What is an ISO management review and how do you run one? 

What is a management review? 

A management review is a planned assessment of whether your management system is still suitable, adequate and effective. In practical terms, you’re checking whether it still fits your organisation, has what it needs and produces the intended results. You then make decisions about processes, resources, risks and improvements. 

Many organisations hold a dedicated Management Review Meeting (MRM), but the standards don’t generally require a specific meeting format. You can use an existing leadership meeting or several linked meetings, provided your management team covers the required inputs, reaches decisions and retains evidence of the results.  

What should you include in a management review? 

Clause 9.3 of your standard sets out the requirements for a management review. Importantly, the details differ between standards, so build your agenda around your specific requirements. If you run an integrated management system, one review can cover several standards, but your agenda must address all their requirements. 

Depending on the standard, your management review should cover topics such as:  

• Progress on actions from previous management reviews 
• Changes in internal and external issues, including relevant interested-party requirements 
• Progress towards management system objectives 
• Performance trends, including monitoring, measurement and audit results 
• Nonconformities and corrective actions 
• Whether you have sufficient people, infrastructure, technology and other resources 
• The effectiveness of actions addressing risks and opportunities 
• Opportunities for continual improvement  

There are also standard-specific items. Under ISO 9001, for example, you’ll also need to consider customer satisfaction, process performance, the conformity of products and services and external-provider performance. 

Although management review is necessary for conformity with the standard, don’t fill the agenda with raw data. Show trends, compare results with targets and highlight exceptions so your leadership team can see where it needs to act.  

How often should you conduct a management review? 

ISO management system standards normally require reviews at planned intervals. Choose an interval that lets you respond before problems grow, considering your risks, rate of change, past performance and the maturity of your system. 

We generally recommend holding MRMs quarterly, with topics distributed across the year as appropriate. This keeps actions moving and prevents an overloaded annual meeting. You may also need an additional review after a major organisational change, serious incident or sustained decline in performance. 

Your management team must own the review. Other attendees should include the people who understand the results, can explain problems and have the authority to support any agreed actions. You don’t need every manager to attend every review, but your relevant functions should be represented.  

How do you run a Management Review Meeting? 

You’ll need an agenda mapped to the applicable requirements. Circulate it with the previous minutes, action log and a short performance pack in time for attendees to examine the information. 

During the MRM:  

1. Confirm the scope of the review and review and approve the previous meeting record. 
2. Check outstanding actions before moving to new topics.
3. Review performance against objectives and look at trends, not isolated figures. 
4. Discuss why targets were missed, whether controls remain effective and what has changed. 
5. Agree decisions, actions, owners, deadlines and any resources required. 

Keep the conversation focused on decisions. A list showing that you mentioned each input won’t demonstrate an effective review if no one evaluates the evidence or responds to it. 

The MRM shouldn’t become a detailed problem-solving session either. If an issue needs investigating, assign it to an owner and set a deadline. This lets your management team maintain oversight without allowing one topic to consume the meeting.  

What should the management review produce? 

The management review should produce clear decisions and actions. Depending on the standard and the evidence discussed, these may concern improvement opportunities, changes to the management system and resource needs. 

Retain documented information showing the results. Your minutes or review record should identify the date, attendees, information considered, conclusions, decisions and actions. You don’t need a transcript, but an auditor should be able to follow how the evidence led to the outcome. 

Update the action log and monitor progress between reviews. At the next MRM, check whether each action was completed and whether it achieved the intended result. 

At ISO QSL, we can help you understand your management review requirements and integrate them into the way you run your organisation. Our ISO training also gives your team practical guidance on maintaining and improving your management system. Get in touch to discuss the support you need.