Management review — General

Plain-language summary

Top management sitting down at planned intervals to judge whether the ISMS is still suitable for the organisation, adequate for its risks and effective in practice — and deciding what to change.

What the clause is really asking

Management review is where leadership commitment (5.1) is exercised and recorded. The clause requires top management to review the ISMS at planned intervals to ensure its continuing suitability (does it still fit the organisation and its context), adequacy (is it big enough for the risks and requirements) and effectiveness (does it deliver the intended outcomes). The 2022 edition split the clause into general, inputs and results. 'Planned intervals' is yours to set — most organisations hold one formal review a year with quarterly check-ins — but it must be top management reviewing, not the ISMS lead presenting to an empty room. A management review that lasts fifteen minutes, covers two of the required inputs and records 'noted' against each is a certification finding and, more importantly, a sign the organisation is not governing its information risk.

What auditors look for

Auditors read the minutes against the required inputs in 9.3.2 and the required results in 9.3.3, check who attended (top management named, present, deciding), and check the interval was kept. They ask attendees what was decided and what has happened since. They look for the review judging suitability, adequacy and effectiveness explicitly, and for evidence that difficult items — resource shortfalls, overdue actions, repeat findings — were discussed rather than smoothed over.

Typical evidence

Management review schedule; agendas structured on the 9.3.2 inputs; minutes recording attendance by top management, discussion and decisions; action register from reviews with owners and dates; evidence of follow-up on previous actions.

How to comply — recommendations

Fix the review dates for the year in advance and build the agenda directly from the 9.3.2 input list so nothing is missed. Pre-circulate a short pack — risk register changes, metrics trend page, audit and incident summaries, objectives status, resource needs — and spend the meeting on decisions, not presentations. Record three things per item: what the data says, what was decided, who owns it by when. Hold a shorter quarterly check-in on the action register so the annual review is not the first time anyone looks. In an integrated system, one review can cover both standards with the ISMS inputs clearly identified.

Common nonconformities

Reviews not held at planned intervals or not held at all; top management absent; required inputs not covered; no judgement of suitability, adequacy and effectiveness; minutes recording information without decisions; actions from previous reviews not followed up; review delegated to the ISMS lead with no leadership involvement.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.