ISO 27001 Management Review: Decide What Changes Next
ISO 27001 clause 9.3 requires top management to review the ISMS at planned intervals for continuing suitability, adequacy and effectiveness. The review brings together required inputs and produces decisions about improvement opportunities and changes to the system. Its value lies in what management understands and decides, rather than the length of a presentation or the number of people attending.
What clause 9.3 requires in practice
Clause 9.3 makes top management responsible for periodically examining the ISMS to be sure it remains suitable, adequate and effective. The review has two defined sides. The inputs are a list of topics the review must consider: actions from earlier reviews, changes in internal and external issues, changes in needs of interested parties, feedback on performance (including trends in nonconformities, measurement results, audit results and achievement of objectives), feedback from interested parties, risk assessment results and treatment status, and opportunities for improvement. The results must include decisions on improvement opportunities and any need to change the system. Documented information must be kept as evidence of the results. The outputs are decisions with owners rather than minutes alone. The standard sets no meeting length, attendance list or frequency; it expects reviews at planned intervals and by top management.
9.3.1: plan review around the system's needs
The requirement specifies planned intervals; it does not prescribe one annual meeting format for every organisation. A review can use an appropriate arrangement, provided the required consideration and documented results are achieved. Routine security operations meetings may supply inputs without, by themselves, fulfilling management review.
Plan enough time for decisions about priorities, resources and change. A meeting that merely reads operational statistics may leave top management without a clear view of whether the system remains suited to its scope and business conditions.
9.3.2: assemble the required inputs
Inputs include the status of previous review actions, changes in relevant internal and external issues, and changes in interested-party needs and expectations relevant to the ISMS. Performance information includes trends in nonconformities and corrective actions, monitoring and measurement, audits and information security objectives. The review also considers interested-party feedback, risk assessment results, treatment-plan status and improvement opportunities.
Present trends with context. A higher number of reported concerns may reflect improved reporting, whereas fewer concerns may reflect a broken route for raising them. Explain material changes in measurement methods and populations so management can avoid comparing unlike figures.
Required inputs do not all need the same amount of presentation time. Highlight decisions required, significant uncertainty and changes affecting the system. Retain the underlying evidence so important claims can be examined.
Why management review matters to the business
Management review is where responsibility for security sits at the top of the business. Without it, issues surface only when something goes wrong, budgets lag behind risk and the ISMS slowly detaches from strategy. A real review gives leaders one place to see performance, make trade-offs and commit resources, and it creates a record that senior people were involved, which customers and assessors expect. It also converts audit results and incident trends into action. When the review is treated as a formality, with slides read aloud and no decisions, assessors notice quickly and the organisation loses its best opportunity to steer.
How to implement clause 9.3
A short, decision-focused review is more valuable than a long reading session. One practical approach is below. Plan the review as a leadership conversation about direction, with preparation done beforehand, so that the meeting itself is spent on choices and not on reading reports aloud. Invite challenge and record dissent. Keep attendance accurate.
- Set a regular review rhythm and put the dates in leaders' calendars well ahead.
- Name an owner to assemble the inputs, ensuring every required topic is covered with data and a short commentary.
- Circulate material in advance so meeting time is used for discussion and decisions.
- Have top management attend in person, including whoever controls budget and resources.
- Frame each topic as a question needing a decision, such as whether to fund a control or change an objective.
- Record decisions, owners and target dates, then publish them to those affected.
- Open the next review with progress on these actions.
Example: software expansion creates an unresolved dependency
A hypothetical software provider has expanded into round-the-clock customer support. Its previous risk treatment assumed that experienced administrators were available during office hours. New overnight personnel rely on a supplier for urgent recovery, but the agreement and escalation arrangements have not been revised.
Management review can connect the changed business context, risk assessment, treatment delay and customer feedback. A useful decision might assign responsibility for confirming the support model, approve necessary resources and set a route for evaluating the revised arrangement. A note saying “support expansion discussed” would not communicate the decision or enable follow-up.
