When should a full risk assessment and authorization be carried out for a standard change?