ABC Company carried out a similar project two years ago, in response to changes in health and safety legislation for the health service. The experiences from that project were used to refine the corporate risk management policy. For that reason, the project board decided to use the corporate risk management policy in the risk management approach for this project.
Is this appropriate, and why?