ISO 45001 clause 9.3: make management review drive OH&S decisions
ISO 45001:2018 clause 9.3 requires top management to review the OH&S management system at planned intervals for continuing suitability, adequacy and effectiveness. The review connects evidence with decisions about prevention, resources and improvement. In the 2018 structure, these requirements sit within clause 9.3 rather than separate numbered input and output subclauses.
What clause 9.3 requires in practice
Clause 9.3 requires top management to review the OH&S management system on a planned schedule to confirm it remains suitable, adequate and effective. The review considers a defined set of inputs: the status of actions from earlier reviews; changes in external and internal issues, including interested parties' needs, legal and other requirements and risks and opportunities; how far policy and objectives have been met; performance information and trends covering incidents, nonconformities and corrective actions, monitoring results, compliance evaluation, audit results, worker consultation and participation, and risks and opportunities; resource adequacy; communications with interested parties; and chances to improve.
Outputs are decisions on suitability, adequacy and effectiveness, improvement, system changes, resources, actions, better integration with other business processes and any strategic implications. Relevant outputs are communicated to workers, and results are retained.
Start with previous action and changing circumstances
Review the status of actions from earlier management reviews. Explain what was done, what remains open and what the evidence shows about the result. A repeated list of overdue actions without a decision does not provide effective follow-through.
Consider changes in relevant internal and external issues, worker and other interested-party needs and expectations, legal and other requirements, and risks and opportunities. These changes can affect the system’s fit, resource needs and control assumptions. Context is useful when it informs the review, not when it is a separate document nobody revisits.
Evaluate policy, objectives and performance trends
Consider the extent to which the OH&S policy and objectives have been met. Review trends in incidents, nonconformities, corrective actions and continual improvement; monitoring and measurement; compliance-evaluation results; audit results; consultation and participation; and risks and opportunities.
Interpret the evidence rather than simply present totals. A decline in reported incidents may have several explanations. An action marked complete may not be effective. Worker feedback can reveal whether a new arrangement is usable, while audits can test whether requirements are implemented. Keep these different sources connected without treating one as a substitute for all the others.
Consider resources, communication and opportunities
Review whether resources are adequate to maintain an effective system, relevant communications with interested parties and opportunities for continual improvement. These inputs may reveal a decision that operational managers cannot resolve alone.
Present important uncertainties openly. If information is incomplete, management can decide what assessment or evidence is needed. A confident statement of effectiveness unsupported by the available information is less useful than a clear conclusion that identifies the limitation and necessary action.
Why clause 9.3 matters to the business
Management review is where evidence becomes leadership decisions about money, people and priorities. Without it, performance data sits with specialists and the system drifts away from what the business is trying to do. A good review reveals where resources are short, where earlier decisions failed and where strategy is creating new exposure. It also gives workers visible proof that their input and concerns can influence top-level choices. Customers and investors gain confidence when leaders can explain what they decided and why. Businesses that delegate the review entirely to a coordinator often find decisions are never taken, whereas those that take it seriously use it to resolve problems operational managers cannot solve alone.
How to implement clause 9.3
Run the review as a decision meeting supported by interpreted evidence. One practical sequence follows. Where the organisation integrates review into regular leadership meetings, confirm that every required input and output is still covered and that top management itself, not a delegate, takes the decisions and owns the follow-up.
- Draw up a standing agenda from the required inputs, so none is forgotten, and assign a person to prepare each.
- Prepare short evidence summaries that explain trends and uncertainties rather than listing totals.
- Begin with actions from the previous review, stating what was done, what remains and what the evidence shows.
- Give top management time to discuss resources, strategy, changes in requirements and worker participation findings.
- Record decisions with an owner and an expected result, and say plainly where more information is needed.
- Communicate the relevant outputs to workers and their representatives in a way they can use.
- Retain the record of conclusions and decisions, and carry open actions into the next review.
Evidence an auditor expects for clause 9.3
An auditor will look for proof that leaders reviewed the system and decided something. Useful evidence includes minutes or decision records showing that each required input was considered, summaries that tie conclusions to underlying data, and a trail from earlier decisions to completed action. Interviews with top management show whether they understand the system's condition and can explain choices on resources or change. Evidence that outputs reached workers, for example briefing notes or team discussions, matters because communication is part of the requirement. The auditor may also check that worker participation results and audit findings appeared among the inputs. A slide deck alone rarely preserves decisions, so a separate record is usually needed.
Two illustrative management reviews
A manufacturer sees repeated concerns about coordination of contractor maintenance. Audit findings, worker participation records and operational observations indicate that earlier reminders did not resolve the interface. Top management decides on changes to responsibilities and planning resources and establishes follow-up. The review addresses the system conditions rather than treating each concern as an isolated worker error.
A software support company has expanded its overnight service. Review inputs include workload-related feedback, objective progress and the operation of escalation arrangements. Management considers whether the system remains suitable and adequately resourced for the new model. It decides on an appropriate change and how the outcome will be evaluated, without assuming that a low injury count answers the work-organisation question.
Produce clear conclusions and decisions
Outputs include decisions on continuing suitability, adequacy and effectiveness; continual-improvement opportunities; changes to the system; resources; necessary actions; opportunities to improve integration with other business processes; and implications for strategic direction. These categories guide the review’s results without requiring a new project in every category at every meeting.
Make decisions usable by the responsible people. Practical ownership, expected results and follow-up help connect the review with implementation. The organisation may integrate review into existing leadership meetings, provided all required inputs and outputs remain covered and top management performs the review.
Communicate relevant results to workers
Top management communicates relevant management-review outputs to workers and representatives where they exist. This closes an important loop: workers who contribute information should receive the results relevant to their work and participation.
Retain documented information as evidence of management-review results. Minutes, decision records or an integrated management record can be suitable. A slide deck can support inputs, but does not necessarily preserve the conclusions and decisions made.
Common weaknesses
Frequent problems include omitting consultation and participation from the inputs, recording discussion without decisions, failing to communicate relevant outputs to workers and allowing earlier actions to disappear. Another is delegating the entire review to the OH&S coordinator while top management only signs a prepared conclusion.
Frequently asked questions
Must management review be one annual meeting?
No. Use planned intervals and an arrangement that provides complete coverage, leadership involvement and demonstrable results.
Do workers need every confidential management discussion?
The requirement concerns relevant outputs communicated to workers and representatives. Tailor communication appropriately while preserving what they need to know.
Can management conclude that no change is needed?
Yes, where the evidence supports it. The required inputs and output considerations still need meaningful review.
Prepare a review that changes decisions
Discuss OH&S management-review preparation with Sterling, including worker inputs, decisions and audit evidence. The KPIs, Objectives and Management Review course develops relevant skills. Effivity ISO & GRC automation software can be scoped to agreed review processes. See evaluation and the directory.