Document code:  Security level:  Effective date:  PRO-0079.05  Internal  30/05/2016  Preventive and risk-based approach to management  The Process Owner monitors the implementation of the action and depending on its nature,  scope and impact, reports to the Senior Management, DCM, the applicable Programme  Board, Quality Steering Commit tee or relevant bodies of the Agency’s Security Organisation. The effectiveness of the preventive action is reviewed within a suitable timeframe and in an  appropriate manner. The action is closed after the effectiveness has been confirmed. If an action proves not to  be effective, changes or further actions are defined and implemented as described above.  The responsible Process Owner ensures that the relevant IQMS documentation is updated  according to PRO-0001 to reflect the changed practice, if needed, and ensures that records  are kept as described in PRO-0010.  The Quality Manager reports to the Senior Management on preventive actions as part of the  Management Review according to PRO-0016. Preventive and mitigation measures in place are mostly derived in a systematic way from  the risk assessment of processes, projects and the overall functioning of the Agency.  Senior Management and Process Owners:  3.3. Risk management  Several procedures and provisions of preventive nature are in place to support the fulfilment  of the  Agency’s  mandate, and to ensure that legal obligations are met  and the Agency’s  principles and values are respected.  3.4. Application of general preventive measures  TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  Page  4  of  6 • analyse issues and propose preventive measures following the Business Continuity  Management Policy (POL-0004).  • analyse the associated risks in the planning of projects or services and decide on the  appropriate actions to be implemented, in order to mitigate the identified issues or risks  that can hinder the execution of the project following the provisions set in PRO-0026 and  PRO-0027 and PRO-0031; • analyse the risks on IT systems (for projects and services) and plan the actions following  a systematic approach to manage security risks as established in PRO-0065;  • determine the environmental risks and opportunities related to the Agency’s  environmental aspects and compliance obligations, as well as the potential for external  environmental conditions to affect the Agency;  • consider the risks when changes are made to processes for enhancing process  performance (effectiveness, efficiency), environmental performance, setting or removing  controls, adapting to external or internal requirements (PRO-0080);  • whenever necessary, analyse the risks and plan actions at process level in connection  with the preparation of the Unit Level Plans in order to complement the corporate level  risk assessment;  • carry out a risk assessment in the  frame of the planning of the Agency’s work  programmes according to PRO-0013 and in line with ED/65/2015;  3.2.4. Evaluation of the effectiveness of the action and conclusion 