In short
Top management carries out the review at planned intervals: the quality manager prepares the data but cannot replace those who decide.
Clause 9.3 of the harmonized structure sets five common inputs; ISO 9001 and the other standards add inputs specific to their discipline.
Without decisions on improvement and changes to the system the requirement is not met, even with long minutes.
Every decision needs what, who, by when, resources and an effectiveness criterion, so it can be verified at the next review.
The certification body checks the review in Stage 1, in Stage 2 and in every surveillance audit.
It is the moment when top management decides on real data: objectives, complaints, risks, resources. A practical agenda and the mistakes an auditor spots straight away.
The management review is the requirement that most often separates a living management system from an archive of documents. On paper it is simple: at planned intervals, top management sits down, looks at how the system is performing and decides what to change. In practice, many SMEs turn it into minutes written in a hurry before the audit, with phrases such as "the system is adequate" and no real decisions. The auditor notices within minutes, because the review is one of the points they are required to check.
In this guide we look at what clause 9.3 of the ISO harmonized structure actually requires, which has the same structure in ISO 9001, ISO 14001, ISO 27001, ISO 45001 and the other management system standards, with small differences in wording between editions. You will find a ready-to-use agenda, a concrete example from a typical company, the right way to write decisions and minutes, and the mistakes an auditor spots straight away. If you first need an overview of the quality system, start with our guide to the ISO 9001 quality management system.
What is a management review and what does clause 9.3 require?
The management review is the periodic evaluation of the management system carried out by top management. It is not just any meeting: it is the point at which the people running the company take documented decisions about the system.
Clause 9.3 is part of the harmonized structure (HS), the common text that ISO and IEC use for all management system standards. The public version is referenced in the ISO/IEC Directives, Part 1. The requirement has three parts. Clause 9.3.1 states that top management shall review the system at planned intervals to ensure its continuing suitability, adequacy and effectiveness. Clause 9.3.2 lists what the review shall include. Clause 9.3.3 establishes that the results shall include decisions on continual improvement opportunities and any need for changes to the system, and that documented information shall be available as evidence.
Each standard can then add inputs specific to its own discipline. The official guidance on the harmonized structure says so explicitly: standard writers may require additional inputs needed to demonstrate the suitability, adequacy and effectiveness of the system. This is why the ISO 9001 review has a longer list than the common one, and the same applies to other standards. If you want a refresher on how this common structure works, it is explained in our guide on what ISO certifications are.
Who must take part: top management, for real
The text is clear: it is top management that carries out the review. In the harmonized structure, top management is the person or group of people who direct and control the organization at the highest level. In an SME this means the owner, the managing director or the board that takes decisions on money, people and priorities.
The quality manager prepares the data, organises the meeting and often writes the minutes. But they cannot do the review alone and have it signed afterwards. The official guidance stresses that the requirement is worded as "top management shall review", not "shall ensure that a review takes place": management takes part, it does not delegate. In practice it is useful to involve the owners of the main processes too (production, sales, purchasing, IT), because they know the causes behind the numbers. A review attended only by the quality manager is the first sign that the system lives in an office cut off from the rest of the company.
Suitability, adequacy, effectiveness: three different questions
The three words in clause 9.3.1 are not synonyms, and a good review answers all three. Suitability: is the system still right for the company as it is today? If you have opened a new line, won a major customer or moved part of the work to remote working, a system designed three years ago may no longer reflect reality.
Adequacy: does the system cover everything it needs to cover, with sufficient resources? A design process without an owner, or quality control entrusted to a single overloaded person, are adequacy problems. Effectiveness, finally, is a defined term in the harmonized structure: the extent to which planned activities are realized and planned results are achieved. Here you need numbers: objectives met or missed, complaint trends, audit results. A review that talks only about effectiveness, without asking whether the system is still the right one, is looking in the mirror rather than at the road.
How often should a management review be carried out?
The harmonized structure does not set a frequency: it speaks of planned intervals. You decide how often, provided the choice is written down, justified and respected.
