ISO 45001 management review: inputs, outputs, the record and a quarterly agenda for OH&S

What does ISO 45001 management review have to cover?

An ISO 45001 management review is the meeting in which the people accountable for the organisation examine whether the OH&S management system is preventing injury and ill health, and then commit to decisions: new controls, changed objectives, more resources, a revised system. It sits at clause 9.3 in ISO 45001:2018, after 9.1 Monitoring, measurement, analysis and performance evaluation and 9.2 Internal audit, and it feeds clause 10, Improvement.

The clause sets a list of inputs the review must consider and the outputs it must produce. Read that list in your own licensed copy of the standard; this guide does not reproduce it. Every input is generated elsewhere in the system:

• context and interested parties (4.1, 4.2), including the decision on whether climate change is a relevant issue added by Amendment 1:2024;
• hazards, OH&S risks and opportunities (6.1.2) and the legal requirements and other requirements that apply (6.1.3);
• progress on OH&S objectives (6.2);
• consultation and participation of workers (5.4) and communication (7.4);
• resources (7.1) and competence (7.2);
• monitoring results (9.1.1), the evaluation of compliance (9.1.2) and internal audit results (9.2);
• incidents, nonconformities and corrective actions (10.2) and continual improvement (10.3).

If those clauses are working, the review pack almost assembles itself.

Who attends, and how often?

Top management owns the review: the person or group that directs and controls the organisation for the certified scope. On a multi-site certificate, that means the managing director or country head with site leads, not a safety manager alone. The HSE coordinator prepares the pack and the minutes; site managers present their own figures.

ISO 45001 gives worker participation its own clause title, and Sterling's practice follows from it. We put the safety committee chair or a worker safety representative on the attendance list, or at least place a committee report on the agenda, so that concerns raised on the shop floor are considered by the people who can fund the fix.

The organisation plans how often the review happens. Sterling recommends every quarter, with a fuller year-end session, because an annual review in a high-hazard operation looks at incidents that happened eleven months earlier. Whatever interval you choose, the certification body will look for it: under ISO/IEC 17021-1, the Stage 1 readiness review evaluates whether management reviews are planned and performed, and each surveillance audit includes management review.

A sample quarterly agenda

This is Sterling's recommended agenda, built from the source clauses rather than from a template. It fits into 90 minutes when each presenter sends one page ahead showing a trend over at least four quarters and a recommendation.

At the year-end session, add a check that the OH&S policy and the scope still describe the business, set next year's objectives, and, while the revised edition of ISO 45001 is pending, agree when the system will be reviewed against it. ISO expects that edition in the first half of 2027; our ISO 45001 revision guide tracks what is known.

The record auditors ask for

The auditor asks for the minutes of the last review, and often the one before, and reads them for evidence that the review happened as designed and changed something. A usable record shows:

• the date, the attendees and top management's presence;
• each agenda item addressed, including a stated "no change" where nothing moved, with the data referred to;
• the decisions, written as decisions rather than as "noted";
• an owner and a due date on every action;
• at the following review, the status of each action.

The minutes are then traced into the workplace. IAF MD 22 requires the certification audit to evaluate the system during operational activities, including a tour of facilities and work sites, so a decision to guard a machine or add a permit to work for roof access will be looked for on the floor. Expect the managing director to be asked what the last review decided about safety. The Stage 1 and Stage 2 audit guide explains how auditors sample.

A serious incident deserves an extraordinary review rather than a wait for the next quarter. IAF MD 22 allows a certification body to conduct a special audit after a serious incident or a serious breach of regulation, and the first record it will want is what top management decided.

What a weak review looks like

At gap analysis the pattern we see most in OH&S is a review that counts lost-time injuries, applauds a low number and moves on. A low injury count with few reported near misses usually means reporting has stopped, not that the work has become safe; the review should ask which of the two it is.

Most of these weaknesses start upstream; our guides to hazard identification and risk assessment, the legal register and evaluation of compliance and contractor management cover those inputs.

Holding the review in Effivity

Effivity's OH&S software includes a management review module alongside hazard and risk assessment, compliance obligations, incident and accident management, work permits, training records, nonconformance and internal audit, with incidents reportable from a mobile device. Presenters draw their figures from those modules, and minutes and actions stay in one record. Effivity is included with the engagement, at no additional cost, and is used in 50+ countries; the Effivity for ISO 45001 guide covers the configuration.

With ISO 14001 as well, one HSE review works if each standard's inputs are visible in the minutes; see the integration guide.

ISO 45001 management review: questions buyers ask