Management review ISO 27001 with example agenda
A management review is the moment when management formally goes through the ISMS and decides what must change. ISO 27001 requires this in clause 9.3, at planned intervals. It links to the internal audit and to the ISMS as a whole. The standard provides a fixed list of topics you must discuss and records that the outcome is decisions and evidence. Without minutes that record decisions, the review does not count for the auditor.
What does clause 9.3 require?
The management board discusses the ISMS on the basis of fixed inputs. In essence, those inputs are:
- the status of actions from the previous management review
- changes in internal and external issues that are relevant to the ISMS
- changes in the needs and expectations of interested parties, such as customers and supervisory authorities
- feedback on information security, including trends in nonconformities and corrective actions, monitoring results, audit results and the extent to which objectives have been met
- feedback from interested parties
- the results of the risk assessment and the status of the risk treatment plan
- opportunities for continual improvement
The outcome (the output) consists of decisions on opportunities for improvement and on changes to the ISMS, such as budget, staffing or a different policy. You also keep documentation as evidence. This list follows clauses 9.3.2 and 9.3.3 of the 2022 version. Check the exact wording in your own copy of the standard.
The standard does not prescribe a fixed frequency. Once a year is common and fits with the internal audit. Make sure the management review takes place before the certification audit.
Example agenda
Below is an agenda for a medium-sized IT company, “Example BV”, a fictional company. The times are indicative.
| Time | Topic | Input from clause 9.3 | Evidence you bring |
|---|---|---|---|
| 10 min | Opening and purpose of the review | None, fixed agenda item | Approved agenda |
| 15 min | Follow-up on the previous review | Status of earlier actions | Action list with status |
| 20 min | Changes in context and customer requirements | Internal and external issues, interested parties | Overview of new customer requirements and legislation |
| 25 min | Information security performance | Nonconformities, audit results, KPIs | Nonconformity register, internal audit report |
| 15 min | Objectives | Extent to which they are achieved | Overview of objectives (objectives) |
| 20 min | Risks and risk treatment | Risk register and status of the treatment plan | Current risk analysis |
| 15 min | Improvement opportunities and decisions | Output: decisions | Proposals with costs and owner |
| 10 min | Closing and agreements | Recording decisions | Signed minutes |
Example minutes
Minutes do not need to be long. They do need to show that decisions were made. An extract:
Decision 2026-03: The nonconformity register shows four open points, two of which are more than 60 days old. Management decides: each nonconformity receives an owner and an end date before 15 December. Owner: operations manager. Evidence: updated register on 1 December.
Decision 2026-04: The budget for the 2027 penetration test is increased from €6,000 to €9,000, based on the October risk analysis.
Note the structure: each decision has an owner, a deadline and a reference to evidence. That is what the auditor looks for.
What does the auditor want to see?
The external auditor asks for the minutes of the last management review and wants to know whether management was really involved. They check whether the agenda matches the inputs of the standard, whether decisions were taken, and whether they were followed up. See also the audit questions and checklist for the questions per role. See the audit process for the full route to certification.
Common mistakes
- A pro forma meeting. Minutes that only say “discussed, no comments” show that management was not involved.
- No decisions. A review without output is not a review.
- Missing inputs. For example, the agenda does not cover risks, while the standard lists them as an input.
- Too late. A review held the week before the audit is seen as a reaction to the audit, not as part of the system.
- Confusion with the ISO 9001 review. If you hold both standards, you can run one meeting that covers both. See management review under ISO 9001 for the quality version.
How do you prepare the review?
- Collect the inputs for the whole previous period: audit report, nonconformities, KPIs, risk register.
- Set the agenda in the order of the table above. Send it at least one week in advance.
- Make sure the management board knows the documents. A two-page management summary works better than a pile of appendices.
- Record the decisions during the meeting itself. Repeat them at the end.
- Circulate the minutes within a few days and add the actions to your action list.
The step-by-step plan shows where the management review fits in the sequence of the process.
Template: decision log
Alongside the minutes, keep one decision log. It is the working document for the coming period, and the auditor often asks for it.
| Decision | Justification | Owner | Deadline | Evidence of implementation | Status |
|---|---|---|---|---|---|
| Penetration test budget increased to €9,000 | October risk analysis, high risk on the web application | Operations manager | 31 March 2027 | Quote and report | Open |
| Nonconformities get a fixed owner and end date | Four open nonconformities, two older than 60 days | Security officer | 15 December 2026 | Updated register | Closed |
| Scope extended to the new customer portal | New service, customer data is processed | Management board | 1 June 2027 | Amended scope document | Open |
A decision that is not in the list does not exist for the auditor. Update the status at every management meeting, and the list is immediately usable as input for the next management review.
Why this is part of the ISMS
The management review is where the ISMS reaches the top of the organisation. Without that link, it remains a collection of documents held by the security officer. With a good review, the ISMS gets money, time and authority. That is also what the standard means by leadership in clause 5.
Frequently asked questions
May the security officer chair the management review? The management board must attend and take the decisions. The chair can be someone else, as long as the management board is demonstrably involved.
Does a small company need a management review? Yes, but it can be brief. One hour with a one-page agenda and two decisions is enough.
What if there is nothing to decide? Record that too, with the justification. “No changes, risks have been assessed and remain acceptable” is a valid decision.
More information
- Standard: NEN-EN-ISO/IEC 27001 (Dutch publication)
- Internal: internal audit, internal audit report, the ISMS explained