ISO 42001 Clause 9.3.2: Prepare the Required Management Review Inputs

What clause 9.3.2 requires in practice

Clause 9.3.2 lists what management review must include, so preparation can be checked against it. The review covers: the status of actions from previous reviews; changes in external and internal issues relevant to the AI management system; shifts in what interested parties need and expect, where this matters to the system; information on system performance, including trends in nonconformities and corrective actions, in monitoring and measurement results, and in audit results; and opportunities for continual improvement.

The list sets a minimum; organisations may bring additional information such as objectives progress or impact findings, but these are additions, not substitutes for the named items. The list shows that trends matter: a single figure rarely tells management enough. The output is an input set that leaders can use to judge the system and decide what to change.

Start with what management previously decided

Report the status of actions from earlier reviews. Explain incomplete work and relevant results of completed actions. A status marked closed may mean an instruction was issued, while the intended improvement remains untested. Preserve that distinction so management can judge the next step.

As an original preparation method, connect each material action with its intended result and current evidence. This helps avoid repeatedly reviewing the same issue without understanding whether the response worked.

Bring relevant changes into view

The review includes changes in external and internal issues and changes in relevant interested-party needs and expectations. A new AI use, supplier dependency or customer commitment may affect the system even if the policy has not changed.

Do not describe the context as unchanged solely because the legal entity is the same. Consider what now influences decisions and outcomes. Relevant local differences should remain visible when reporting for a group.

Why clause 9.3.2 matters to the business

The quality of a management review depends almost entirely on the quality of its inputs. If the pack omits unresolved actions, shows only favourable numbers or averages away a serious local problem, leaders will make confident decisions on a partial picture. That can lead to approving expansion when review capacity is already stretched, or to relaxing a control that is quietly doing important work. A well-prepared input set saves meeting time, focuses debate on what must be decided and gives auditors direct evidence that the review took account of context, stakeholders and performance. It is a modest investment with a high return in better decisions.

How to implement clause 9.3.2

Prepare the pack so that every required input is present and each tells management what to do with it. The following steps show one method Sterling teams use. Whoever assembles the pack should be free to say what the evidence cannot yet show.

1. Create a standing template with a section for each matter the clause names, so nothing is forgotten.
2. Report the status of earlier actions with their intended result and evidence, and say plainly where a task was closed but the result is unproven.
3. Summarise changes in context and interested-party expectations, including new AI uses, suppliers and customer commitments.
4. Present trends in corrective actions, measurement and audit results over a comparable period, and flag any change of definition.
5. Show significant local differences, so a group average does not conceal a serious issue in one place.
6. List improvement opportunities with the benefit, the evidence and the decision required.
7. Keep supporting detail available for questions, and state clearly where evidence is incomplete.

Illustrative software example: one change affects several inputs

Explain performance trends with their limits

The expressly identified performance trends concern nonconformities and corrective actions, monitoring and measurement results, and audit results. Explain the period, scope and basis of comparison. A changed definition can alter a trend without any underlying improvement or deterioration.

Other information, such as objectives, important impact findings or supplier limitations, may help interpret performance. It can be a useful addition, but should not be misrepresented as a verbatim separate item in clause 9.3.2's list.

Illustrative BPO example: fewer reports do not prove fewer problems

A BPO firm reports fewer AI-related concerns after moving to a new reporting route. An audit finds that temporary staff cannot access the route. The downward trend could reflect reduced reporting rather than improved service.

The review pack presents the trend alongside access findings and relevant corrective action. Management can then consider whether the reporting arrangement and evidence are adequate. Presenting the count alone as success would remove the context needed for a credible decision.

Identify improvement opportunities

Include opportunities for continual improvement, not only failures. An assessment method may work but create avoidable rework because teams identify intended use too late. A clearer early discussion can improve both efficiency and decision quality.

Describe the benefit, supporting evidence and decision required. Avoid an unprioritised wish list of tools. Management needs enough information to judge suitability and resources, while implementation planning can develop the detail after a decision.

Evidence and common preparation errors

Common nonconformities with clause 9.3.2

Inputs to management review are often incomplete in recognisable ways.

• The review pack leaves out one or more of the matters the clause names, such as interested-party changes or audit trends.
• Actions from the last review are not reported, or are shown as closed with no evidence they worked.
• Only favourable measures are presented, and adverse results are summarised away.
• Trends compare periods whose definitions or samples differed, with no explanation.
• Additional information, such as impact findings, is presented as though it were a required input, or required inputs are replaced by it.