Management review results

Plain-language summary

What has to come out of the review — decisions on improvement opportunities and on any changes the ISMS needs — recorded as documented information.

What the clause is really asking

A review without outputs is a briefing. The clause requires the review's outputs to cover decisions on opportunities for continual improvement and on any changes the ISMS needs, with documented information kept as evidence of what came out. Typical decisions: fund a control that has been 'planned' too long; change the risk methodology because scores are not reproducible; extend the scope to a new site; raise an objective's target; commission an external test; replace a supplier whose assurance has lapsed; change the audit programme after an incident. Each decision needs an owner and a date so that the next review's first input — status of previous actions — has something to measure. In ISO 9001 terms the clause is the same; the resource decision that 9001 lists explicitly is implied here under 'changes to the ISMS'.

What auditors look for

Auditors read the decisions and follow them forward: were they actioned, by whom, by when, and did the next review check? They look for decisions proportionate to the inputs — a review that heard about overdue treatment actions and repeat findings but decided nothing is a finding against this clause and against 5.1. They check the results are documented, approved and retained, and that changes to the ISMS decided here appear in the change planning of 6.3.

Typical evidence

Management review minutes with a decisions and actions section; action register with owners, dates and status; evidence of actions carried out (budget approvals, updated documents, revised objectives, changed audit programme); next review's record of previous-action status.

How to comply — recommendations

End every review with a decisions table: decision, owner, date, resource — and nothing leaves the room without one. Enter the decisions in the ISMS action register the same day and report status at the quarterly check-in. Where a decision changes the ISMS, open a 6.3 change record. Have the chair sign the minutes. Over time this register becomes the clearest evidence of leadership and improvement the organisation holds.

Common nonconformities

No decisions recorded, only information noted; decisions without owners or dates; decisions not implemented or not followed up at the next review; results not documented or not approved; needed changes to the ISMS evident from the inputs but not decided; no link from decisions to objectives, resources or the treatment plan.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.