Have local operating procedures been developed and implemented to be consistent with the location's security manual? Are local operating procedures reviewed annually following changes in the local operating environment and after conducting risk assessments?