The company's management body or an authorized person is responsible for establishing and overseeing the organization's approach to risk and preparedness. This involves the formal review and approval of all essential documentation, including examples such as risk and vulnerability assessments and contingency and business continuity plans, that guide the organization’s strategic direction and operational resilience. These approvals must be formally recorded to ensure clear accountability.

Once approved, the management body is responsible for ensuring the documented procedures are effectively implemented and maintained.