (1), (2), (3), or (5).

HU

(B) Two independent changes in process conditions exist 

before an accident is possible. One meets one or more of 

the criteria under (A) above. The other is protected by one 

or more of the following:

(1) Simple ADM without substantial safety margin.*

(2) Enabling event expected during lifetime of the facility

(3) The natural and credible course of events (per 

ANSI/ANS-8.1)

(4) External event with a frequency no more than 1 in 10 years

*NOTE: Item (1) cannot be combined with item (4) from (A) 

above.

U
Issue Date: 04/01/16 13 2606

(C) A single change in process conditions exists before an 

accident is possible, or two changes in process conditions 

but whose failures are not independent. The change in 

process conditions or dependent failure is protected by the 

following:

(1) PEC with all appropriate management measures applied

U

(D) Single change in process conditions, including a 

dependent failure, as described in (C) above, and which is 

protected by at most one of the following: 

(1) AEC with all appropriate management measures applied,

(2) An enhanced or simple administrative control,

(3) The natural and credible course of events, when justified by 

experimental measurements and/or physical law, with 

substantial safety margin (multiple failures are required to 

exceed subcritical limits),

(4) External event with a frequency no more than 1 in 100 

years, or

(5) Any event or condition not meeting criteria under (A), (B), 

or (C) above.

NU

The likelihood determination is the most complex and significant part of 

determining the overall risk. Whether the staff applies Table 2, 3, or 4 depends 

mainly on the licensee’s methodology and on the type and quality of information 

available. In some cases, it may be desirable to cross-check the result using 

two or all three of these methods to determine the most reasonable estimate of 

the residual risk.

2606-07 REFERENCES

07.01 Code of Federal Regulations, Title 10, Part 40, “Domestic Licensing of Special 

Nuclear Material”

07.02 Code of Federal Regulations, Title 10, Part 70, “Domestic Licensing of Special 

Nuclear Material”

07.03 FCSS-ISG-01, “Methods for Qualitative Evaluation of Likelihood”

(ML042460008)

07.04 Nuclear Regulatory Commission Issuances, Volume 61, January – June 2005

07.05 NUREG-1520, Rev. 2, “Standard Review Plan (SRP) for Fuel Cycle Facilities 

License Applications” (ML15176A258)

END
Issue Date: 04/01/16 Att1-1 2606

Attachment 1: Safety Significance worksheet

SAFETY SIGNIFICANCE WORKSHEET

LICENSEE: _________ EVENT/NOV No: ________________ DATE: __________

Affected Accident Sequence/Contingency (attach separate worksheet for each):

Designation: _______________ Description:

 Analyzed  Unanalyzed

Purpose:  Initial Assessment* Provisional Assessment Final Assessment 

*If initial assessment, only use credited IROFS/controls from the affected sequence or 

contingency, or applicable IROFS from other sequences in consequence/likelihood assessments. 

Justification for the applicability of IROFS from other sequences must be documented.

If provisional or final assessment has reduced likelihood or consequences from the initial 

assessment, document the justification for applicability of any items not considered in the initial 

assessment and coordinate with Office of Enforcement (OE).

Consequence:

Type:  Criticality  Chemical Fire  Radiological

Magnitude:  LOW INTERMEDIATE  HIGH

 Actual  Potential

 Mitigated  Unmitigated

Basis for Unmitigated Consequence:

If mitigated, provide basis below:

**Type: ____ Credit: ______ Description: 

Basis: 

**Type: ____ Credit: ______ Description: 

Basis: 

**Type: ____ Credit: ______ Description: 

Basis: 

**Type: ____ Credit: ______ Description: 

Basis: 

**Type: ____ Credit: ______ Description: 

Basis: 

**Types: I = IROFS; C = Credited Control; U = Uncredited Control; O = Other
Issue Date: 04/01/16 Att1-2 2606

Likelihood:

 Not Credible  Highly Unlikely  Unlikely  Not Unlikely  Occurred

Likelihood Assessment Method(s):

