Management System FAQs: Management Review

We often get asked questions about various aspects of management systems. So, we decided to put some of the more frequently asked questions to one of our lead consultants. Those questions and his answers are being made available as a series of posts on management system FAQs. 

Alan Jones - is Qudos CEO. he has decades of experience as a management system consultant, helping hundreds of businesses to implement management systems and achieve certification to various standards including ISO9001, ISO27001, ISO14001, and ISO45001. He has conducted certification audits against multiple standards, personally trained over 1,000 internal auditors, is a well-established public-speaker, author, and broadcaster, and has played a major role in the continuing development of Qudos³ IMS software. 

In this post, the focus of our FAQs is on Management Review - a mandatory (but often misunderstood) requirement in all ISO certification standards.

FAQs:

What is the purpose of a management review and why is it so important in ISO standards?

The purpose of a management review is to ensure that the management system remains suitable, adequate, effective, and aligned with the organization’s strategic direction. That means verifying that the system is working and is helping the organization to achieve its goals.  In ISO's common clause structure for its management system standards, management review is part of clause 9 "Performance Evaluation".

Clause 9.1 is about ongoing monitoring, measurement, and evaluation. Clause 9.2 internal audits provides an independent layer of checking or verification. Clause 9.3 Management Review is almost the ultimate internal check. It's where top management take a step back and look at the overall system.

In terms of the PDCA cycle, management review is part of the Check phase and it could be argued that it also plays an important role in the Plan phase.

It's important in ISO standards because its one of those areas where top management are required to be involved and can help to ensure that the management system is part of the real business - not just an overlay.

How often must management reviews be conducted? Is once per year enough?

The ISO standards are generally not very prescriptive, and that also applies in the frequency of management reviews. They just require the reviews to take place at "planned intervals". So, once per year is generally considered to be enough by most auditors. There are a few caveats to that. There must be at least one management review conducted before any initial certification audit. Secondly, to use an old Aussie expression, a year is "a long time between drinks", and my general suggestion is that 6-monthly is a more suitable frequency for most organizations.

What are the required inputs?

The required inputs vary a little in different standards, but they generally include:

• Consider actions from previous management reviews
• Changes in context that may affect the management system
• Information on performance (internal audit results, progress on objectives, nonconformities etc.)
• Resources
• Actions taken on risks / opportunities
• Opportunities for improvement

There may be some variation across the standards. For example, in a Quality system, the review would include indicators of customer satisfaction; In an information security system, penetration tests or vulnerability assessments may be included.

Can one management review cover multiple standards (e.g. ISO 9001 + ISO 27001)?

What are the required outputs?

The required outputs are the decisions taken or actions agreed to. If the review is in the form of a meeting (which is typical), the outputs are usually documented as action points. Ideally, they should be assigned to someone add have a target date.

Who should participate in a management review?

The standards simply refer to top management. That is the top echelon of management in an organization. They may be titled General Manager, Managing Director, or the C-Suite (CEO, CFO, CIO etc.). That's not necessarily all of them being involved, but relevant ones. Participation in the management review also helps to demonstrate top management's leadership of, and commitment to the system.

Usually, the person responsible for running and reporting on the management system will also be there. They are typically the person who organises the review and prepares much of the information to be reviewed.

Qudos Management Pty Ltd.
May 2026