DPO.AR.B.001 Management system

(a)       The Agency shall establish and maintain a management system, including, as a minimum, the following elements:

(1)       documented policies and procedures to describe its organisation, means and methods to establish compliance with Regulation (EU) 2018/1139 and the delegated and implementing acts adopted on their bases, as necessary, for the exercise of its certification, oversight and enforcement tasks; the procedures shall be kept up to date and serve as the basic working documents within the Agency for all related tasks;

(2)       a sufficient number of personnel to perform its tasks and discharge its responsibilities under this Regulation; a system shall be in place to plan the availability of personnel in order to ensure the proper completion of all related tasks;

(3)       personnel that are qualified to perform their allocated tasks and have the necessary knowledge and experience, and have received initial and recurrent training to ensure their continuing competence;

(4)       adequate facilities and offices to perform the allocated tasks;

(5)       a function to monitor the compliance of the management system with the relevant requirements and the adequacy of the procedures, including the establishment of an internal audit process and a safety risk management process; the compliance-monitoring function shall include a system to provide feedback about audit findings to the senior management of the Agency to ensure the implementation of corrective actions as necessary;

(6)       a person or group of persons ultimately responsible to the senior management of the Agency for the compliance- monitoring function.

(b)       The Agency shall, for each field of activity included in the management system, appoint one or more persons with the overall responsibility for the management of the relevant task(s).

(c)       The Agency shall establish procedures for its participation in a mutual exchange of all the necessary information with any other competent authority(ies) referred to in Article 4 of Commission Implementing Regulation (EU) 2017/373 ([11]) and provide them with assistance or request assistance from them, including any information that stems from mandatory and voluntary occurrence reporting as required by point DPO.OR.A.045.

(d)       The management system established and maintained by the Agency shall comply with Annex I (Part-IS.AR) of Implementing Regulation (EU) 2023/203 in order to ensure the proper management of information security risks which may have an impact on aviation safety.