#1: Quantitative

For Use with Table 2 of IMC 2606

Basis for Using Method #1: ___________________________________________________

Provide basis for each factor contributing to the quantitative determination:

IEF: ____________ Description:

Basis:

†Type: ____ ‡Credit: ______ 

F/P/DR/DI

Description:

Basis:

†Type: ____ Credit: ______ 

F/P/DR/DI

Description:

Basis:

†Type: ____ Credit: ______ 

F/P/DR/DI

Description:

Basis:

†Type: ____ Credit: ______ 

F/P/DR/DI

Description:

Basis:

†Type: ____ Credit: ______ 

F/P/DR/DI

Description:

Basis:

†**Types: I = IROFS; C = Credited Control; U = Uncredited Control; B = Bounding Assumption; 

E = Enabling Event; O = Other 

‡Credit: F = Frequency; P = PFOD; DR = Demand Rate; DI = Duration Index

#2: Qualitative

For Use with Table 3 of IMC 2606

Basis for Using Method #2: ___________________________________________________

First Control Type:

None/ADM/AEC/PEC

Description:

First Control Type:

None/ADM/AEC/PEC

Description:
Issue Date: 04/01/16 Att1-3 2606

#3: Deterministic

For Use with Table 4 of IMC 2606

Basis for Using Method #3: ___________________________________________________

Highly Unlikely Based On:

A1/A2/A3/A4/A5 of Table 4

Circle as appropriate

Basis:

Unlikely Based On:

B1/B2/B3/B4/C1 of Table 4

Circle as appropriate

Basis:

Not Unlikely Based On:

D1/D2/D3/D4/D5 of Table 4

Circle as appropriate

Basis:

Additional Considerations/Comments:

INSTRUCTIONS

This “Safety Significance Worksheet” provides a sample format for summarizing the 

results of an IMC 2606 safety significance determination. Instructions for completing the 

form follow.

Affected Accident Sequence/Contingency: A brief description of the accident sequence

in sufficient detail to understand the major events (not just the initiating event) should be 

provided. If the sequence was analyzed in the licensee’s ISA, its label/number should be 

provided under “designation.” The appropriate box should be checked to indicate 

whether the sequence was previously analyzed. A separate worksheet should be 

included for each affected sequence. 

The term “sequence” is used in the instructions for “accident sequence or contingency.” 

This longer term reflects that there may be an accident sequence explicitly identified in 

the licensee’s ISA, with appropriate IROFS, or there may be a scenario analyzed as part 

of a double contingency analysis in a licensee’s criticality safety evaluation, involving 

IROFS or other criticality controls. The worksheet is intended to be flexible enough to 

accommodate either approach.

Purpose: This worksheet may be used to summarize the results of an IMC 2606 

evaluation at several stages in the enforcement process. The types of assessments are 

summarized below:

Initial Assessment: An assessment performed upon initial identification of a 

potential noncompliance or screening of an event. The staff should attempt an 

initial assessment only based on the licensee’s analysis in the short time allowed 

during an inspection or during an assessment of whether there is an immediate 

safety concern. Only credited IROFS and controls, including IROFS credited for 
Issue Date: 04/01/16 Att1-4 2606

other sequences, should be considered during this initial phase because the staff 

will still be gathering information about the facility and processes, detracting from 

the feasibility of a more detailed safety significance evaluation. 

Provisional Assessment: An assessment performed by the staff subsequent to 

the initial assessment but prior to final disposition of the potential noncompliance. 

Factors other than credited IROFS and controls (e.g., uncredited controls) may 

be considered consistent with the guidance in IMC 2606 given that information 

should be available to perform a more detailed evaluation.

Final Assessment: An assessment documenting the final Agency decision on the 

safety significance of a noncompliance or event. What may be considered is 

identical to that in the provisional assessment; the purpose of having two 

separate boxes is to indicate, at a glance, whether the assessment is predecisional or final.

NOTE: If the safety significance of a provisional or final assessment of safety 

significance differs from that of the initial assessment, the staff must consult with OE due 

to the difficulty inherent in considering additional factors beyond credited IROFS and 

controls.

