Please note the following changes:

  • Duplication to be removed (where possible)
  • Requirements will be clearly defined (i.e., process requirement and evidence requirement).
  • Criteria has been streamlined through re-wording and greater clarity.
  • Additional requirements have been assigned to ensure a greater level of assurance in areas of high-risk (see attached change matrix)
  • New Protocol ‘Non-Operational Railway Services CORE to be introduced to suit suppliers that operate outside the operational railway
  • The separation and clarification changes are designed to help suppliers be assured for those areas where the buyer requires greater clarity for the supply of products and services. For example, this maybe where a supplier might be working on a ‘’transport undertaking’, or the ‘infrastructure’ is Operational, with a separate protocol for those that may be in an ‘engineering possessions’ but are still delivering Safety Critical, High Risk Activity or where their sponsoring Buyer has required. This is further explained in the Guide to ROGS - December 2022 (
  • Please note the RSSB, RISQS, and RISAS, are also making recommendation to the RSSB on amendments to the Railway Industry Commodities Classification List (RICCL) to cover products and services that are recommended by Cullen’s report (Recommendation 24) to be subject to a third-party assessment of the process that supports the product or service – these if accepted will be published by the RSSB later in the year.

Change 1A : CORE Module

The main change that will impact the supply chain is the introduction of two separate CORE modules. The two modules are titled as follows:

  1. Operational Railway Services - CORE (ORS)
  2. Non-Operational Railway Services – CORE (NORS)

What do you need to do?

As a supplier you will need to review your answer to question 127 within the ‘Infrastructure Access’ section of the RISQS questionnaire. It will now ask:

'Does your organisation work within the boundaries of the Operational Railway, or could your services impact on the operational running of the Railway?'

  • A ‘Yes’ answer will generate Operational Railway Services CORE.
  • A ‘No’ Answer will generate Non-Operational Railway Services CORE.


  • Suppliers undertaking the Operational Railway Services CORE will also be assured for non-Operational railway services.
  • Suppliers that have undertaken the non-operational railway services CORE and intending on working within the operational boundaries will need to undertake the Operational Railway Services CORE as an out of turn audit. If they are looking to work trackside, then this will be generated alongside the Sentinel protocol.

Change 1B: Non-Operational Railway Services - CORE

This protocol has been designed for suppliers who offer safety critical products and services or high-risk activities outside the ‘Operational Railway’ parameters so as not to impact on the operational running of the railway.

The questions will explore a supplier’s management system and evidence of implementation against standard requirements linked to an environment outside the boundaries of the operational railway (i.e., areas with high street environment status, segregated worksites, and general civil construction sites that are part of a railway development project).

  • The benefit is that a supplier who does not work within the parameters of the Operational Railway will not need to prepare an audit around a rail specific Core which has trackside requirements at its foundation. Additionally, the protocol will provide the buying community with the same level of supplier assurance from high-risk unassured (non-rail, but still supplying to rail and still within UCR. Part 1, Chapter 2, Regulation 12; Transport services 12.— (1) These Regulations apply to activities relating to the provision or operation of networks providing a service to the public, or where a Buyer requires that you demonstrate competence without UCR.) suppliers that they currently get for suppliers working ‘trackside’ in the rail industry.


Change 1C: Operational Railway Services - CORE

The Operational Railway Services - CORE will continue to provide assurances on suppliers delivering high risk services within the operational railway parameters.

The Operational Railway Services for this are defined as follows:

  • Trackside/ On or near the line (within 3 metres (10 feet) of a line or 1.25 metres (4 feet) of a station platform edge if doing engineering or technical work)
  • Lineside (if between trackside and the boundary fence)
  • A position where safety critical work being performed may impact on the Operational Railway (i.e., within Turn-back, reversing, loop, lay-by, lay-over sidings, and depots).

The questions within this protocol will have operational railway standards at the foundation of all the requirements.


Change 2: Refresh of the existing protocols

Following feedback from the supply chain, we have re-written all the protocols to remove duplication and make requirement expectations clearer to avoid audit failure from any supplier misunderstanding.

From the example below, you will see that the protocol is now confirming which requirement is a process and which is evidence of implementation.

NOTE: a statement of intent is not a process. A process is a series of actions or steps that an organisation intends to take in order of achieving a particular end. Any statement of intent presented at audit that is not an adequate process will lead to a non-conformance being raised.


