The management review is the one point in the ISMS where top management is required to look at the whole system and make decisions about it. In many organizations it is a slide deck the security lead presents once a year to whichever executives are free, with minutes that say "ISMS reviewed, no changes".
Certification auditors read those minutes closely. A management review that records no decisions, or that top management did not attend, is evidence that leadership is not directing the ISMS, which clause 5 requires them to do. It is also a missed opportunity: the review is the cheapest place to get decisions on budget, risk acceptance, and priorities on the record.
This article covers what clause 9.3 of ISO/IEC 27001:2022 requires, who needs to be involved, how to prepare each required input, and what a useful record looks like.
What clause 9.3 requires
Clause 9.3 has three parts.
9.3.1 General. Top management must review the ISMS at planned intervals to ensure its continuing suitability, adequacy, and effectiveness.
9.3.2 Management review inputs. The review must include consideration of:
The status of actions from previous management reviews
Changes in external and internal issues relevant to the ISMS
Changes in needs and expectations of interested parties relevant to the ISMS
Feedback on information security performance, including trends in nonconformities and corrective actions, monitoring and measurement results, audit results, and fulfillment of information security objectives
Feedback from interested parties
Results of risk assessment and status of the risk treatment plan
Opportunities for continual improvement
9.3.3 Management review results. The results must include decisions related to continual improvement opportunities and any needs for changes to the ISMS. Documented information must be available as evidence of the results.
The structure is useful because it is specific. Every input has a source in the ISMS, and the output must be decisions, not a summary of the inputs.
Who has to be there
The review is carried out by top management. ISO/IEC 27000 defines top management as the person or group of people who directs and controls an organization at the highest level. In a small company, that is usually the chief executive and the leadership team. In a larger one, it may be an executive committee or a designated group with real authority over the scope.
What matters is that the people in the review can make the decisions it requires: approving resources, accepting residual risk, changing scope, or redirecting priorities. A review attended only by the security team and one delegated manager cannot show that top management reviewed anything.
The security lead usually prepares and presents the inputs. That is fine, and expected. The decisions belong to leadership.
Preparing the inputs
Each input should already exist somewhere in the ISMS. Preparing the review is mainly a matter of collecting and summarizing them, which is why a review that takes weeks to prepare suggests the underlying records are not being kept.
| Input | Where it comes from | What to present |
|---|---|---|
| Actions from previous reviews | Last review's record | Each action, owner, status, and any that slipped |
| Changes in issues | Clause 4.1 register | What changed since the last review, and why it matters |
| Changes in interested party needs | Clause 4.2 register | New contracts, laws, or customer demands with security terms |
| Performance feedback | Corrective action log, metrics, audit reports, objectives tracker | Trends, not raw lists: are things improving or not |
| Interested party feedback | Customer reviews, complaints, questionnaire themes | Recurring concerns from customers, staff, or suppliers |
| Risk results and treatment status | Risk register, risk treatment plan | Material changes in risk, overdue treatments, residual risks needing acceptance |
| Improvement opportunities | Internal audit, incidents, staff suggestions | Specific proposals, each with what it would need |
The word "trends" in the fourth input is easy to skip. A list of this year's nonconformities is not a trend. Compare with the previous period: are findings in the same areas recurring, are corrective actions closing on time, are objectives moving in the right direction. Trends are what let leadership decide whether the ISMS is working.
The clause 4 article covers how to keep the issues and interested party registers in a shape that makes the second and third inputs quick to prepare.
Running the review
Hold it as a meeting with a fixed agenda that follows the seven inputs, in the order the standard lists them. That makes the record easy to check against clause 9.3.2, for you and for your auditor.
Send the input pack in advance. A review where executives see the material for the first time in the meeting tends to produce acknowledgment rather than decisions.
For each input, the question to put to the room is "what do we decide?" Many inputs will need no change, and saying so explicitly is a decision. Others will need one of a small number of outcomes:
Approve a resource, such as budget, headcount, or a tool
Accept a residual risk, or refuse to accept it and require further treatment
Change the ISMS scope, policy, or objectives
Assign an improvement action with an owner and a date
Escalate an issue outside the ISMS, such as a contractual dispute
Frequency is "planned intervals", which the standard does not define. Once a year is common for small organizations, timed after the internal audit and before the surveillance audit so its results are inputs. Organizations with faster change, or a large number of open risks, often review more frequently. Whatever interval you choose, write it down and meet it.
What the record needs to show
The documented information required by 9.3.3 is evidence of the results. In practice, a record that survives an audit shows:
- Not done:
The date, and the names and roles of those present
- Not done:
Each of the seven inputs, with what was presented or a reference to it
- Not done:
The decisions made, stated as decisions
- Not done:
Actions, each with an owner and a due date
- Not done:
Any residual risks accepted, by whom
- Not done:
Any changes to the ISMS approved, such as scope, policy, or objectives
- Not done:
The input pack, retained alongside the minutes
The next review's first input is the status of these actions. A chain of reviews where actions are tracked from one to the next is strong evidence of a management system that runs. A review whose actions never reappear is the opposite.
Common failures
These are the patterns that turn a management review into a finding.
Wrong attendees. Top management absent, with no record of their involvement in the decisions.
Missing inputs. The agenda covers performance and risk but skips changes in context or interested party feedback.
No decisions. Minutes that summarize the inputs and stop.
No continuity. Actions from the last review not followed up.
Bad timing. A review held before the internal audit, so its results could not be considered, or held the day before the surveillance audit with no time to act.
The review depends on inputs from the rest of the ISMS. The internal audit article covers the audit results that feed it, and the clause 6 article covers the risk results. Both are examined at every surveillance audit, alongside the review itself. For the standard as a whole, see the ISO 27001 framework page.
How TrustLynce helps
TrustLynce produces the performance and risk inputs from the records you already keep. The readiness dashboard gives per-framework status and executive reports, and the risk register shows treatment status and residual risks awaiting acceptance.