Consequence: This section indicates the consequence part of the risk assessment. 

Typically a fire is not directly a consequence of concern, because it is not directly 

mentioned in 10 CFR 70.61. However, if a fire can result in a chemical release, 

radiological dose, or criticality, the applicable box should be checked as well. If the 

sequence affects more than one area, check all applicable boxes.

Actual consequences are those in which the sequence progressed to completion, such 

that there was an actual chemical or radiological dose or criticality accident.

Potential consequences are those in which the sequence did not progress to completion 

and there was no chemical or radiological dose. For criticality, the potential 

consequence is almost always considered high.

At the time of the revision of this IMC, all fuel facility licensees committed to considering

criticality as a high-consequence event. Future facilities that rely on mitigation to reduce 

the consequence of criticality to less than high still must ensure that nuclear processes 

will be subcritical under normal and credible abnormal conditions, in accordance with 10 

CFR 70.61(d).

For other consequence types, normally the unmitigated consequence should be used 

since the potential consequence is evaluated assuming all IROFS have failed.

If it is deemed desirable to perform the IMC 2606 evaluation using mitigated 

consequences (e.g., when there is unusually high assurance that mitigative barriers will 

remain in place), this should be indicated by checking the appropriate box. The basis for 

the mitigated or unmitigated consequence should be provided.
Issue Date: 04/01/16 Att1-5 2606

Type: Indicates whether the mitigative feature is an IROFS, credited control (including 

IROFS on other sequences), uncredited control, or some other feature, such as physical 

considerations that inherently limit the consequence.

Magnitude: Indicates the mitigated or unmitigated consequence (typically unmitigated), 

depending on which box is checked below. This should be based on the licensee’s 

approved ISA methodology or the consequence categories in Table 1 of this IMC.

Credit: Typically indicates the risk-reduction factor, or factor by which the mitigative 

feature has reduced the unmitigated consequence. However, the means of conferring 

credit will be done in accordance with the licensee’s approved ISA methodology.

For each such mitigative feature, the staff should include a brief description, including an 

IROFS designation if applicable, and the basis for any credit taken. If no factors apply, 

leave it blank.

Likelihood: Indicates the likelihood of the sequence at the time of the potential 

noncompliance or event (conditional likelihood of an accident following the potential 

noncompliance of event). Thus if a licensee has a potential noncompliance that results 

in loss of a control that changes the likelihood from “highly unlikely” to “unlikely,” the 

“unlikely” box should be checked.

IMC 2606 describes three distinct likelihood assessment methods—quantitative, 

qualitative, and deterministic, for use in accordance with Tables 2, 3, and 4 of the text. 

The staff should use the appropriate method(s) in accordance with the guidance 

provided in the body of IMC 2606. The choice depends on the method of analysis used 

by the licensee and information available. The staff should briefly justify the choice of 

method under “basis” on the worksheet. Note that it may be advisable to employ more 

than one of the three methods as an independent check on the results of the safety 

significance determination. In such cases, the staff should indicate which method was 

the main one used for the ultimate determination of likelihood.

Method #1: The worksheet is designed to follow the information in Table 2 of IMC 2606. 

This method is intended to be used when likelihood is assessed quantitatively (including 

the semi-quantitative index method from NUREG-1520). In applying Method 1, it is 

important that the likelihood be assessed rigorously in accordance with the licensee’s 

approved methodology, including, as appropriate, failure frequency, probability of failure 

on demand (PFOD), failure duration, and demand rate. Guidance for doing so is 

provided in Appendix 3-B of NUREG-1520, “Qualitative Criteria for Evaluation of 

Likelihood” (formerly FCSS-ISG-01).

IEF: The Initiating Event Frequency (IEF) is used whenever the initiating event in 

the sequence did not occur, since this block is intended to indicate the likelihood 

following the potential noncompliance or event. If the initiating event occurred, its 

likelihood can no longer be considered in the conditional likelihood of the accident 

and this line should be left blank. Note that if an IROFS or control failure was 

associated with the potential noncompliance or event, it may not be the initiating 

event as identified in the licensee’s evaluation of the sequence, because in many 
Issue Date: 04/01/16 Att1-6 2606

cases the events do not have to occur in the precise order indicated in the 

sequence.

