What inputs must a management review consider?
- Status of actions from previous reviews
- Changes inside and outside the organisation relevant to the ISMS: new services, systems, suppliers, threats
- Feedback from interested parties, including customers and their questionnaires
- Performance against information security objectives, with measures
- Audit results: internal audit findings and external findings, with corrective action status
- Incidents and near misses, and what they indicate about controls
- Status of the risk assessment and treatment plan; significant risks and acceptances
- Supplier performance where information security is concerned
- Opportunities for continual improvement, and resource needs
Circulate these as a short pack before the meeting. A review that assembles its inputs live, from memory, produces the generic minutes auditors discount.
What does a workable 90-minute management review agenda look like?
| Item | Time | Question it answers |
|---|---|---|
| Previous actions | 10 min | Did we do what we said, and if not, why? |
| What changed | 15 min | Do scope, risk assessment and SoA still match the business? |
| Audit and incident picture | 20 min | What are our own checks and our incidents telling us? |
| Risk and objectives | 20 min | Are treatments progressing, objectives being met, acceptances still right? |
| Decisions and resourcing | 20 min | What will we change, fund or stop, with owners and dates? |
| Close | 5 min | Next review date set; actions assigned |
What outputs must be recorded?
Decisions on improvement, on any changes the ISMS needs, and on resources. Each action leaves the room with an owner and a date.
Record conclusions in minutes that reference the inputs actually discussed. An auditor comparing minutes against the pack should be able to follow the reasoning.
Where do management reviews go wrong?
- Held, but not by top management. Delegated entirely to the ISMS coordinator, it demonstrates the opposite of clause 5 and 9.3 working together.
- Inputs skipped. No audit results, no risk status, no previous actions. The minutes reveal it immediately.
- No decisions. A review that produces no changes, no funding and no decisions is unlikely to have examined anything.
- Actions never revisited. The next review's first input is this review's actions; open the loop visibly.
Build the review into the annual rhythm in my maintenance guide, and schedule it after internal audit so its results can be an input. Expect your surveillance auditor to ask for these minutes early in the visit.