ISO 27001 clause 9.3.2: Management-review inputs
ISO 27001 clause 9.3.2 sets the information to consider during management review. Its practical purpose is to give leaders a rounded view of the ISMS: what changed, what previous decisions achieved, how performance is developing and where risk or improvement needs attention. A list of attachments is not the same as informed consideration.
What clause 9.3.2 requires in practice
Clause 9.3.2 lists what the management review must consider. There are seven groups of input.
- Progress on actions agreed at earlier reviews.
- Changes in external and internal issues relevant to the ISMS.
- Changes in the needs and expectations of interested parties.
- Feedback on security performance, including trends in nonconformities and corrective actions, monitoring and measurement results, audit results and achievement of objectives.
- Feedback from interested parties.
- Results of risk assessment and the status of the treatment plan.
- Opportunities for continual improvement.
The word consideration is important: each topic must actually be discussed, not just attached to a pack. The clause leaves format open, so a dashboard, a short paper or a structured discussion are all acceptable. The output is an informed leadership team, and the evidence is the material and the record of its discussion.
Connect previous decisions with current conditions
Begin with actions from earlier management reviews. Explain what has been completed, what remains unresolved and whether the intended effect is visible. An action can be administratively closed while its original problem persists; management needs that distinction.
Consider changes in relevant internal and external issues and in the needs and expectations of interested parties. A significant new customer commitment, supplier dependency or operating model can affect the system even when performance indicators have not yet changed. Relate the information to the actual scope rather than presenting generic market news.
Evaluate performance as a pattern
Review relevant trends in nonconformities and corrective actions, monitoring and measurement, audits and fulfilment of objectives. Connect the sources. An audit finding can explain an unreliable metric; a recurring incident pattern can challenge an apparently successful objective. Differences deserve examination rather than selective reporting of the most favourable figure.
Include relevant feedback from interested parties, risk-assessment results, treatment-plan status and opportunities for continual improvement. These inputs help management understand both present performance and developing exposure. A treatment plan with overdue dependencies may require action before a performance indicator deteriorates.
Present limitations openly. If data coverage is incomplete, explain what is missing and how that affects confidence. Do not turn an unknown into a green result. The standard does not prescribe a presentation template or require every input to have identical volume.
Why management-review inputs matters to the business
The listed inputs make sure leaders see the whole picture and not just whichever issue is most urgent. Trends matter in particular, because a single quarter of incidents says little while a steady rise in a particular nonconformity points to a systemic cause. Customer and partner feedback often reveals expectations that internal metrics miss. Reviewing risk results and treatment status stops treatment plans from drifting out of sight. Missing inputs are among the most frequent findings in external assessments, and they matter because the missing topic is often the one where a problem is developing. A complete input set gives decisions a firm factual basis.
How to implement clause 9.3.2
Treat the inputs as a standing agenda with a named supplier for each item. A workable method follows. Aim for a pack that a senior leader can read quickly, opening with trends and exceptions rather than long tables of raw data.
- Convert the list of inputs into a template page with a space for data, a trend and a short comment on each.
- Name an owner for each input who will provide it by a set date before the review.
- Pull actions from the last review forward with their status, flagging overdue items accurately.
- Summarise changes in context and in interested parties' needs, such as new customer contracts or new regulations.
- Show performance trends over several periods, combining nonconformity, measurement, audit and objective results.
- Include direct feedback from customers or other parties, with a view on what it means.
- Close the pack with risk results and a list of improvement opportunities proposed for decision.
Illustrative examples
Internal reports show high completion of required reviews, but a customer raises repeated concerns about delayed exception decisions. The review examines the mismatch, checks whether the metric covers decision quality and identifies an ownership bottleneck. Management can then improve the process instead of dismissing the feedback because the dashboard is green.
New service integrations increase reliance on external providers. The risk report identifies changed dependencies, the audit report shows incomplete supplier evidence and the treatment plan contains delayed actions. Presenting those inputs together helps management decide priorities and resources rather than treating each report as an unrelated agenda item.
Common mistakes
Avoid copying last year’s pack with updated dates, reporting counts without trends or context, and describing every improvement idea as a corrective action. Another weakness is omitting changes because they belong to a commercial function rather than IT.
Follow the review through to results and decisions. Gathering inputs should support a judgement on suitability, adequacy and effectiveness under clause 9.3.1, not become an end in itself.
Bring management evidence that explains performance
Talk to Sterling to assemble the required review inputs into a clear account of change, results, risk and opportunities, rather than an unexamined dashboard. Build the relevant knowledge through KPIs, Objectives & Management Review at Sterling Academy. Certification decisions remain with an independent certification body.
Frequently asked questions
Do we need a separate report for every input category?
No specific report format is required. Existing information can be combined, provided management can meaningfully consider the required input areas.
Should unfavourable or incomplete data be included?
Yes, where relevant. Explain limitations and adverse results so management can judge the system and decide action; incomplete coverage should not be presented as confirmed success.
Why review previous actions if they are marked closed?
Closure does not necessarily show the intended result was achieved. Consider effectiveness and unresolved consequences, not only the administrative status.
Prepare information for decisions
Use a concise explanation of significance, supporting evidence and any decision needed. A large technical report can be linked for detail while the review pack highlights the issue management must understand. Ensure the summary does not omit material uncertainty or adverse results.
The input process can use existing reports and records. Clause 9.3.2 does not demand a separate spreadsheet for each category. However, the organisation should be able to show that all applicable input areas were considered. A review that discusses incidents but ignores objectives, interested parties and treatment status is incomplete.