ISO/IEC 27001 management review: the inputs, the outputs, the record, and how to run it without a ceremony

What clause 9.3 requires of top management

Management review is where the people who run the organisation, not the security team, judge what the ISMS has delivered and decide what changes. ISO/IEC 27001:2022 places it in clause 9, Performance evaluation, in three parts: 9.3.1 General, 9.3.2 Management review inputs and 9.3.3 Management review results. Top management reviews the ISMS at planned intervals to confirm it remains suitable, adequate and effective. We paraphrase below; the standard's text governs.

The inputs, by topic

• whether actions from earlier reviews were completed;
• changes in the internal and external issues affecting the ISMS;
• changes in interested parties' needs and expectations, added in 2022;
• security performance, as trends in nonconformities and corrective actions, monitoring and measurement results, audit results and progress on objectives;
• what clients, regulators, staff and other interested parties are saying;
• risk assessment results and progress on the treatment plan;
• opportunities to improve.

The climate change question added by Amendment 1:2024 is best revisited under the second item.

The outputs

The 2022 edition calls them results and the 2013 edition called them outputs, but the substance is unchanged: decisions about where to improve and about any changes the ISMS needs, evidenced by documented information. Resources are not listed separately; funding a treatment or a role is a change to the ISMS, and clause 5 already makes resources top management's responsibility.

How often to hold it, and who must attend

The standard leaves the interval to you, so the first evidence is a plan: dates for the year, set in advance and kept. Annual can suit a small, stable scope, but most ISMSs change every quarter, so we recommend quarterly reviews plus an extra sitting after significant change, such as an acquisition or a serious breach.

Top management is the person or group that directs and controls the organisation, or the part the ISMS covers, at the highest level. The chief executive or managing director chairs, with the leaders who own the services in scope; the ISMS lead prepares the pack, and IT, HR, legal and the lead who answers client questionnaires join for their items. An IT steering group can prepare the review but cannot replace top management.

One 90-minute meeting a quarter: a sample agenda

A yearly review drifts into ceremony: a long deck built for the auditor. Instead, keep the inputs in the same order every quarter, send a pack of one page per item a week ahead, show trends, and ask each presenter for a proposal.

Once a year, also confirm that the scope and policy still fit, set objectives and agree the audit programme. Running ISO 22301 or ISO/IEC 27701 too? One review can cover each standard's inputs; see our integration guide.

How the review connects to the risk assessment and the Statement of Applicability

The risk input turns a performance report into governance. Clause 8.2 requires risk assessments at planned intervals and on significant change, and refreshing the register before each review keeps the figures current. Under clause 6.1.3, risk owners approve the treatment plan and accept residual risk; the review should see what they accepted, challenge anything above the criteria and decide when the criteria must change. Decisions then flow back into the risk documents, where auditors look for them.

Our risk assessment and treatment guide and Statement of Applicability guide cover the method itself.

The record auditors ask for

Clause 9.3.3 requires documented information as evidence of the results. That means minutes, backed by the pack they cite, showing:

• the date, with top management present rather than represented;
• every input addressed, citing the data or document version, even where nothing changed;
• decisions worded as decisions, under improvement and changes to the ISMS;
• an owner and a due date for each action, and the status of the last review's actions.

Auditors then trace a decision, such as a funded treatment, into the plan and the working control, and ask the chief executive what the last review decided; a clear answer without notes is strong evidence. Under ISO/IEC 17021-1, Stage 1 checks that reviews are planned and performed and every surveillance audit covers management review; our Stage 1 and Stage 2 guide explains the sampling.

What a weak management review looks like

In our gap analyses, weak reviews usually share one cause: the ISMS is treated as IT's system, so the review becomes an IT meeting with a leader's signature added later.

• The security team reviewing itself. The ISMS lead and IT staff meet; the managing director signs a week later. To an auditor, top management reviewed nothing.
• Risk mentioned, not reviewed. The minutes say "risks discussed", with no register version, late treatment or accepted residual risk on record.
• A 2013 agenda. Old templates omit changes in interested parties' needs, so new contract clauses and regulator expectations never reach leadership.
• Counts without trends. Thirty-eight incidents, with no comparison, cause or decision, tell leadership nothing.
• Actions that never close. The same item carried forward, review after review, without a new date or escalation.
• One staged review. A single meeting just before Stage 1, and none after certification, reads as a system built for the certificate.

How Effivity records the review

In Effivity's Management Review module you set the agenda or use Effivity's suggested one, attendees are e-mailed automatically, minutes sit against each agenda point and decisions become action plans, so next quarter's status comes from the same record. Presenters draw on modules such as Risk Management, Statement of Applicability, Incident Management and Internal Audit. Effivity is included with the engagement, at no additional cost, and is used in 50+ countries; see the Effivity guide.

ISO/IEC 27001 management review: questions buyers ask