How to run a management review

A management review is top management deciding whether the management system still works, and what to change. Schedule it, gather the inputs from audits, corrective actions, risks, objectives and incidents, send a short pre-read, take each input in turn, and minute every decision with an owner and a date. Start the next review with those actions.

When you need this

ISO 27001:2022 9.3.1 requires top management to review the system at planned intervals, 9.3.2 sets the inputs, including changes in the needs of interested parties, and 9.3.3 requires decisions on improvement and change, with the results kept as documented information. ISO 9001:2015 9.3 has the same three parts, and ISO 42001:2023 9.3 applies them to an AI management system. ISO 13485:2016 5.6.1 goes further: a documented procedure and intervals you document, with complaints, reports to regulatory authorities and new regulatory requirements among the inputs in 5.6.2.

The usual triggers are the annual cycle, the run-up to a stage 2 or surveillance audit, and a significant event such as a serious incident or an acquisition. A quality or security lead prepares it; the directors hold it.

This is guidance to help you understand the requirement, not legal advice.

Before you start

You need a date in the directors’ diaries, the minutes and action list from the last review, and access to the data behind each input: internal audit reports, the corrective action log, the risk register, objective measures, incidents, complaints and supplier reviews. For ISO 13485, also have your documented management review procedure and the interval it sets.

Allow one to two days to prepare the pack, five working days for the pre-read, and 90 minutes to two hours for the meeting. Writing and approving the minutes takes another hour.

Steps

Schedule the review and name the attendees. Invite the people who form top management, plus the person presenting. Done when the date and agenda are in every attendee’s calendar.
Collect the actions from the previous review. Record each one as closed, open or overdue, with evidence. Done when every action has a status.
Gather the inputs from the system for the period since the last review. Take audit results, nonconformities and corrective action status, risk changes and treatment progress, objective measures, incidents, complaints and feedback, supplier performance, and overdue reviews and training. Done when each input has a source and a date range.

Audit readiness is the share of done items per adopted standard: approved documents, adopted requirements, records and training.
Audit readiness is visible to administrators only for now.
Tasks open and close themselves from the state of your documents, records and training; you rarely create them by hand.
Summary shows nine profile cards of what Steward has learnt (an unanswered question reads “Not yet captured”), strips counting your standards, audit readiness (administrators only) and framework, a Statement of Applicability card per eligible standard, the registers that have rows, and last a collapsed Generation history for administrators and Policy and Process Owners; it has no generate button.

Write the pack. Give each input group one page with the trend and a question for decision, and keep the whole pack under ten pages. Done when every section ends in a question.
Send the pack as a pre-read five working days before the meeting. Done when every attendee has confirmed receipt.
Hold the meeting and take the inputs in agenda order. Minute what each input showed in one or two lines. Done when every input has been discussed.
Record each decision: an improvement, a change to the system, or a resource need. Give each an owner and a due date. Done when no decision lacks either.
Approve the minutes and file them with the pack within 10 working days. Done when the signed minutes and the pack are stored together.
Track each action to closure, and make the action list the first agenda item of the next review. Done when the next review date is set.

Grouping the inputs

The standards list their inputs differently, but they fall into four groups. Build the agenda around the groups and tick off each standard’s inputs inside them.

Group	What to bring	Where the standards differ
Follow-up	Status of actions from earlier reviews	All four standards ask for it
Change	Changes in internal and external issues and in what interested parties need	ISO 13485 asks for new or revised regulatory requirements
Performance	Nonconformities and corrective actions, measurement results, audit results, objectives, feedback	ISO 9001 adds customer satisfaction, supplier performance and resource adequacy; ISO 13485 adds complaints and regulatory reporting
Risk and improvement	Risk assessment status, treatment progress, opportunities to improve	ISO 9001 asks whether actions on risks and opportunities worked

The ISO 27001 change input covers interested parties’ needs, added in the 2022 edition. Auditors check for it, because older agendas miss it.

Minutes that hold up

An auditor reads the minutes to find out what top management decided. A good decision names the change, the owner and the date: “Move the production access review to quarterly from 1 April 2026; owner: CTO.”

