Chapter 9 of 13 · Months 3–5
Management Review Without the Theatre
- What is a management review and do we have to hold one?
- What goes in the pack?
- How do I get real decisions out of it?
ISO management system standards, including ISO/IEC 27001 and ISO/IEC 42001, require top management to review the system at planned intervals. Auditors will ask for the minutes. More importantly, it is the one meeting where leaders formally look at your whole programme.
What usually goes in
- Status of actions from the last review.
- Changes inside and outside the organisation that affect security, such as new laws, products or suppliers.
- Changes in the needs and expectations of interested parties, such as customers or regulators.
- Performance: nonconformities and corrective actions, monitoring results, audit results, and whether objectives were met.
- Feedback from interested parties, the risk assessment results and the status of risk treatment.
- Opportunities to improve.
Check the exact required inputs in the edition of the standard you are certified to. The 2022 edition of ISO/IEC 27001 added changes in the needs and expectations of interested parties to the management review inputs.
Running it well
- Send a short pack a few days ahead. Lead with the decisions you need.
- For each decision, give the options, your recommendation and the risk of doing nothing.
- Keep the meeting to the decisions. Reading slides aloud wastes the room.
- Record each decision with an owner and a date.
- Start the next review by checking those actions.
The question you might not ask out loud
Our last management review was a 40-slide deck and nobody said anything. Is that normal?
It is common, and it is a missed chance. Try one page: three decisions needed, top risks, and what changed. Silence usually means nobody was asked a question.
Rule of thumb:Minutes must show decisions and actions, not only that the meeting happened. "Reviewed and noted" for every item tells an auditor the review was a formality.
After the meeting
Send the minutes within a few days, while people still remember what they agreed. Put each action into the same tracker you use for nonconformities and risks, so it is chased like any other piece of work. If an action has no owner when the minutes go out, it will not be done.
Keep the pack and the minutes together in your documented information register. At the next audit, the auditor will usually ask for the last review and then follow one or two actions through to see whether they were done.
If leaders will not attend, say so plainly to your manager. A management review without top management does not meet the requirement, and it suggests governance problems an auditor will notice.