The management review is top management's scheduled examination of the ISMS, required by clause 9.3 at planned intervals, usually once a year and often more. It takes a fixed set of inputs: the status of actions from the last review, changes in the issues and interested parties around the ISMS, performance feedback including nonconformities, measurement results, audit results and progress on objectives, feedback from interested parties, the risk assessment results and the status of the treatment plan, and opportunities for improvement. It must produce decisions on improvement and on changes to the ISMS, and minutes that record them. Certification bodies check at Stage 1 that it has happened and read the minutes at every audit.
The management review is the clause that makes ISO 27001 a management system rather than a control list: once a cycle, the people accountable for the organisation look at how security is going and decide what changes. It is also the record a certification auditor opens straight after the internal audit report, because it shows whether management acted on what the audit found.
What clause 9.3 requires
Clause 9.3 has three parts. The general requirement: top management reviews the ISMS at planned intervals to ensure it stays suitable, adequate and effective. The inputs: a list of what the review must consider. The outputs: decisions on continual improvement opportunities and on any need to change the ISMS, kept as documented information. Nothing in the clause prescribes a meeting, a length or a format, but the record has to show that each input was considered and what was decided.
Who attends and how often
Top management is whoever directs and controls the organisation at the highest level inside the ISMS scope: the chief executive and the leadership team in most companies, the founders in a small one. The ISMS owner prepares and presents; the risk owners and the internal auditor are usually present. Once a year is the floor most certification bodies accept, timed after the internal audit and before the external one. Many organisations hold a shorter review each quarter and a full one yearly, which keeps the inputs fresh and spreads the decisions.
The inputs, and where each comes from
| Input (clause 9.3.2) | What to bring | Typical source |
|---|---|---|
| Status of actions from previous reviews | Each action with owner, due date and status | Previous minutes and the action log |
| Changes in external and internal issues relevant to the ISMS | New regulations, customers, products, providers, reorganisations, threats | The clause 4.1 register, updated for the review |
| Changes in needs and expectations of interested parties | New contractual security requirements, regulator expectations, customer questionnaires | The clause 4.2 register; sales and legal |
| Feedback on performance: nonconformities and corrective actions, monitoring results, audit results, objectives | Trends in findings, measurements against each objective, the internal audit report and its findings | The nonconformity log, the measurement results under 9.1, the internal audit report |
| Feedback from interested parties | Customer security reviews, complaints, supplier issues, staff reports | Sales, support, HR, the incident log |
| Results of risk assessment and status of the risk treatment plan | Risks added, changed or closed; treatments overdue; residual risks accepted | The risk register and treatment plan |
| Opportunities for continual improvement | Proposals from audits, incidents, staff and the ISMS owner | Opportunities for improvement raised at audits; the improvement log |
The outputs
The review must end in decisions: which improvements to pursue, what to change in the ISMS, and, in practice, what resources to commit. Each decision becomes an action with an owner and a date, and those actions are the first input to the next review. The minutes are the documented information clause 9.3.3 requires, so they must exist, be dated, and name who attended.
A working agenda
- Actions from the last review: status of each, closed or carried forward.
- What has changed: issues, interested parties and their requirements, scope.
- Performance: objectives and measurements, nonconformities and corrective actions, incidents, the internal audit results.
- Feedback from customers, regulators, suppliers and staff.
- Risk: the current assessment, the treatment plan's status, residual risks for acceptance.
- Improvement opportunities and proposed changes to the ISMS.
- Decisions, resources and actions, each with an owner and a date.
Ninety minutes covers it in a small company when the ISMS owner circulates the inputs beforehand, and the free management review minutes template has a heading for each input. The internal audit article explains the report that feeds the performance item, and the nonconformities article the trend data.
Minutes that survive the audit
- Date, attendees and their roles, so the auditor can see top management was there.
- One heading per input in clause 9.3.2, each with a note of what was presented, even when it was "no change".
- The decisions, written as decisions rather than discussion.
- The actions, with owners and dates, and a note of the resources committed.
- Approval of the minutes by the chair.
Common findings
- No review held before Stage 1, or one held after the internal audit was booked but before it reported, so the audit results were not an input.
- Minutes that list the inputs but record no decisions.
- No evidence that top management attended, only the security team.
- Objectives that were never evaluated, because nothing was measured against them.
- Actions from the previous review with no status.
Preparing the review from Noru
The review itself happens in the room, not in a tool, and Noru's ISO 27001 plan records it as a milestone once the minutes are agreed. The inputs come from what the programme already holds: the risk register and treatment status, the internal audit report and its findings, the control statuses and evidence, and the open corrective actions, so the ISMS owner assembles the pack rather than reconstructing it.