In practice, most certified SMEs carry out at least one full review a year. It is a sensible choice, because the certification cycle includes annual surveillance audits and, as we will see, the certification body checks the review at every surveillance. Fast-growing companies, those integrating several standards or those facing major changes often hold two reviews a year, or one full annual review plus short meetings on specific topics. There is no obligation to cover everything in a single meeting: the review can be spread over several sessions, provided that by the end all the required inputs have been covered and the decisions have been recorded.
Where to place it in the calendar
The most effective sequence is internal audit first, then the review, then the certification body's audit. The reason is simple: audit results are one of the mandatory inputs, and a review held before the internal audit arrives with an obvious gap. To organise the internal audit properly, see our dedicated guide to the ISO internal audit.
Also leave some margin between the review and the external audit. If the review decides on actions, the auditor will want to see that at least the first ones have started. A review closed the day before surveillance, with ten actions all "to be started", sends only one message: it was done for the audit. In a company with surveillance in November, for example, a reasonable calendar is internal audit in September, review in early October and a check on the status of actions at the end of October.
A final word of caution concerns initial certification. Under ISO/IEC 17021-1, the standard that governs certification bodies, the auditor already evaluates in Stage 1 whether internal audits and management reviews are being planned and performed. If you reach certification without ever having held a review, you are behind schedule.
What inputs must the review include: the practical agenda
In the current text of the harmonized structure there are five common inputs: the status of actions from previous reviews, changes in external and internal issues, changes in the needs and expectations of interested parties, information on performance including trends, and opportunities for continual improvement. The trends concern in particular nonconformities and corrective actions, monitoring and measurement results, and audit results.
Turned into an agenda, they become the items for discussion. The table below is a model you can copy: for each input there is the question to ask and the data to bring to the table.
Input (clause 9.3.2) | Question to ask | What to bring to the table |
|---|---|---|
Status of actions from previous reviews | Did we do what we decided? Did it work? | List of actions with owner, deadline, status and outcome |
Changes in external and internal issues | What has changed in the market, in regulations, in the organization? | Updated context analysis, new applicable laws, organisational changes |
Changes in the needs of interested parties | Are customers, suppliers, authorities or employees asking for new things? | New contractual requirements, customer requests, reports and feedback |
Performance and trends | Are we improving or getting worse, and why? | Objective indicators, nonconformities, corrective actions, audit results |
Opportunities for improvement | Where is it worth investing next year? | Proposals from process owners, ideas from audits, internal benchmarks |
The additional ISO 9001 inputs
ISO 9001 adds quality-specific inputs to the five common ones. The reference remains the official text of the standard, which is paid for: check the full list in the version you have purchased, in the language you work in. Do not rely on lists found online, which often mix different editions.
In practice, a well-run ISO 9001 review almost always covers the voice of the customer (satisfaction, complaints, returns), the performance of external providers, process performance and the conformity of products and services, the adequacy of resources and the effectiveness of actions taken to address risks and opportunities. These are the topics where management has real leverage: budget, people, choice of suppliers, commercial priorities. A good test is to ask, for each agenda item, what decision could come out of it. If none, the item is purely informative and should be shortened.
How to prepare the review: data, owners and timing
An effective review is prepared over the two or three weeks beforehand, not the night before. The meeting is short if the data arrive already analysed; it becomes useless if the time is spent hunting for numbers.
The simplest method is to assign each input to an owner. Sales bring complaints and customer satisfaction, purchasing brings the supplier evaluation, production brings scrap and nonconformities, and whoever manages the system brings audits, corrective actions and the status of objectives. Each person submits their data with a short comment: what happened, why, what they propose. The quality manager gathers everything into a single document and sends it to top management a few days in advance. This way the meeting is used to discuss and decide, not to discover the numbers.
The pack to prepare
The review pack does not need to be long; it needs to be readable in half an hour. A three-part structure works well: a one-page summary with the key messages, a section for each agenda input, and a list of proposed decisions.