Preventive Features: The type and credit (typically risk reduction factor, or factor 

by which the event likelihood is reduced) should be specified, including a 

description that includes the IROFS designation if applicable, as indicated under 

“Consequence” above. The risk-reduction provided by the preventive feature may 

be expressed in terms of a failure frequency, a probability of failure on demand 

(PFOD), a demand rate, or a failure duration. If the licensee used an index 

method (such as that in NUREG-1520), typically each of these are assigned an 

index, and all such indices are added up to arrive at the overall likelihood. If no

factors apply, leave it blank.

Method #2: This is typically applied when there is insufficient information to assess the 

risk reduction provided by preventive features (e.g., when the sequence was 

unanalyzed). Method #2 is intended to be a conservative estimation of likelihood based 

solely on the type of control. It may also be used as check on Method #1. While Table 3 

of IMC 2606 only considers those situations where there are two control barriers (which 

is often the case for criticality sequences), it may be adapted as follows;

If the entire sequence includes two controls, the state of one is indicated in the rows and 

other in the columns. If one of the two controls has failed, the row or column entitled “no 

control” should be used. If the sequence contains three controls and one has failed, 

then use the table for the remaining controls. If two of the three controls have failed, use 

the table with “no control.” For more controls, if two or more of them can be aggregated 

as a “control system,” the system may be treated as a single control for the purpose of 

applying the table. In such cases, consider two administrative controls as an active 

engineered control, and any other combination (e.g., an administrative and an active 

engineered control) as a passive engineered control.

Method #3: This is typically applied when the potential noncompliance or violation 

involves a double contingency analysis in a criticality safety evaluation rather than one 

analyzed in the ISA Summary. Such a case may occur when the sequence is 

inadvertently omitted from the ISA Summary, or when it screened from further consider 

by being considered “not credible.” Here the likelihood is determined based on meeting 

certain deterministic criteria, when there is no information available to estimate the 

likelihood of the individual contingencies. Staff should indicate the overall likelihood 

category and the basis, including which paragraph of Table 4 of IMC 2606 applies.

Additional Considerations/Comments: This block is to capture any unique aspect of the 

potential noncompliance or event that may impact the safety basis. Any additional notes 

such as whether the potential noncompliance is considered programmatic may also be 

included.
Issue Date: 04/01/16 Att2-1 2606

Attachment 2: Sample Safety Significance Worksheet

The sample below shows the risk assessment of an IROFS failure. The IROFS and the 

associated accident sequence are included in the licensee’s ISA. In this example, the 

staff performed the assessment to determine the change in likelihood upon the failure of 

one of two credited IROFS.

SAFETY SIGNIFICANCE WORKSHEET

LICENSEE: SNM-XX EVENT/NOV No: 16-001 DATE: 01/26/2016

Affected Accident Sequence/Contingency (attach separate worksheet for each):

Designation: SF-105: Operator places more than a double-batch of moderator into glovebox 

Description:

Initiating Event Control Initiating Event 

Frequency

Effectiveness of 

Protection

Overall Risk 

Index

Operator 

places more 

than a doublebatch of 

moderator into 

glovebox

IROFS 1 –

Operator 

controls the 

amount of 

moderating 

material

[-2]

IROFS 2 –

Operator 

controls the 

amount of 

fissile mass

[-2]

[-4]

.

 Analyzed  Unanalyzed

Purpose:  Initial Assessment* Provisional Assessment Final Assessment 

*If initial assessment, only use credited IROFS/controls from the affected sequence or 

contingency, or applicable IROFS from other sequences in consequence/likelihood assessments. 

Justification for the applicability of IROFS from other sequences must be documented.

If provisional or final assessment has reduced likelihood or consequences from the initial 

assessment, document the justification for applicability of any items not considered in the initial 

assessment and coordinate with Office of Enforcement (OE).

