Management review ISO 9001: the management review

The management review is a mandatory meeting in which top management periodically evaluates the quality management system. Clause 9.3 of ISO 9001 sets firm requirements for what must be discussed (input) and which decisions must come out of it (output). An accredited certification body routinely asks for the minutes. On this page, you find a practical explanation of the requirements, an example agenda and common mistakes. The results of the internal audit are mandatory input for this meeting.

The management review is not a formality. The external auditor reads the minutes and checks whether top management is genuinely involved: are concrete decisions made, and are they carried out later?

Required input for the management review

The standard prescribes which topics must be covered at a minimum. You may discuss more, but you cannot shorten this list.

Mandatory topic	Explanation
Status of actions from the previous management review	Have decisions made earlier been carried out?
Changes in internal and external issues	New legislation, market changes, organisational changes
Information on performance and effectiveness	Client satisfaction, nonconformities, quality objectives, supplier performance
Adequacy of resources	Does the team have enough people, time and budget?
Effectiveness of actions taken on risks and opportunities	Are the measures you have taken working?
Opportunities for improvement	Which improvements are possible?

Under “information on performance”, this concretely includes:

Results of internal audits
Client satisfaction measurements and complaints
Process results (KPIs, lead times, error rates)
Conformity of products and services
Performance of external suppliers
Status of corrective actions

Required output of the management review

The management review must produce decisions in three areas:

Required output	Example
Opportunities for improvement	”We are starting a project to shorten complaint handling from ten to five days.”
Changes to the quality management system	”We are adding a check step before handover.”
Resources needed	”We are making budget available to train two new employees.”

You record all these decisions in the minutes, including who is responsible and when it must be ready. At the next audit, the auditor checks whether the decisions have also been carried out.

Example agenda for the management review ISO 9001

A management review does not have to take half a day. For an SME, it fits in two hours if you are well prepared. Below is a workable structure:

#	Agenda item	Content	Time
1	Opening	Purpose, attendees, agenda	5 min
2	Follow-up on previous decisions	Status of actions from the previous review	15 min
3	Context and changes	What has changed internally and externally?	10 min
4	Performance	KPIs, client satisfaction, complaints, suppliers	30 min
5	Audit results	Findings of the internal audit and the external audit	15 min
6	Risks and opportunities	Are the measures effective? New risks?	15 min
7	Quality objectives	Achieved? New objectives?	15 min
8	Resources	Are there bottlenecks in capacity, budget or knowledge?	10 min
9	Decisions and improvement opportunities	What will we do, who, when?	15 min
10	Closing	Date of the next review	5 min

Total: about 135 minutes

Make a short summary of each item in the minutes. The decisions under item 9 are the most critical: they are the first thing checked at the next external audit.

How often must the management review take place?

The standard says “at planned intervals”. In practice, this means at least once a year. Most organisations link it to the annual cycle of the surveillance audit.

More frequent reviews are needed when:

A major nonconformity is found during the external audit
The organisation changes significantly (merger, new product line, location)
KPIs consistently lag behind the objectives
Complaints increase sharply

Plan the management review at least four weeks before your surveillance audit. That way the minutes are fresh and actions have recently started. A management review from eleven months ago raises the question of whether top management is still involved.

Common mistakes in the management review ISO 9001

Mistake	Consequence at the audit
The minutes are a tick-box exercise with no real content	Auditor sees that no analysis was done
Decisions are never followed up	The action list keeps growing but never gets shorter
Top management is absent, only the quality manager attends	The standard requires involvement of top management, not the quality manager alone
Client satisfaction is not discussed	Required input is missing; this leads to a finding
The management review is missed or held too late	Record missing; major nonconformity possible
No decisions on resources	Output is incomplete

A management review that produces no decisions is a sign that the system is not alive. The auditor will then ask: “What did this review deliver?” If the answer is vague, an observation or a nonconformity follows.

Relationship with other mandatory activities

The management review is the link between the various mandatory activities:

The results of internal audits form input
Progress on quality objectives is discussed
Conclusions about nonconformities come from the page nonconformities and improvement
The decisions affect the maintenance cycle after certification

Next step

After the management review, translate the decisions into concrete quality objectives or follow up open actions through the nonconformity and improvement system. See also the requirements of ISO 9001 for the context of clause 9.3 within the full structure of the standard.

Sources

NEN-EN-ISO 9001:2015, clause 9.3 - Management review
ISO.org - ISO 9001
RvA - Dutch Accreditation Council