Glossary · ISO and management systems
Management review is the meeting where leadership owns the results of the security programme.
A planned meeting in which top management examines how the management system is performing and records decisions on changes, resources and improvement.
Back to the glossary01 · In plain words
In plain words
A planned meeting in which top management examines how the management system is performing and records decisions on changes, resources and improvement.
Every so often, the people who run the company sit down and look at the security programme as a whole: audit results, incidents, risks, targets. That sitting is the management review. What matters is less the meeting itself than the decisions it leaves behind.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
Management systems standards, ISO 27001 among them under clause 9.3, expect leadership to review the system at planned intervals and to keep evidence of the outcome. An auditor reads the minutes to judge whether leadership actually steers security or simply signs what the security lead hands over. Thin minutes with no decisions are one of the quickest ways to draw a finding. For the business, a good review is the moment when budget, staffing and risk appetite get settled out loud, instead of drifting.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- Clause 9.3 of ISO 27001 (and the same clause in ISO 42001 and other management system standards)
- Sets out that leadership reviews the system and what the review should consider and produce, in the standard's own terms.
- The review minutes
- The record an auditor samples: date, attendees, inputs looked at, decisions and owners.
- The certification and surveillance audit plan
- Auditors usually ask to see the most recent review early in the visit.
- The board or leadership calendar
- Many companies attach the review to an existing quarterly or half-yearly leadership meeting.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a payments fintech in Mumbai, half-yearly review
The CEO, CTO, head of compliance and finance lead meet for ninety minutes. Inputs: two internal audit findings, one incident where a vendor leaked a test file, progress on security objectives, and a new RBI circular. Outputs: approve budget for a second security engineer, move vendor risk reviews from yearly to quarterly for payment partners, and accept one low risk with a written rationale. Each decision gets an owner and a date. Six months later, the next review opens by checking whether those actions closed.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Internal audit
- An internal audit tests whether the system works and reports findings. The management review receives those findings and decides what to do about them.
- A board meeting
- A board meeting can host the review, but a general board agenda with no look at security inputs and no recorded decisions does not count as one.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Fix a standing agenda that lists each input the standard expects, so nothing is skipped.
- Record decisions with an owner and a date, not just discussion.
- Open each review by checking the actions from the previous one.
- Keep the minutes with your ISMS records where an auditor can find them.
- GuideThe management reviewThe inputs and outputs the standard lists, and a workable agenda.
- GuideClause 9: performance evaluationMeasuring, auditing and reviewing the system.
Sources: ISO/IEC 27001:2022 clause 9.3 title and purpose (described in our own words, not quoted); the harmonized structure shared by ISO management system standards.
Questions about Management review
How often should a management review happen?
At planned intervals you set yourself.
The standard asks for planned intervals rather than a fixed frequency. Many organisations hold one at least once a year, commonly more often in the first year or after big changes. Whatever you choose, write it down and keep to it.
Who must attend?
Top management, with the people who run the system.
The review belongs to top management, the people who direct the organisation within the scope. The security lead usually prepares the inputs and attends, but a review attended only by the security team is hard to defend as leadership's review.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.