What is a management review?
A management review is a recorded meeting in which leadership looks at how the management system is performing: audit results, risks, incidents, objectives and resources, and decides what to change. ISO management system standards, including ISO 27001 and ISO 42001, require it at planned intervals.
What the review must consider
Clause 9.3 of ISO 27001:2022 says top management must review the ISMS at planned intervals to make sure it remains suitable, adequate and effective. It then lists the inputs the review has to cover. Auditors check the minutes against this list, so it is worth using it as the agenda.
- Previous actions. The status of actions from earlier reviews.
- Changes. Changes in internal and external issues, and in the needs and expectations of interested parties.
- Performance. Trends in nonconformities and corrective actions, monitoring and measurement results, audit results and progress on security objectives.
- Feedback. Feedback from interested parties, such as customers or regulators.
- Risk. Results of the risk assessment and the status of the risk treatment plan.
- Improvement. Opportunities for continual improvement.
What it has to produce
The results must include decisions on improvement opportunities and on any changes needed to the management system, and the results have to be kept as documented information. In practice that means minutes with attendees, the inputs reviewed, the decisions made, and each action with an owner and a date.
A review that lists inputs but records no decisions is a common finding. If nothing needs to change, the minutes should say so and say why.
When to hold it
The standard leaves the interval to you. Most organisations hold a full review once a year, with shorter check-ins in between. Before a Stage 2 certification audit, certification bodies expect at least one management review to have taken place, normally after the internal audit so its results can feed in.
Who attends matters too. "Top management" means the people who direct the organisation and can commit resources. A review held only by the security team, without anyone who can approve budget or accept risk, is hard to defend at audit.
Questions
Management review, answered
How often must a management review happen?
At planned intervals that you set. Most organisations hold one at least once a year, and certification bodies expect one before the Stage 2 audit and before each surveillance audit.
Can the management review be part of a board meeting?
Yes, if the meeting covers every input in clause 9.3 and the minutes record the decisions and actions. Many smaller companies run it as a dedicated item on a leadership meeting agenda.
Can ISO 27001 and ISO 42001 share one management review?
Yes. Both standards use the same clause structure, so one review can cover both systems, provided the minutes address the inputs for each.
Working through this for an audit?
Talk it through with someone who has run the audit before, or look up another term.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them