Management review
A management review is a planned meeting in which top management looks at the management system as a whole, decides whether it is still suitable, adequate and effective, and agrees what has to change. Every ISO management system standard requires one, and its minutes are among the first records an auditor asks to see.
- Clauses
- ISO 27001:2022 9.3 · ISO 9001:2015 9.3 · ISO 13485:2016 5.6 · ISO 42001:2023 9.3
Where the term appears
ISO 27001:2022 9.3, ISO 9001:2015 9.3 and ISO 42001:2023 9.3 share one shape: reviews at planned intervals, a set list of inputs, and recorded decisions on improvement and change. ISO 13485:2016 5.6 goes further: you document the procedure and the interval, and the inputs include complaints, reports to regulators and new regulatory requirements. None of them sets a frequency; once a year is common for a small organisation. The ISO 27001 management review page explains each input.
Not a status meeting
It is not an internal audit either. An internal audit has an impartial auditor test the system against requirements; a management review has top management judge whether the system still fits the business and decide what changes. An auditor checks that top management actually attended rather than receiving a summary from the security or quality lead, that every required input was considered, and that the outputs are decisions with owners and dates. Last time’s actions should be followed up in this time’s minutes. A slide deck with no recorded decisions usually becomes a finding.
How Sted uses it
- For ISO 27001 clause 9.3 Sted’s knowledge base carries the Management Review Procedure (PRC-MRP) with its Management Review Schedule (REC-MRS), Management Review Record (REC-MRR) and Management Review Action Record (REC-MRA); the schedule and the review record come with a suggested annual frequency.
- Nothing is scheduled until an owner picks a first due date, and records are part of the Full Management System plan.
- 33 periodic record types come with a suggested frequency, but nothing is scheduled until you pick a first due date.
Related terms
- Internal audit: its results are a required input.
- Nonconformity: trends in nonconformities and corrective actions are reviewed.
- Interested parties: changes in their needs are an input.
- Documented information: the minutes are the evidence the review happened.
- How to run a management review: preparing the pack and running the meeting.