content_image/502638.jpg
<img src='content_image/502638.jpg'>

Preventive and risk-based approach to management 

Document code: Security level: Effective date: 

PRO-0079.05 Internal 30/05/2016 

The Process Owner monitors the implementation of the action and depending on its nature, scope and impact, reports to the Senior Management, DCM, the applicable Programme Board, Quality Steering Commit tee or relevant bodies of the Agency’s Security Organisation. 

## 3.2.4. Evaluation of the effectiveness of the action and conclusion 

The effectiveness of the preventive action is reviewed within a suitable timeframe and in an appropriate manner. 

The action is closed after the effectiveness has been confirmed. If an action proves not to be effective, changes or further actions are defined and implemented as described above. 

The responsible Process Owner ensures that the relevant IQMS documentation is updated according to PRO-0001 to reflect the changed practice, if needed, and ensures that records are kept as described in PRO-0010. 

The Quality Manager reports to the Senior Management on preventive actions as part of the Management Review according to PRO-0016. 

## 3.3. Risk management 

Preventive and mitigation measures in place are mostly derived in a systematic way from the risk assessment of processes, projects and the overall functioning of the Agency. 

Senior Management and Process Owners: 

• carry out a risk assessment in the frame of the planning of the Agency’s work programmes according to PRO-0013 and in line with ED/65/2015; 

• whenever necessary, analyse the risks and plan actions at process level in connection with the preparation of the Unit Level Plans in order to complement the corporate level risk assessment; 

• consider the risks when changes are made to processes for enhancing process performance (effectiveness, efficiency), environmental performance, setting or removing controls, adapting to external or internal requirements (PRO-0080); 

• determine the environmental risks and opportunities related to the Agency’s environmental aspects and compliance obligations, as well as the potential for external environmental conditions to affect the Agency; 

• analyse the risks on IT systems (for projects and services) and plan the actions following a systematic approach to manage security risks as established in PRO-0065; 

• analyse the associated risks in the planning of projects or services and decide on the appropriate actions to be implemented, in order to mitigate the identified issues or risks that can hinder the execution of the project following the provisions set in PRO-0026 and PRO-0027 and PRO-0031; 

• analyse issues and propose preventive measures following the Business Continuity Management Policy (POL-0004). 

## 3.4. Application of general preventive measures 

Several procedures and provisions of preventive nature are in place to support the fulfilment of the Agency’s  mandate, and to ensure that legal obligations are met and the Agency’s principles and values are respected. 

