---
title: "ISO 27001 Management Review: Agenda, Inputs, Minutes"
description: "How to run an ISO 27001 clause 9.3 management review: required inputs and outputs, a 90-minute agenda, who should attend, and minutes that satisfy an auditor."
canonical: https://www.isosecurity.co.uk/resources/iso-27001-management-review
updated: 2026-11-10
---

# ISO 27001 management review, run so it proves leadership

Clause 9.3 requires top management to review the ISMS, consider a defined set of inputs, and produce decisions. Done well, it is the meeting that keeps the system alive between audits; run as a formality, it is one of the most common findings at certification and surveillance alike.

## What inputs must a management review consider?

- Status of actions from previous reviews
- Changes inside and outside the organisation relevant to the ISMS: new services, systems, suppliers, threats
- Feedback from interested parties, including customers and their questionnaires
- Performance against information security objectives, with measures
- Audit results: internal audit findings and external findings, with corrective action status
- Incidents and near misses, and what they indicate about controls
- Status of the risk assessment and treatment plan; significant risks and acceptances
- Supplier performance where information security is concerned
- Opportunities for continual improvement, and resource needs

Circulate these as a short pack before the meeting. A review that assembles its inputs live, from memory, produces the generic minutes auditors discount.

## What does a workable 90-minute management review agenda look like?

| Item                       | Time   | Question it answers                                                        |
| -------------------------- | ------ | -------------------------------------------------------------------------- |
| Previous actions           | 10 min | Did we do what we said, and if not, why?                                   |
| What changed               | 15 min | Do scope, risk assessment and SoA still match the business?                |
| Audit and incident picture | 20 min | What are our own checks and our incidents telling us?                      |
| Risk and objectives        | 20 min | Are treatments progressing, objectives being met, acceptances still right? |
| Decisions and resourcing   | 20 min | What will we change, fund or stop, with owners and dates?                  |
| Close                      | 5 min  | Next review date set; actions assigned                                     |

## What outputs must be recorded?

Decisions on improvement, on any changes the ISMS needs, and on resources. Each action leaves the room with an owner and a date.

Record conclusions in minutes that reference the inputs actually discussed. An auditor comparing minutes against the pack should be able to follow the reasoning.

## Where do management reviews go wrong?

- **Held, but not by top management.** Delegated entirely to the ISMS coordinator, it demonstrates the opposite of clause 5 and 9.3 working together.
- **Inputs skipped.** No audit results, no risk status, no previous actions. The minutes reveal it immediately.
- **No decisions.** A review that produces no changes, no funding and no decisions is unlikely to have examined anything.
- **Actions never revisited.** The next review's first input is this review's actions; open the loop visibly.

Build the review into the annual rhythm in my [maintenance guide](/resources/how-to-maintain-iso-27001-certification), and schedule it after [internal audit](/resources/iso-27001-internal-audit) so its results can be an input. Expect your [surveillance auditor](/resources/iso-27001-surveillance-audit) to ask for these minutes early in the visit.

## Frequently asked questions about ISO 27001 management review

### What is an ISO 27001 management review?

A planned review of the management system by top management, required by clause 9.3: whether the ISMS remains suitable, adequate and effective, what audits, incidents, risks and objectives are telling you, and what you will change as a result. It must consider a defined set of inputs, produce decisions and actions, and leave records an auditor can examine.

### How often should a management review be held?

At planned intervals: annually is the common minimum, and many organisations review twice a year so actions stay live. The interval matters less than the discipline of setting the date at the previous review, circulating the inputs in advance, and following up the actions between meetings.

### Who should attend the ISO 27001 management review?

Top management, meaning the people with authority over scope, budget and risk acceptance, plus whoever coordinates the ISMS and can present audit results, risk status and progress against objectives. Auditors look for evidence that leadership engaged with the inputs and made decisions.

### What should management review minutes contain?

The date and attendees, each required input considered (previous actions, changes, audit results, incident and feedback trends, risk and treatment status, objective performance, supplier performance, opportunities to improve), the decisions made, and actions with owners and dates. Minutes that record only attendance, with no decisions, are one of the most common surveillance findings.

## Contact

Management review due, and nothing to show for inputs? Arrange a readiness discussion: [contact ISO Security](/contact) or email info@isosecurity.co.uk.