External control versus internalised responsibility in the design of hazardous installations