Reading this in the HSE COMAH website:
"Has the Operator a policy on risk assessment?

This is an important point because the Operator must demonstrate a risk-based approach to his activities and to the production of the safety report."

Made me think, what is a non risk based approach?

Perhaps more accurate to describe these as "arrangements" for managing risk assessment though?

I think the text you quote reflects problems from the early days of COMAH. What companies tended to do was write everything they knew about their hazards, operations, controls etc. Then try to claim they were doing everything possible to manage their risks.

What HSE actually want is reassurance that you understand your risks and actually implement controls that are proportionate. The difficulty is that when talking about major accidents we need to consider high consequence low frequency events. Most companies have very little experience of these and so find it difficult to understand the risk.

Your example of PAT testing is not relevant to COMAH but can still act as a useful illustration. If you look at the guidance you will see that a risk based approach is proposed (http://www.hse.gov.uk/PUBNS/indg236.pdf). However, many companies tend to think blanket rules to test everything on a fixed frequency must be better. If that proves to be practical I guess it is acceptable, but it may mean that no one is actually thinking about risks for specific items of equipment.