While competent people are required at all levels, overall accountability and responsibility usually resides with the business owner, managing director or manager.
It's important your organisation ensure decision makers and key personnel are made aware of data protection, information security, environmental and social responsibility. They will need to fully understand the scale and impact this has, and work on areas that could cause increased risk, compliance issues, as well as creating opportunities.
Members of staff undoubtedly receive regular training so they are aware of key issues and potential risks. Having regular management review meetings is good practice and a necessity when managing constant change, diverse skill requirements and dealing with any sensitive information. Any management review should deal with internal and external factors facing the business, as well as mitigating the root causes of damaging incidents.
Clients require that incidents are reported and managed quickly, including a procedure for notifying external parties in the event of a data breach. Information and non-informational incidents, such as major parts delays, should be communicated quickly and effectively.