A service provider wants to deploy a change that will affect the end-to-end service. Who is responsible for confirming that the change has been evaluated for risk?