ISO 42001 Clause 9.3.3: Record Management Review Decisions That Can Be Acted On
ISO 42001 clause 9.3.3 requires management-review results to include decisions about continual improvement opportunities and any need for changes to the AIMS. Documented evidence of the results must be available. A record that says “performance discussed” does not explain the management decision or what should happen next.
What clause 9.3.3 requires in practice
Clause 9.3.3 concerns what management review must produce. The results must include decisions on opportunities for continual improvement and on any need to change the AI management system. Documented information must be kept as evidence of what management reviews concluded.
The emphasis is on decisions, not discussion. A record that says a topic was presented does not show what management decided. The clause does not specify an action-table layout, a minutes template or a named owner field, although stating who will act and by when is a sensible method for making a decision actionable. A decision to keep an arrangement unchanged can also be a legitimate result, provided it follows real consideration of the evidence. The outputs are recorded decisions about improvement and change, in a form that remains understandable and retrievable.
Record the result, not only the conversation
Meeting notes can help, but the important information is the decision and its meaning. Identify the issue considered and whether management decided to improve an arrangement, change the system, obtain further evidence or maintain the current approach with a clear rationale.
As an original implementation practice, add responsibility, timing and the intended result where action follows. Clause 9.3.3 does not prescribe a particular action-table format, but these details help people act consistently and allow the next review to examine progress.
Why clause 9.3.3 matters to the business
Reviews that end without clear decisions leave issues in limbo. Teams do not know whether to change a process, wait for more data or carry on as before, and the same topics return meeting after meeting. Clear recorded decisions let the business move: resources are released, restrictions are applied and responsibilities are assigned. They also protect leaders, since a documented rationale shows that the matter was considered with the evidence available at the time. For customers and certification audits, the record is the visible proof that the system is genuinely directed by those in charge, rather than administered on their behalf without their involvement.
How to implement clause 9.3.3
Capture the result, not the conversation. A sequence Sterling teams use to make review decisions usable is set out below. A good test is whether someone who missed the meeting could tell what was decided and what they should now do.
- For every material topic, write the decision in a sentence: improve, change, obtain more evidence, or maintain with reasons.
- Add the person responsible, the intended result and the evidence that will show it, as a good practice rather than a clause demand.
- Where more investigation is needed, state the question that is unanswered and who will obtain the evidence.
- Identify which sites, services or teams each decision covers, so a local restriction is not lost in a group summary.
- Send decisions that alter the system into planned change arrangements and communicate them to those affected.
- Store the record in a controlled form that links to the inputs used, and keep it retrievable.
- At the next review, test decisions against results and ask management why any have stalled.
Illustrative construction example: an unclear decision stalls change
A construction consultancy reviews an AI reporting process whose summaries omit important qualifications. The record states that project teams should “improve oversight”. No one knows whether that means more review time, revised instructions or a narrower use.
A clearer result identifies the management decision about the operating arrangement and who will develop the agreed response. It preserves any limits pending the change. The record does not need to reproduce every comment from the meeting, but it should explain what affected teams are expected to do.
Illustrative manufacturing example: a decision needs later evidence
A manufacturer reviews inconsistent AI inspection controls across shifts. Management decides to provide additional competent review capacity and verify the arrangement under representative conditions.
The result identifies the intended improvement and the evidence needed to judge it. At the next review, the organisation can distinguish recruitment or training completed from a control shown to work. Without that distinction, an action can be administratively closed while the original problem persists.
Connect decisions with planned change
Where review identifies a needed AIMS change, use planned change arrangements. A new approval structure can affect responsibilities, competence, instructions and communication. The review result should reach the people coordinating those interfaces.
Where further investigation is needed, describe the unanswered question. “More data required” is less useful than explaining which uncertainty prevents a decision and who can obtain relevant evidence. Management should avoid allowing indefinite investigation to substitute for an appropriate interim response.
Retain evidence that remains understandable
Keep documented results in a controlled form. Electronic records, formal minutes or another suitable method can work. They should remain retrievable and connected with the relevant review and supporting information.
For global arrangements, identify which activities or locations a decision covers. A local operating restriction should not disappear inside a group-wide summary. Conversely, a decision affecting several teams needs communication beyond the person who attended the meeting.
Common mistakes and evidence tests
An auditor may follow a material input to the recorded decision and subsequent action. Common weaknesses include actions with no identifiable owner, decisions changed informally without explanation and records containing only attendance or presentation titles.
Another failure is assuming that every review must create a new project. The requirement concerns decisions on improvement opportunities and needed changes. Maintaining an arrangement can be a reasoned outcome, provided the review genuinely considers evidence rather than automatically recording no change.
At the next review, the status of previous actions provides continuity. Use it to examine progress and results, including unresolved constraints that need management attention.
Frequently asked questions
Does the standard require a specific minutes template?
No. Documented evidence of the review results is required. Choose a format that makes decisions and their meaning clear.
Must every review result in a system change?
No. Management considers improvement opportunities and any need for change. The decision should follow the evidence rather than a rule to create activity.
Are action owners and dates mandatory fields in clause 9.3.3?
The clause does not prescribe those fields. They are useful implementation details for making decisions actionable and supporting follow-up.
Make the next review decision usable
Ask Sterling to help turn an unresolved review issue into a clear decision and follow-up. Scoped support can include documentation and Effivity ISO & GRC automation software. ISO/IEC 42001 Awareness supports management understanding. Return to the review guide and the complete library.