For each indicator show at least two periods side by side: an isolated value says nothing, a trend does. If the objective was to reduce complaints and the figure went from 14 to 11, write it down and explain what worked; if it rose, explain what happened. Attach or reference the evidence (audit report, nonconformity log, supplier evaluation) instead of summarising it from memory. When documents live in different places, preparation turns into a hunt for files: this is where a platform holding evidence and deadlines in one place saves the most time.
Example: a 40-person engineering company
Take a typical company: 40 employees, subcontract machining, ISO 9001 certified. Three facts emerge from the annual review. Complaints have fallen, but two key customers have reported repeated delivery delays. A heat-treatment supplier has accumulated three nonconformities in six months. And an automotive customer has requested new traceability requirements for batches.
A box-ticking review would note everything as "to be monitored". A real review decides: launch a root cause analysis of the delays with the production manager within a month; place the supplier under observation and qualify a second one within six months; update the identification and traceability procedure before the automotive customer's next order, with a budget for labels. Three decisions, three owners, three deadlines. That is exactly what the auditor will look for in the minutes.
What decisions must the review produce?
Clause 9.3.3 is clear: the results of the review shall include decisions on continual improvement opportunities and any need for changes to the management system. A review without decisions does not meet the requirement, even if the minutes are long and well written.
"Decision" does not necessarily mean changing something. Confirming an objective or deciding not to act on a stable indicator is also a decision, as long as it is justified. What is not acceptable is the absence of conclusions: minutes that describe the data and stop there. The official guidance on the harmonized structure explains the spirit of the requirement well: top management's involvement in the review is the mechanism that drives changes to the system and directs improvement priorities. In other words, the review is where the PDCA cycle closes and starts again.
How to write a verifiable decision
A decision is verifiable when someone, six months later, can say whether it was implemented and whether it worked. To get there you need five elements: what will be done, who is responsible, by when, with what resources, and how the result will be measured.
Compare two wordings. "Improve supplier management" is not verifiable. "Qualify a second heat-treatment supplier by 30 June; owner: purchasing; sampling budget approved; effectiveness: zero line stoppages due to missing heat treatment in the following six months" is. When the decision concerns a recurring nonconformity, link it to a corrective action with root cause analysis: you will find the method in our guide to corrective action and root cause analysis. And remember that the status of these decisions will be the first input of the next review.
The minutes: what they must demonstrate
The requirement asks for documented information to be available as evidence of the results. It does not impose a form or format: minutes, a presentation with the approved decisions or a report generated by a platform are all fine, as long as they are clear and retained.
Useful minutes record at least the date, the participants and their roles, the inputs covered with the main data, decisions with owner and deadline, and any changes to policy, objectives, resources or processes. Avoid two extremes. The first is ten lines of minutes with generic conclusions, which prove nothing. The second is forty pages that copy out all the data and bury the decisions. The practical rule: anyone reading only the last page must understand what top management decided and who has to do what.
What the auditor looks at in the management review
The certification body's auditor must check the review: it is not their choice. ISO/IEC 17021-1 lists it among the mandatory elements at several points in the certification cycle.
In Stage 1 the auditor evaluates whether internal audits and management reviews are being planned and performed. In Stage 2 the audit must include, among other things, internal auditing and management review. Every surveillance audit must cover internal audits and management review. And in its report the certification body also records how it assessed the internal audit and management review. In practice, at every visit someone will ask to see the latest minutes.
What do they look for, specifically? That all the required inputs have been covered. That there is a link between data and decisions: if complaints have doubled, the minutes must say what was decided. That the decisions of the previous review have been followed up. That top management was genuinely present. Auditors often work backwards: they start from a problem found on the shop floor and check whether the review had picked it up.
The mistakes an auditor spots straight away
Management review mistakes are almost always the same, and an experienced auditor recognises them within minutes. Here are the most common, with how to avoid them.
Desk-written minutes: drafted by the quality manager and signed by top management without a meeting. It shows in inconsistent dates, no sign of discussion and decisions identical to the previous year.
Missing inputs: usually the changes in interested parties or the status of previous actions. Use the agenda as a checklist and tick off each item.