Noted is not a decision

The common failure is an hour of slides and a minute reading “all items noted”. Clause 9.3.3 of ISO 27001 and of ISO 9001 asks for outputs, and ISO 13485:2016 5.6.3 lists the kinds it expects. If an input needs no change, minute that decision and the reason. The other failure is a review held without top management: content alone does not meet the clause.

Worked examples

ISO 27001, a 40-person firm’s annual review

Ardent Freight Software holds its review on 21 January 2026; the CEO, CTO and finance director attend, and the security lead presents. Four of five actions from January 2025 are closed; the fifth, a supplier review backlog, is two months late. Change: a new NHS trust customer requires Cyber Essentials Plus, and the scope now includes a second product. Performance: 11 internal audit findings, down from 19; three incidents, one a misdirected email; the phishing objective met. Risk: a single-region hosting risk still scores 15.

Three decisions: fund a second hosting region, owner CTO, by 30 June 2026; achieve Cyber Essentials Plus for the new scope, owner security lead, by 31 May 2026; clear the supplier backlog, owner finance director, by 31 March 2026. The minutes are approved on 28 January, and the Cyber Essentials Plus result and its scope go on the agenda for January 2027.

ISO 13485, complaint trends and a vigilance report

Calder Diagnostics reviews its quality management system on 4 March 2026. Complaints about a glucose reader’s display rose from 4 to 12 in six months, and one serious incident was reported to the competent authority. A new distributor in Australia brings that market’s device regulations into scope, a new regulatory requirement for the review. Under ISO 13485:2016 5.6.3 the minutes record a product improvement (a firmware change to the display), a resource need (a second complaint handler), and a change to the system (an updated surveillance plan), each with an owner and date.

ISO 9001, adding the quality inputs

ISO 9001:2015 9.3.2 follows the ISO 27001 example with customer satisfaction, supplier performance and resource adequacy added to the pack.

ISO 42001, the same review for AI

ISO 42001:2023 9.3 follows the ISO 27001 example, with the AI systems in scope, their impact assessments and their monitoring results as the performance inputs.

Checklist

Top management attended, and the minutes name them.
The review happened within the interval you planned.
Every action from the previous review has a status.
Changes in issues and in interested parties’ needs were discussed.
Audit results, corrective actions, objectives and risks were reviewed with trends.
Each standard’s extra inputs were covered.
Every decision has an owner and a due date.
Minutes are approved and filed with the pack.
Actions are tracked and open the next review.

How Sted helps

For ISO 27001 clause 9.3 Sted’s knowledge base carries the Management Review Procedure (PRC-MRP) with its Management Review Schedule (REC-MRS), Management Review Record (REC-MRR) and Management Review Action Record (REC-MRA); the schedule and the review record come with a suggested annual frequency.
Nothing is scheduled until an owner picks a first due date, and records are part of the Full Management System plan.
33 periodic record types come with a suggested frequency, but nothing is scheduled until you pick a first due date.

Sted raises the review record on the schedule you set and holds its actions. It does not attend the review or make its decisions; top management does.

ISO 27001 management review: what clause 9.3 requires, input by input.
ISO 9001 performance evaluation: the quality version of the review.
Management review: the term, and how it differs from an internal audit.
Root-cause analysis for a CAPA: the corrective actions whose status the review weighs.
Repeating records: how Sted raises the review record when it falls due.

Frequently asked questions

What should be on a management review agenda?

Five items in this order: actions from the last review, what has changed, how the system is performing, risks and improvement, then decisions. Starting with old actions stops them vanishing, and ending with decisions makes sure the meeting produces some.

What should management review minutes include?

The date, who attended, each input considered with a line on what it showed, and every decision with an owner and a due date. Add the approver and approval date. An auditor reads the minutes to check coverage of the inputs and to pick a decision to trace.

How long does a management review take?

Ninety minutes to two hours for a small organisation with a good pre-read. Preparing the pack takes longer, usually one to two days, because the data comes from audits, corrective actions, risks and objectives.

Can one review cover ISO 27001 and ISO 9001 together?

Yes, if the agenda covers every input each standard requires and the minutes show it. ISO 9001 names customer satisfaction, supplier performance and resources, which ISO 27001 does not, so add them for the quality side.