ISO 27001 management review: agenda, inputs and minutes (clause 9.3)

A management review is a meeting where top management looks at how the ISMS is performing and decides what to change. It's the moment the people accountable for the business take ownership of security, rather than leaving it with whoever runs IT.

Most small organisations hold one a year, with a shorter check-in in between. You need at least one before your stage 2 audit.

Why it matters

Management review is clause 9.3 of ISO/IEC 27001:2022, and it backs up the leadership requirements in clause 5.1. In summary, top management must review the ISMS at planned intervals, and the review must consider:

• The status of actions from previous reviews.
• Changes in external and internal issues relevant to the ISMS.
• Changes in the needs and expectations of interested parties.
• Feedback on security performance, including trends in nonconformities and corrective actions, monitoring and measurement results, audit results, and progress on your security objectives.
• Feedback from interested parties.
• Results of the risk assessment and status of the risk treatment plan.
• Opportunities for continual improvement.

The outputs are decisions about improvement and any changes needed to the ISMS, kept as documented information.

What an auditor looks for

• Every required input was covered, not just a status update.
• Top management was there, and signed off the outcome. A review held only by the IT team doesn't meet the clause.
• Decisions and actions were recorded, with owners and dates, and they're followed up at the next review.
• The review reflects reality: open nonconformities, overdue actions and recent incidents are discussed, not hidden.
• Trends, not snapshots, especially at surveillance and recertification: how performance, objectives and audit results have moved across the cycle.

Common reasons it fails: missing inputs (often interested parties or objectives); no top-management attendance; minutes with no decisions; or actions from the last review never revisited.

A ready agenda

Use these headings, in order, and record a short note and any decision under each:

1. Actions from the last review: done, in progress, overdue
2. Changes in issues affecting the ISMS (internal and external)
3. Changes in interested parties' needs and expectations
4. Nonconformities and corrective actions: numbers and trends
5. Monitoring and measurement results
6. Internal and external audit results
7. Security objectives: progress against each
8. Feedback from interested parties (customers, staff, suppliers)
9. Risk assessment results and treatment plan status
10. Opportunities for improvement
11. Decisions, changes to the ISMS, resources needed, and new actions

Common mistakes, and how to keep it manageable

• Starting from a blank page. Gather the figures from your records beforehand, so the meeting discusses decisions, not data gathering.
• Making it a slideshow. Keep it to an hour, focus on what needs a decision, and minute the decisions.
• Separate documents for everything. Link to the risk register, audit reports and objectives rather than copying them into the minutes.
• No follow-up. Turn each decision into an owned action with a date.

How to do it in ClearIMS

1. Press New review on Management reviews, then Create review. It picks up counts from your records, such as changes to context and interested parties and progress on measured objectives.
2. Use the Agenda / status brief. Choose the sections to cover (they follow the clause 9.3 inputs) and add commentary under each. Your commentary stays visibly separate from the source figures, so gaps and overdue actions are never hidden. The monitoring and measurement input (d2) and the objectives input (d4) show trend lines across the certification cycle. The audit results input (d3) includes certification body audits and your internal audit programme effectiveness review, as well as internal audits.
3. Record actions with owners and dates, and attach supporting files.
4. Sign it off. Move the Status / sign-off from Draft to In review and then Approved. Signing off a management review needs a member marked as top management. The AI never approves anything.
5. Keep the record for your auditor. A recurring task brings the next review round on time.

Related pages

• Internal audits: one of the review's key inputs.
• Nonconformities: trends you'll review.
• Security objectives: progress you'll report.
• Meetings: for shorter governance check-ins between reviews.
• Certification cycle: certification body audit results.
• Annual workload: resourcing the ISMS.