Data without trends: an isolated number does not allow effectiveness to be assessed. Always compare at least two periods.
No decisions: phrases such as "the system is adequate and effective" with no actions, resources or changes. Close each item with a decision, even if it is only a justified confirmation.
Unverifiable decisions: "improve", "raise awareness", "monitor" with no owner or deadline.
Forgotten actions from the previous review: the auditor opens last year's minutes and asks what happened to each action.
Review held the day before the audit: no actions started, no evidence of implementation.
There is also a subtler mistake: a review disconnected from the budget. If top management decides on new resources in the review but the company budget is approved at another time without taking them into account, the decisions stay on paper. Align the review calendar with the financial planning calendar: it is the simplest way to turn the requirement into a management tool.
Management review in an integrated system
If your company holds several certifications, you can carry out a single review for all of them. The harmonized structure was designed precisely for this: clause 9.3 with the same structure, common inputs, the same decision logic.
An integrated review avoids three separate meetings with the same participants and the same context data. It must, however, cover the specific inputs of each standard: environmental topics for ISO 14001, information security for ISO 27001, workers' health and safety for ISO 45001, according to the list each standard adds to clause 9.3.2. There is still a single agenda, with dedicated sections where needed. In the minutes, state which system each decision refers to, so that each auditor immediately finds what they need. To set up this approach properly, read our guide to the integrated management system.
A practical tip: even if the review is a single one, make sure the data for each standard are complete. An integrated review that talks at length about quality and dismisses the environment in two lines is an incomplete review for ISO 14001, and the environmental auditor will flag it.
How Complaion helps you prepare your management review
The review works when the data are ready and the decisions are followed up. That is exactly the work Complaion organises with a dedicated Lead Auditor and a platform designed for management systems.
The Lead Auditor follows your company throughout and conducts the internal audit, the first input to the review, so you come to the table with real findings and actions already under way. They propose the path best suited to your needs, help you set up the review agenda for the standard or standards you have chosen and check that decisions and minutes stand up in front of an auditor. The platform collects evidence, manages documents, keeps the schedule of agreed actions and prepares the audit, so the review pack is not rebuilt from scratch every year. Complaion supports more than 1,000 clients with ISO 9001 certification and the other management system standards. If you want to understand how to set up the next review in your company, talk to our team and receive a tailored quote.
Frequently asked questions about the management review
Is the management review mandatory for ISO certification?
Yes. Clause 9.3 is a requirement of all ISO management system standards built on the harmonized structure, including ISO 9001. Without a review the system does not conform. In addition, the certification body must check it both at initial certification and at every surveillance audit.
How often should a management review be carried out?
The standard does not set a frequency: it requires planned intervals, which you decide and must respect. Most SMEs carry out at least one review a year, placed after the internal audit and before the external audit. Fast-growing companies or those managing several standards often hold two.
Who must take part in the management review?
Top management must take part, meaning those who direct the company at the highest level: owner, managing director or board. The quality manager prepares the data and the minutes but cannot take management's place. It is also useful to involve the owners of the main processes.
Can I hold the management review remotely or over several meetings?
Yes, the standard does not require an in-person meeting or a single session. You can spread the inputs over several sessions, including online, provided all of them have been covered by the end. What matters is that decisions and participants are recorded in documented information.
What should the management review minutes contain?
Date, participants, inputs covered with the main data, decisions with owner and deadline, and any changes to the system, objectives or resources. The standard does not impose a form, but it does require evidence of the results. Anyone reading the minutes must immediately understand what top management decided.
Is a review needed before initial certification?
Yes. Under ISO/IEC 17021-1, the auditor already evaluates in Stage 1 whether internal audits and management reviews are being planned and performed. Reaching certification without a complete review is a sign that the system is not ready yet.
With several ISO certifications, do I need several reviews?
No, you can carry out a single integrated review, because clause 9.3 has the same structure in all standards with the harmonized structure. You must, however, also cover the specific inputs of each standard. In the minutes it is worth stating which system each decision refers to.