Where a requirement is listed that is not applicable to the organisation, the supplier shall provide adequate justification as to why a requirement doesn’t apply, and this will be recorded in the audit report.

A failure to provide adequate justification will lead to a non-conformance being raised.

Compliance date:

Suppliers will have 3 months from the release date of the protocols to comply with the new protocol requirements. The compliance date is from 3rd April 2023.

Change 3: Question Changes (Change Matrix)

NOTE: Suppliers are to review every question in the protocol as the requirements have been re-worded and some of the question got additional requirements. This change matrix details changes to a whole module question. 

Protocol CORE – Operational Railway Services
Change Additional Information
4.2 Communication and Coordination Removed and included as 6.4 Communication and Coordination of Risk Controls. CDM elements stripped from the requirement and the focus is on communicating the risk controls from service delivery with affected parties.
Section 6.4 Management of a Close Call, Near Miss, Accident, and an Incident

This has been moved to Section 4.4 Management of a Close Call, Near Miss, Accident, and an Incident.

7.3.2. Alcohol and Drug Arrangements (Safety Critical Only) Dedicated question to ensure arrangements in place for safety critical employees that are not sponsored but could have an impact on the operational running of the railway.


Protocol Sentinel
Change Additional Information
1.2 Contract of Sponsorship Management

This has been reworded as it was a copy from the Sentinel Rules. To make it simpler to read all areas from the old version “a” through to “m” is now covered in section “aii”

2.3 Policy The question has been removed as it is currently covered within the relevant CORE module (i.e., Operational Railway Services CORE Module).
3.1 Management of Sub Sponsors

Simplification of sub sponsoring contracting staff either “in” or “out”.

4.1 Employment medicals

Significant change in the wording to target the changed in NR 0124 standard but also focus the company on the areas that the auditor is targeting for compliance in particular the focus should be in:

  • The standard NR/L2/OHS/00124 having been reviewed and communicated to the relevant responsible persons .
  • An assured provider for medical assessments has been selected and holding the qualified RICCL H.H.4 Medical Screening & Surveillance (Sentinel).
  • Individuals are performing duties in-line with the medical levels assigned.
  • Determined whether it is reasonably practical to implement a safe system of work to allow the individual to hold the competency, having made reasonable adjustment in accordance with the Equality Act 2010.
4.2 Fatigue Management

Stripped out wording that is covered in Core 7.2 and now focuses on fatigue arrangements of all Sentinel Sponsored Individuals under their control.

4.3 Alcohol and Drugs Management
  • Carrying out a risk-based programme of random testing on all Sentinel Sponsored employees over a rolling 12-month period (percentage in-line with the infrastructure managers requirement).
  • Carrying out ‘for-cause’ testing – i.e. through an assured drug and alcohol testing provider holding the RICCL H.H.5.1Alcohol & Drugs Testing (Sentinel) (ensuing a request is made at the earliest opportunity following accidents, serious incidents or suspected of being unfit through drugs or alcohol).
  • Carrying out annual Alcohol & Drugs establishing a For-Cause contract with an organisation who can ensure a test can be conducted by a qualified collection supplier within 2-hours of a request being made (4-hour within designated remote areas).


Protocol CDM
Change Additional Information
2.1 Safe movements within a construction site Requirement to evidence management control of site movements (where applicable). This question is designed to look at areas within a construction site that remain under the contractor’s control and not focus solely on a Principal Contractor’s responsibility (unless it is a PC who is being audited).

2.2 Working Environment

The question is designed to provide assurances that suppliers are ensuring the provision of a safe working environment on a construction site.

2.3 Specialist Activity Controls

The requirement is designed to ensure adequate control measures are being implemented, managed, and controlled where specialist activities are provided (i.e., temporary works, excavations, demolition).

2.4 Emergency Arrangements

The question is designed to ensure project emergency arrangements are suitable and sufficient for high-risk issues such as flood, asphyxiation, and fire.

The requirement is a detailed look at project arrangements and is above and beyond the emergency arrangements in the CORE module

(NOTE: if evidence demonstrates general service arrangements and project specific then the auditor will cross reference and not ask the question twice).


If you have any questions regarding scheme updates please contact