Example: a manufacturing group sees uneven access control
A manufacturer presents a group-wide access-review completion rate that looks satisfactory. Two factories, however, have repeated overdue reviews for supplier maintenance accounts. Their production schedules and local ownership arrangements differ from the headquarters model.
The review should retain that distinction. Management may need to change responsibilities or resources at those factories while keeping the shared policy. Treating the average as proof of group-wide effectiveness would conceal the exact exposure that deserves attention. This example illustrates judgement in presentation, not a mandatory site-by-site reporting template.
9.3.3: record decisions and connect them with action
Outputs include decisions about improvement opportunities and any need to change the ISMS, with documented information retained as evidence of results. A useful record identifies what was decided and allows the organisation to follow implementation. Owners, dates and success measures are practical aids; their form should fit the decision and existing management arrangements.
A decision to accept a limitation, defer work or seek more evidence should also be understandable. Avoid recording only the actions that were easy to approve while losing the reasoning behind unresolved significant risks. Where risk acceptance is involved, preserve the relevant approval arrangements rather than assuming attendance at the meeting provides every required authorisation.
What evidence may be examined?
An auditor may trace selected inputs to reliable records and selected outputs to subsequent action. They may also examine whether previous actions were reconsidered, whether relevant changes reached the review and whether management considered effectiveness rather than activity alone. A set of signed minutes is not sufficient if the contents omit important required inputs.
Other common mistakes include recycling the previous review unchanged, flooding leaders with unexplained technical detail and repeatedly carrying actions forward without discussing the cause of delay. The remedy is better analysis and decision-making, not simply a larger meeting pack.
Explore each numbered part
9.3.1 · Purpose of management review
Management review asks whether the ISMS remains suitable, adequately supported and effective. Learn how top management can make the review a decision-making process rather than a ceremonial meeting. This page explains timing, participation and evidence, with examples of business changes and persistent weaknesses that require management attention.
9.3.2 · Management-review inputs
Prepare management-review information that supports judgement, not just a checklist of reports. Learn to connect previous actions, changes, performance trends, interested-party feedback, risks and treatment status. Examples show how to present conflicting signals and incomplete evidence accurately so leaders can decide what the ISMS needs next.
9.3.3 · Management-review decisions and results
Management review should leave clear decisions about improvement and changes needed to the ISMS. Learn how to record meaningful results, assign practical follow-through and preserve the reasoning behind decisions. Examples distinguish a useful decision record from minutes that only say reports were noted or actions remain in progress.
Common nonconformities with clause 9.3
Auditors often find that reviews happen but do not meet their purpose. Common examples follow.
- Required inputs are missing, typically feedback from interested parties, risk treatment status or trends in nonconformities.
- Records show topics were noted, yet no decisions on improvement or change were made.
- Top management did not attend, or the review was delegated entirely to the security team.
- Actions from the previous review were not followed up.
- Reviews take place irregularly, so intervals are not planned, or they are held only when an external assessment approaches.
Frequently asked questions
Must the review be separate from business management meetings?
No particular meeting label is required. An integrated arrangement can work if the ISMS requirements are covered and the results are identifiable.
Can a security manager conduct the review alone?
The requirement concerns top management's review. Specialists can prepare evidence and recommendations, but should not silently replace the leadership responsibility.
What makes a review action useful?
It should communicate the decision clearly enough for implementation and follow-up. An owner, suitable timing and an intended result are practical aids, rather than a substitute for the underlying management judgement.
Prepare a review that supports decisions
Discuss ISMS management review support, including scoped evidence preparation and scoped use of Effivity ISO & GRC automation software. Explore KPIs, Objectives & Management Review for related learning. Consulting and training support implementation; certification decisions remain independent.
Parent: clause 9. Previous: internal audit. Next: improvement. Return to the hub.