ISMS Metrics, Management Review & Evidence Tracker (Excel) — 25 measures, the 9.3 review and an evidence register for all 93 controls
An ISMS that can show it is measured, reviewed by top management and evidenced on a rhythm — the three post-certification findings auditors raise most, answered from one workbook.
The three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
Instant download through Payhip · no delivery charge · 14-day full refund
Real pages from the actual files — click any preview to enlarge.
What's inside
KPI register
Twenty-five measures with what each shows, the clause or control it evidences, method, unit, source, owner, frequency, target, direction and amber band; fifteen rows for your own.
Monthly data
Twelve months per measure from an editable start month; Latest, Previous, Trend and Green / Amber / Red status calculated.
Dashboard
RAG counts, every measure with quarter averages, evidence status, review cadence and health score, with a reporting-date cell.
Evidence register
Fifteen clause-level records and all 93 Annex A controls: evidence that shows it works, applicability, owner, frequency, location, last collected, next due and live status.
Management review
Agenda and minutes in one — the 9.3.2 inputs one row each with their data sources, the results, the previous review's actions and the sign-off.
Health check and Guidance
Ten tests scored out of ten; why measure, choosing measures, targets and the amber band, the evidence rhythm, running the review, what the auditor asks, clause map.
Worked example across three sheets
Veldline Logistics (Pty) Ltd nine months in: live monthly data, an evidence register with the realistic mix of statuses, and the complete July 2027 review.
One Excel workbook, eleven sheets.
A management review with nothing skipped
Every clause 9.3.2 input answered in a row — what was presented, what was discussed, what was decided, by whom and by when — with the previous review's six actions accounted for at the top.
See it used
What you still have to do
The workbook calculates status, trend, due dates and the health score; it collects nothing. You choose the measures (eight to twelve is a good first year), set targets you mean, enter the numbers each month, name an owner for every evidence item and collect it, and hold the review with top management in the room. Budget a day to set it up, two hours a month to run it and half a day before each review. The measures and collection frequencies are defaults, not requirements — ISO/IEC 27001 leaves what you measure to you — written in our own words; you need your own licensed copy of the standard.
Who it's for
ISMS leads, quality and compliance managers and IT managers running an ISO/IEC 27001:2022 system between audits — and anyone preparing a first management review who would rather walk in with a dashboard than a slide.
The details
- Works with
- Excel 2016 or later, including Microsoft 365. Plain .xlsx — no macros, no add-ins, nothing to install.
- Licence
- Licensed for your own and your organisation's use — every site and every user, with no per-user fees. Not for resale, redistribution or republication.
- Updates
- Free updates for 12 months after purchase: if the workbook is revised in that time, the new version reaches you as a Payhip product update.
- Refund
- If it isn't right for you, email hello@qlause.app within 14 days of purchase for a full refund. No reason needed.
Questions
Do I have to use all 25 measures?+
No — eight to twelve active measures is a good first year. Switch the rest off in the register (they stay for later) and add your own. An auditor will ask why you chose each one, so choose measures a source you already have can produce.
Does it replace the Risk Assessment & SoA Toolkit?+
No, it pairs with it. The toolkit holds the risk register, treatment plan and Statement of Applicability; this tracker measures the system, reviews it and keeps the evidence for the controls the SoA says are implemented. Both use the same worked example.
Is the management review template the standard's list?+
It covers every input and result clause 9.3 expects, written in our own words with where the data for each comes from. Check the rows against your licensed copy of the standard — the text itself is not reproduced.
Does it include the text of the standard?+
No. Everything is written in our own words and points to clause numbers. You still need your own licensed copy of the standard to work against — from SABS or the ISO store.
Can the whole team use it?+
Yes. One purchase covers your organisation — every site and every user. What it doesn't cover is reselling it, handing it to other organisations or republishing it.
What if it isn't what I need?+
If it isn't right for you, email hello@qlause.app within 14 days of purchase for a full refund. No reason needed.
ISMS Metrics, Management Review & Evidence Tracker (Excel) — 25 measures, the 9.3 review and an evidence register for all 93 controls
Instant download · licensed for your whole organisation · 14-day full refund
Start free
Qlause toolkits are interpretive tools written in our own words — not a substitute for the standards, which you need to hold licensed copies of (from SABS or ISO). All templates & toolkits