1. The operator shall identify sources of risks of errors in the data flow from primary data to final data in the baseline data report and shall establish, document, implement and maintain an effective control system to ensure that the reports resulting from data flow activities do not contain misstatements and are in conformity with the monitoring methodology plan and in compliance with this Regulation.

The operator shall make the risk assessment pursuant to the first subparagraph available to the regulator upon request. The operator shall also make it available for the purposes of verification.

2. For the purpose of the first subparagraph of paragraph 1, the operator shall establish, document, implement and maintain written procedures for data flow activities as well as for control activities, and include references to those procedures in the monitoring methodology plan in accordance with Article 8(3).

3. Control activities referred to in paragraph 2 shall include, where applicable:

a) quality assurance of the relevant measurement equipment;

(b) quality assurance of information technology systems ensuring that the relevant systems are designed, documented, tested, implemented, controlled and maintained in a way that ensures processing reliable, accurate and timely data in accordance with the risks identified in accordance with paragraph 1;

(c) segregation of duties in the data flow activities and control activities, as well as management of necessary competencies;