Consequence:

Type:  Criticality  Chemical/Fire  Radiological

Magnitude:  LOW INTERMEDIATE  HIGH

 Actual  Potential
Issue Date: 04/01/16 Att2-2 2606

 Mitigated  Unmitigated

Basis for Unmitigated Consequence:

The licensee’s ISA did not include IROFS or other safety controls to mitigate the 

consequences.

If mitigated, provide basis below:

**Type: ____ Credit: ______ Description: 

Basis: 

**Type: ____ Credit: ______ Description: 

Basis: 

**Type: ____ Credit: ______ Description: 

Basis: 

**Type: ____ Credit: ______ Description: 

Basis: 

**Type: ____ Credit: ______ Description: 

Basis: 

**Types: I = IROFS; C = Credited Control; U = Uncredited Control; O = Other

Likelihood:

 Not Credible  Highly Unlikely  Unlikely  Not Unlikely  Occurred

Likelihood Assessment Method(s):

#1: Quantitative

For Use with Table 2 of IMC 2606

Basis for Using Method #1: The licensee’s ISA includes the accident sequence in question 

and provides information on the IROFS and their quantitative contributions to the accident 

sequence. This assessment will evaluate the risk after IROFS1 failed.

Provide basis for each factor contributing to the quantitative determination:

IEF: ____________ Description:

Basis:

†Type: I ‡Credit: -2 F 

F/P/DR/DI

Description: IROFS 2: Operator controls the amount of 

fissile mass

Basis: The licensee’s ISA states that the probability of failure 

for this IROFS is 10-2; therefore, it would receive -2 as an 

IROFS.

†Type: ____ Credit: ______ 

F/P/DR/DI

Description:

Basis:

†Type: ____ Credit: ______ Description:
Issue Date: 04/01/16 Att2-3 2606

F/P/DR/DI Basis:

†Type: ____ Credit: ______ 

F/P/DR/DI

Description:

Basis:

†Type: ____ Credit: ______ 

F/P/DR/DI

Description:

Basis:

†**Types: I = IROFS; C = Credited Control; U = Uncredited Control; B = Bounding Assumption; 

E = Enabling Event; O = Other 

‡Credit: F = Frequency; P = PFOD; DR = Demand Rate; DI = Duration Index

Additional Considerations/Comments:
Issue Date: 04/01/16 Att3-1 2606

Attachment 3: Sample Safety Significance Worksheet

The sample below shows the risk assessment of an IROFS failure while crediting other 

safety controls. The IROFS and the associated accident sequence are included in the 

licensee’s ISA. In this example, the staff performed the assessment to determine the 

change in likelihood upon the failure of one of two credited IROFS while crediting 

another safety control.

SAFETY SIGNIFICANCE WORKSHEET

Affected Accident Sequence/Contingency (attach separate worksheet for each):

Designation: SF-105: Operator places more than a double-batch of moderator into glovebox 

Description: 

Initiating Event Control Initiating Event 

Frequency

Effectiveness of 

Protection

Overall Risk 

Index

Operator 

places more 

than a doublebatch of 

moderator into 

glovebox

IROFS 1 –

Operator 

controls the 

amount of 

moderating 

material

[-2]

IROFS 2 –

Operator 

controls the 

amount of 

fissile mass

[-2]

[-4]

The licensee provided additional information. Specifically, the licensee’s analysis of the 

glovebox showed the worse-case credible limits of mass and moderator to be 10 kg U-235 

and 5 kg H2O (H/U ≈ 13). The licensee demonstrated these combined amounts to be 

subcritical with an approved margin of subcriticality. Furthermore, the glovebox is 

documented in the ISA as a safety control and is credited as an NCS control in that it is 

designed and maintained to limit reflection, and therefore, prevent criticality.

 Analyzed  Unanalyzed

Purpose:  Initial Assessment* Provisional Assessment Final Assessment 

*If initial assessment, only use credited IROFS/controls from the affected sequence or 

contingency, or applicable IROFS from other sequences in consequence/likelihood assessments. 

Justification for the applicability of IROFS from other sequences must be documented.

