The Senior Investigator varied the CSSO's decision. While he found that it was justified in refusing access, under section 42(f), to the information relating to risks 4 and 6 to 10 contained in the Risk Register, he found that it was not justified in refusing access to the remainder of the record under the other exemptions cited and directed its release, subject to the redaction of the names of any specific software/systems used by the CSSO.