The management review is one of those ISO 9001 requirements that most easily becomes a checkbox: a meeting gets scheduled, the agenda items get recited, the minutes get signed and filed away until next year. The auditor reviews them, marks them “conformant,” and everyone breathes easy — until the auditor asks: “What decisions did management actually make as a result of this review?” Uncomfortable silence.
The problem isn’t the meeting — it’s that the review gets designed to demonstrate compliance, not to make decisions. This guide shows you how to run an ISO 9001 management review that satisfies the standard and, at the same time, becomes the most useful quality-focused meeting your leadership team has all year.
Table of Contents
What the Management Review Is and What ISO 9001 Requires
The management review is defined in clause 9.3 of ISO 9001:2015, within the Performance Evaluation section. Its purpose, per the standard, is to ensure the QMS:
- Remains suitable, adequate, and effective.
- Is aligned with the strategic direction of the organization.
In practical terms: the management review is the formal opportunity for the people who make decisions in your organization to evaluate the quality system with real data and decide what changes, resources, or priorities are needed for the next cycle.
How often? The standard says “at planned intervals.” In practice, once a year is the minimum auditors accept; twice a year is most common in mature organizations.
Required Inputs (Clause 9.3.2)
One of the most frequent mistakes is holding the review without preparing the right data. ISO 9001 clause 9.3.2 explicitly lists the inputs the review must consider:
- Status of actions from previous reviews: what was decided last year and what progress has been made?
- Changes in external and internal issues relevant to the QMS.
- Information on QMS performance and effectiveness:
- Trends in customer satisfaction and feedback.
- Degree to which quality objectives have been met.
- Process performance and product/service conformity.
- Nonconformances and corrective actions.
- Monitoring and measurement results.
- Audit results.
- External provider performance.
- Adequacy of resources.
- Effectiveness of actions taken to address risks and opportunities.
- Opportunities for improvement.
Prepare a briefing document with real data for each of these points before the meeting. Without data, the review isn’t a review — it’s a meeting of opinions.
Required Outputs (Clause 9.3.3)
The management review cannot end without concrete decisions. Clause 9.3.3 requires that the outputs include:
- Opportunities for improvement identified.
- Any need for changes to the QMS.
- Resource needs (human, financial, infrastructure, technology).
These outputs are what turns the review into a real management mechanism. If the minutes simply state “the system is conformant and satisfactory,” they don’t meet clause 9.3.3 — and they generate zero value for the organization.
Consultant’s note: every output must have an owner, a deadline, and a way to measure completion. Without that, the minutes are a document, not a commitment.
Who Needs to Participate
The standard says “top management.” In an SME, this means the owner, CEO, or operations director — whoever has real authority to make decisions about resources and strategy. It doesn’t need to be the entire board, but it does need to be someone who can say “yes” or “no” when the quality manager asks for budget for training or process changes.
How to Structure the Meeting Step by Step
Step 1: Prepare the data package in advance
The QMS manager should prepare an executive briefing covering all the clause 9.3.2 inputs — ideally 2–3 pages with real data, trend charts, and a traffic-light view of objective compliance. Send it 5 days in advance so leadership arrives with context, not questions.
Step 2: Open with the status of previous review actions
First question: what did we agree to last year, and what happened? This closes the previous cycle and gives the process credibility. If actions are incomplete, decide whether they continue or are formally cancelled.
Step 3: Review QMS performance with data
Present quality KPIs, internal audit results, complaint and nonconformance analysis, and supplier performance. The goal isn’t to read the numbers — it’s to interpret them: did things improve, worsen, or stagnate, and why?
Step 4: Evaluate risks and opportunities
Review whether the risks identified under clause 6.1 are still the same, whether the actions taken worked, and whether any new risks or opportunities have emerged from context changes. Risk management and the management review feed into each other.
Step 5: Make decisions and document the outputs
This is where most reviews fail: ending the meeting with documented decisions. What gets improved? What resources get allocated? What objectives change for the next year? The review minutes must capture these decisions with owners and deadlines — not just a summary of what was discussed.
The Review Minutes: What They Must Include
The minutes are the mandatory documented information of clause 9.3. At a minimum, they must include:
- Date and attendees.
- Inputs analyzed (reference to the briefing prepared).
- Conclusions by topic.
- Decisions / outputs with owner, deadline, and follow-up indicator.
- Top management signature.
Frequently Asked Questions about the Management Review
How often must the management review be conducted?
Clause 9.3 says “at planned intervals.” The minimum frequency accepted by auditors is annual. In more mature organizations or dynamic environments, semi-annual is recommended. What matters is that the frequency is defined, documented, and consistently followed.
Can the management review be held virtually?
Yes. ISO 9001 doesn’t require an in-person meeting. A properly documented video call — with attendees, date, decisions, and digital signatures — satisfies the requirement. What doesn’t work is substituting the review with scattered email threads or a document approval without a real meeting.
What if top management can’t attend?
This is a common audit finding. The solution isn’t to delegate the review to the quality manager “on behalf of” management — that doesn’t meet the spirit of the clause. If the CEO genuinely can’t attend, they must formally delegate to someone with equivalent authority (COO, general manager), and that delegation must be documented.
How do I measure whether the management review was effective?
The most direct indicator: how many of the outputs from the minutes were executed within the agreed timeframe? If previous-year agreements are consistently fulfilled, the review is effective. If unmet agreements accumulate year after year, the review is a formality — and any experienced auditor will notice.
Do I need a documented procedure for the management review?
ISO 9001 doesn’t explicitly require one. But a simple protocol defining the frequency, responsible parties, pre-meeting briefing format, and minutes format helps ensure consistency year over year — especially when there’s turnover in the quality team.
From Formality to Decision: The Change Starts with Data
Management reviews become formalities when data isn’t organized. If your KPIs live in separate spreadsheets, your corrective actions in a different file, and your audits in another folder, preparing the pre-meeting briefing takes longer than the meeting itself.
QualityWeb 360 consolidates in one place all the data you need for the review: performance indicators, corrective action status, internal audit results, supplier evaluation, and risk tracking. You generate the review report in minutes, not days.
Before scheduling your next review, find out where your QMS stands with the free ISO 9001 QMS Maturity Assessment — no registration required.
Or see the platform in action: schedule a demo and we’ll walk you through the full system in 30 minutes.