If provisional or final assessment has reduced likelihood or consequences from the initial 

assessment, document the justification for applicability of any items not considered in the initial 

assessment and coordinate with Office of Enforcement (OE).
Issue Date: 04/01/16 Att3-2 2606

Consequence:

Type:  Criticality  Chemical/Fire  Radiological

Magnitude:  LOW INTERMEDIATE  HIGH

 Actual  Potential

 Mitigated  Unmitigated

Basis for Unmitigated Consequence:

The licensee’s ISA did not include IROFS or other safety controls to mitigate the 

consequences.

If mitigated, provide basis below:

**Type: ____ Credit: ______ Description: 

Basis

**Type: ____ Credit: ______ Description: 

Basis

**Type: ____ Credit: ______ Description: 

Basis

**Type: ____ Credit: ______ Description: 

Basis: 

**Type: ____ Credit: ______ Description: 

Basis: 

**Types: I = IROFS; C = Credited Control; U = Uncredited Control; O = Other

Likelihood:

 Not Credible  Highly Unlikely  Unlikely  Not Unlikely  Occurred

Likelihood Assessment Method(s):

#1: Quantitative

For Use with Table 2 of IMC 2606

Basis for Using Method #1: The licensee’s ISA includes the accident sequence in question 

and provides information on the IROFS and their quantitative contributions to the accident 

sequence. This assessment will evaluate the risk after IROFS 1 failed and the glovebox size 

limitation is credited. According to the licensee’s ISA Summary, both IROFS must fail for the 

accident sequence to occur. However, the full ISA indicates that the glovebox size must also 

be exceeded.

Provide basis for each factor contributing to the quantitative determination:

IEF: ____________ Description:

Basis:

†Type: I ‡Credit: -2 F 

F/P/DR/DI

Description: IROFS 2: Operator controls the amount of 

fissile mass
Issue Date: 04/01/16 Att3-3 2606

Basis: The licensee’s ISA states that the probability of failure 

for this IROFS is 10-2; therefore, it would receive -2 as an 

IROFS.

†Type: C Credit:-2 F 

F/P/DR/DI

Description: The size and configuration of the glovebox 

limits the amount of credible reflection.

Basis: The licensee’s full ISA cites the criticality analysis 

and credits the glovebox with limiting reflection, as mass 

and moderator limits were derived using full water reflection. 

The glovebox is a passive engineered control on which 

appropriate management measures have been applied. 

Therefore, it would receive -2 as a credited control. 

†Type: ____ Credit: ______ 

F/P/DR/DI

Description:

Basis:

†Type: ____ Credit: ______ 

F/P/DR/DI

Description:

Basis:

†Type: ____ Credit: ______ 

F/P/DR/DI

Description:

Basis:

†**Types: I = IROFS; C = Credited Control; U = Uncredited Control; B = Bounding Assumption; 

E = Enabling Event; O = Other 

‡Credit: F = Frequency; P = PFOD; DR = Demand Rate; DI = Duration Index

Additional Considerations/Comments:
Issue Date: 04/01/16 Att4-1 2606

Attachment 4: Revision History for IMC 2606

Commitment 

Tracking 

Number

Accession 

Number

Issue Date

Change Notice

Description of Change Description of 

Training Required 

and Completion 

Date

Comment and 

Feedback Resolution 

Accession Number

(Pre-Decisional, NonPublic)

N/A ML12254A075

09/26/12

CN 12-022

Initial issuance to provide direction 

assessing change in risk due to a violation

at a fuel cycle facility.

N/A ML12254A078

N/A ML16039A302

04/01/16

CN 16-010

Major revision to provide further guidance 

on accessing significance and add an 

assessment form.

Revised to clarify the approach to crediting 

controls. Specifically, rather than 

attempting to give partial credit when there 

are reduced management measures, credit 

will be given appropriate to the type of

control (whether an IROFS or other formally 

established and documented safety 

control), taking into account the 

management measures that were actually 

applied to it (as opposed to what were 

required to be applied).

N/A Comments vetted 

through regional 

meetings.