Management review inputs

Plain-language summary

The set of things the management review must consider — actions from last time, changes in context and in what interested parties expect, how the ISMS is performing, feedback, the risk picture and improvement opportunities.

What the clause is really asking

The clause lists the inputs so that no review can quietly skip the uncomfortable ones. Top management considers: the status of actions from previous reviews; changes in external and internal issues relevant to the ISMS; changes in the needs and expectations of interested parties (new in 2022 — a new regulation, a customer's new security schedule, an insurer's new conditions); feedback on information security performance, including trends in nonconformities and corrective actions, monitoring and measurement results, audit results and the fulfilment of objectives; feedback from interested parties; the results of risk assessment and the status of the risk treatment plan; and opportunities for continual improvement. Each input is a question — what changed, what do the numbers say, where are we exposed — and the review record should show the question asked and answered, even when the answer is 'no change'.

What auditors look for

Auditors hold the minutes against this list. For each input they look for evidence it was considered with content, not a heading: the 'changes in interested parties' item should mention the actual new requirement; 'risk assessment results' should cite the register version and the top risks; 'audit results' should name the findings. They probe the 2022 addition specifically. They also look for the inputs being current — a review in November using metrics from March is not reviewing performance.

Typical evidence

Management review pack and minutes addressing every input with specifics; the data behind them: metrics report, audit summary, nonconformity and corrective action trends, risk register and treatment plan status, objectives status, interested-party feedback (customer audits, questionnaires, complaints, regulator correspondence); previous action register.

How to comply — recommendations

Make the input list the agenda template and never remove an item — write 'no change this period' where that is true. For each input attach the one-page evidence: the metrics trend, the audit coverage matrix, the top ten risks with movement, the treatment plan status, the objectives page, a summary of customer and regulator feedback. Ask the owner of each input to speak to it for two minutes and to propose a decision. Close the pack a week before the meeting so the review works from current data.

Common nonconformities

One or more required inputs not considered (most often changes in interested parties' needs, feedback from interested parties, or risk treatment plan status); inputs listed as headings without content; stale data; trends in nonconformities and corrective actions not analysed; objectives status not reported; previous actions not reviewed.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.