A management review agenda that actually makes decisions

The management review is the clause 9.3 input that certification auditors most reliably find deficient. Not because companies skip it - most companies conduct a management review of some kind before their Stage 2 - but because the meeting produces a document and not a decision. The minutes record what was discussed. They do not record what was decided, who will do it, or by when.

A certification auditor reviewing your management review records is not looking for proof that management gathered in a room. They are looking for evidence that top management is actively governing the ISMS. The difference between a governance document and a meeting minutes document is whether it contains real decisions: accepted risks, rejected proposals, committed resources, and explicit changes to scope or objectives.

This post gives you a concrete agenda structure and explains what auditors look for in the record of each input. The examples use ISO 27001, but clause 9.3 sits in the same place in ISO 9001 and ISO 42001, so the agenda carries over to any management system - or to one integrated review covering several.

What ISO 27001 clause 9.3 actually requires

Clause 9.3 specifies a list of required inputs to the management review. These are not optional agenda items. If your management review record does not address each one, you have a gap that will likely surface as a finding.

The required inputs are: the status of actions from previous reviews; changes in external and internal issues relevant to the ISMS; feedback on information security performance (including nonconformities and corrective actions, monitoring and measurement results, audit results, and fulfilment of information security objectives); feedback from interested parties; results of risk assessment and status of the risk treatment plan; and opportunities for continual improvement.

The required outputs - meaning the decisions the review must produce - are decisions and actions related to continual improvement opportunities, and any changes needed to the ISMS.

The standard does not specify frequency, but most certification bodies expect at least an annual review, and for active programmes, semi-annual reviews are more defensible.

Why most reviews decide nothing

When the inputs are covered but no decisions follow, the cause is usually one of four things:

• The wrong people are in the room. If nobody present can allocate budget or reassign people, the meeting can only note issues. The standard says top management for a reason.
• Information arrives without a decision attached. "42 open vulnerabilities" is a status update. "Six critical vulnerabilities past their deadline because we lack coverage, and here is the proposed fix" asks for a decision.
• There is no follow-through. Decisions are made, nobody owns them, and the same issues return at the next review.
• The cadence is wrong. Monthly reviews turn into status meetings with nothing new to decide; annual-only reviews are too coarse to steer anything. Many organisations of 50 to 250 people settle on quarterly or twice-yearly reviews.

The common thread: the review is being run as communication rather than governance.

An agenda that generates decisions

The following structure works for a 90-minute management review. It is long enough to be substantive, short enough to hold management attention, and structured to force real decisions at each stage.

Opening (5 minutes): State the purpose, attendees, and scope of the ISMS under review. This is administrative but it belongs in the record.

Previous actions (10 minutes): Review the action log from the previous management review. For each action: is it complete, in progress with a revised target date, or overdue? Each overdue item needs a named owner and a new commitment. This section should be uncomfortable if actions are slipping - that discomfort is the governance mechanism working.

ISMS performance (30 minutes): This is the largest section and the one where most management reviews produce noise instead of signal. Cover: nonconformities raised since the last review and their status; corrective actions and whether root causes were addressed; internal audit findings and their status; security incidents - count, type, severity, and whether they triggered any control changes; metrics against your information security objectives; and monitoring results that indicate whether key controls are functioning.

The goal of this section is not to recite the numbers. It is to surface whether the ISMS is working and where it is not. If your incident count went up, why? If a corrective action has been open for nine months, why has it not been closed?

Risk register review (15 minutes): Walk through the risk register at the level of the highest-rated risks. Have any risks changed since the last review? Have new risks emerged? Are any risks at levels the organisation has not formally accepted? This section must produce at least one explicit decision: risks are accepted as documented, or specific risks require further treatment before the next review.

The risk acceptance decision is one of the outputs auditors look for most carefully. Risk acceptance is a top-management function. If the risk register has risks rated "high" or "critical" and the management review record does not address them, a certification auditor will ask who accepted those risks and when. The answer must be traceable to a decision in a management review record.

Changes to context and scope (10 minutes): Have there been significant changes to the business that affect ISMS scope? New products, new markets, new data categories, acquisitions, significant supplier changes, or regulatory changes all potentially affect scope. If scope has changed, the management review record should document that the change was considered and either incorporated or explicitly deferred.

Resource and objective review (10 minutes): Are the current information security objectives still appropriate? Are resources adequate to achieve them? This is where budget and staffing decisions belong. If the security team needs additional resource and management is not providing it, that decision - and its rationale - should be in the record. An undocumented decision to defer resource is a governance gap. A documented decision to defer resource with a rationale is management judgement.

Improvement decisions (10 minutes): What will be done differently before the next review? This section must produce named actions with owners and dates. It should not produce aspirations. "We will improve our incident response process" is an aspiration. "We will revise the incident response procedure to include a 24-hour containment step, owned by [name], completed by [date]" is an action.

What goes in the record

The management review record is not the slides. It is not a summary email. It is a formal record that demonstrates clause 9.3 compliance and provides the basis for the next review's opening section.

The record should include: date, attendees and their roles, agenda items addressed, the inputs that were reviewed and the key findings for each, decisions made (including risk acceptance decisions), actions with owners and target dates, and any changes to the ISMS or its objectives.

Brevity is fine. A two-page record that contains real decisions is more valuable than a twenty-page record that describes discussions without decisions. Auditors are reading for decisions, not for detail.

Making the decisions stick

The value of a review is realised between reviews. A few habits make sure decisions are executed:

• Keep decisions in one tracked list with an owner and a due date, not buried in minutes.
• Give one person responsibility for chasing actions between reviews.
• Open every review with the previous review's actions, and treat "not done" as a decision point rather than a deferral.
• Record a conscious decision to accept the status quo when an item needs no change. That is a valid, auditable output too.

What auditors find when the record is weak

The patterns that most often lead to findings on management review records:

The record describes inputs but records no decisions. The risk section notes that risks were discussed. It does not state what decisions were made about specific risks.

Actions from the previous review were not followed up. The current review record does not reference the previous review's action log. There is no continuity.

Top management was not present. ISO 27001 is explicit that this is a top-management responsibility. A management review conducted entirely by the security lead, without senior leadership participation, does not satisfy clause 5.1 (leadership and commitment) or clause 9.3.

The review happened once, immediately before the Stage 2 audit. This suggests the review was conducted to satisfy an audit requirement rather than as a genuine governance mechanism. Certification auditors are experienced at identifying this pattern, and it often leads to additional scrutiny of whether the ISMS is genuinely embedded.

A practical point on timing

Plan the management review far enough before your Stage 2 that any actions it generates can begin before the auditor visits. A review conducted three weeks before a Stage 2 and producing actions due in six months does not demonstrate that management is actively governing the ISMS. A review conducted three months before the Stage 2, producing actions that are already in progress at the time of the audit, demonstrates exactly that.

Preparing management review inputs and tracking the resulting actions is part of Managed ISMS and the other managed system services; the decisions themselves stay with your top management.