ISO 27001 clause 9.3.3: Management-review decisions and results
ISO 27001 clause 9.3.3 requires management-review results to include decisions about continual improvement opportunities and any need for ISMS changes. Documented information must be available as evidence of the review results. The record should explain management’s conclusions, not merely prove that people attended a meeting.
What clause 9.3.3 requires in practice
Clause 9.3.3 deals with what the management review produces. Its results must include two kinds of decision: decisions about opportunities for continual improvement, and decisions about any need to change the ISMS. This makes the review an instrument of direction, not an information session. Documented information must be available as evidence of the results.
In practice, the outputs may include changes to objectives, additional resources, new or altered controls, a revised scope or priorities for the audit programme. A decision that no change is needed is also a result, provided it was made consciously with reasons. The clause does not prescribe minutes in a certain style, only that evidence of the results exists. The records should let a reader see what was decided, who owns each action and when it is to be reported back, so that the next review can begin with a check on delivery.
Record a decision, not only a discussion
“Risk report reviewed” gives little indication of what management concluded. A useful result explains whether action is needed, what direction was agreed and why. Where an existing arrangement remains suitable, record a meaningful conclusion supported by the review rather than inventing change for its own sake.
Decisions may concern priorities, process changes, responsibilities, resources or further evaluation. The exact result depends on the evidence. Clause 9.3.3 does not require every review to approve a new technology or produce a fixed number of improvement projects.
Make follow-through workable
For decisions requiring action, identify practical ownership, expected timing and how completion or effectiveness will be checked. These are useful implementation arrangements; the clause does not prescribe a particular action-log template. Connect the action with the process that will carry it out rather than leaving it only in meeting minutes.
If a decision changes scope, risk criteria or governance, use appropriate planning under clause 6.3. If it addresses a nonconformity, connect it to the corrective-action process. If further information is needed before a decision, make that dependency explicit rather than recording an unsupported assurance.
Consider what must be communicated to affected teams and interested parties. A management decision is not operationally effective if the responsible people learn about it only during the next audit. Protect sensitive review information while making the relevant actions available to those who need them.
Why management-review decisions matters to the business
The value of a review lies in what changes because of it. Decisions allocate budget, resolve disputes about priorities and give staff the mandate to act, which is hard to obtain elsewhere. A clear record shows customers and assessors that leadership steers the ISMS and that issues raised in audits and incidents lead to action. It also protects staff, who can point to an agreed direction when asked to take on a security task that competes with other work. When results are vague, nothing follows and the same issues reappear at each review, wearing down credibility and morale.
How to implement clause 9.3.3
Good results come from asking for decisions rather than comments. A practical way of doing so is below. Keep the record short and specific, since a clear list of decisions is more useful and more convincing than lengthy minutes of the discussion. Tie each decision to the input that prompted it, so cause and response stay visible together.
- Prepare each agenda item with a proposal that leaders can accept, amend or reject.
- Capture decisions in plain words during the meeting, reading them back before moving on.
- Assign each decision to a named owner with a date to report progress.
- Separate improvement decisions from changes to the ISMS, so that scope, objective, resource or control changes are visible.
- Record the reasons when leaders decide not to act, including risks accepted.
- Issue the record to those affected soon after the meeting, and store it under document control.
- Open the next review by checking each decision against what was delivered.
Illustrative examples
Review inputs show that important treatment actions are delayed because a specialist role is overloaded. Management agrees a revised allocation of work and suitable support, identifies the accountable owner and sets a follow-up check on delivery. The record connects the resource decision with the risk it is intended to address.
One site’s audit and performance results reveal inconsistent supplier-access reviews. Management decides to revise the shared process and verify application at the other relevant sites. The result identifies the scope of the change and expected evidence, rather than simply stating that the local finding should be closed.
Evidence and traceability
Minutes, a controlled decision record or another suitable form can provide documented results. Retain enough context to identify the review and understand conclusions, decisions and follow-up. A signed attendance list alone does not capture results.
At the next review, compare agreed actions with what happened. Check whether the original issue was addressed and whether unexpected consequences emerged. This connects previous-action status with continual improvement. The record should make it possible to follow that cycle without depending on one person’s memory.
Common mistakes
Watch for repeated “noted” entries, actions with no practical owner, or records written after the fact to match what an auditor is expected to want. Another problem is recording a broad conclusion that the ISMS is effective without explaining the basis when material issues remain unresolved.
A defensible review can recognise strengths and unresolved weaknesses at the same time. The aim is an accurate management judgement and useful direction. Sterling can help prepare the evidence and facilitate a disciplined process, while management retains responsibility for its decisions.
Frequently asked questions
Must management-review minutes be signed on paper?
No specific paper-signature format is prescribed. Use controlled documented information that reliably records the review results and relevant decisions.
Do we have to change the ISMS after every review?
Not necessarily. Consider improvement opportunities and change needs, and record a defensible conclusion. Do not manufacture changes simply to fill an action list.
Can an action log replace the review results?
It may form part of the record, but it should capture or link to the actual review conclusions and decisions, including relevant reasoning and context.
Make review decisions lead to action
Talk to Sterling to translate management-review conclusions into documented decisions on improvement and necessary ISMS changes, with clear responsibility for follow-through. Build the relevant knowledge through KPIs, Objectives & Management Review at Sterling Academy. We can also assess whether Effivity ISO & GRC automation software suits the agreed workflow and programme. Certification decisions remain with an independent certification body.