The Ticketing Settlement Agreement is a 400-page document to which all TOCs are party to, and must comply with.
TSA p259 said:
10-6 CHANGING THE PERMITTED ROUTES
(1) Agreement to make a change
The Routeing Guide may, with the consent of the Authority [Strategic Rail Authority], be altered from time to time by a resolution of the Ticketing and Settlement Scheme Council, passed by a 75 per cent. majority. Before giving his consent, the Authority will consult with any relevant RPCs [Rail Passenger Councils].
(2) Requirement to notify the RSP [Rail Settlement Plan]
(a) If such a resolution is passed the Operators must ensure that its terms are notified to the RSP as soon as reasonably practicable after the consent of the Authority has been obtained, in the format and in accordance with the procedure specified by the RSP from time to time.
(b) The alteration will take effect immediately after the first Fares Setting Round to start after the RSP receives this notification has been completed.
In addition to this, under the TSA, ATOC must consult with, and gain permission of, the Secretary of State before making changes to permitted routes.
Changing permitted routes without following the procedure detailed within the TSA is a breach thereof.
Page 358 onwards of the TSA (Chapter 14) describes the procedures when a breach of the TSA has occurred (or is suspected).
Disputes can be handed to the Ticketing Settlement Scheme Council which can in turn, result in the operator in breach of the TSA having financial penalties imposed upon it; the power is also there to terminate an Operator's rights under the TSA (effectively ending its operation of the franchise). The provision is also there for court action in the event of serious or repeated breaches of the TSA.
Unfortunately, whenever a change to the NRG is made illegally, it is often put down to "maintenance" or a "mistake". Neither of which remove the liability for the correct procedure to be followed.
Theoretically, a FOI request could be made for each change we have observed to the NRG, to request confirmation the correct paperwork has been submitted every time. I highly doubt anyone would come out smelling like roses.