ISO 9001 Management Review: What It Requires and How to Run One Properly
The management review is the most important meeting in an ISO 9001 Quality Management System. It is the process through which senior leadership evaluates whether the QMS is functioning effectively, whether quality objectives are being achieved, and what decisions need to be made to improve. It is also the meeting that most certified organisations conduct as a formality rather than a genuine evaluation.
ISO 9001 Clause 9.3 requires top management to review the organisation’s quality management system at planned intervals. The purpose is clear: to ensure the QMS remains suitable, adequate, and effective in relation to the organisation’s strategic direction. This is not an administrative requirement that can be satisfied by a brief annual meeting where no substantive decisions are made.
The management review is the mechanism through which the internal audit program, customer feedback, quality objectives performance, and risk assessment findings are synthesised into organisational decisions. When it works properly, the management review drives genuine improvement. When it is conducted as a compliance formality, it produces minutes that satisfy certification auditors while adding no value to the business.
This guide explains what Clause 9.3 specifically requires, what the review inputs and outputs must cover, how to structure a management review that is both compliant and genuinely useful, and what external auditors assess when they review management review records. For the full standard requirements, refer to iso.org, bsigroup.com/en-AU, and standards.org.au.
| What ISO 9001 Clause 9.3 requires — the plain-English version: Top management must review the QMS at planned intervals. The review must evaluate whether the QMS is suitable, adequate, and effective. The review must use defined inputs and produce defined outputs. The results of the review must be retained as documented information. Four elements — frequency, evaluation standard, inputs/outputs, and records — are all required. A management review that satisfies three of the four does not satisfy Clause 9.3. |
Who Must Be Involved in the Management Review
Clause 9.3 places the management review obligation on top management. This is deliberate and specific. ISO 9001 defines top management as the person or group of people who directs and controls the organisation at the highest level. For most Australian SMEs, that means the managing director, CEO, or business owner.
The management review cannot be delegated to the quality manager or compliance officer and called a management review. The Quality Manager may facilitate and prepare the review. The compliance function may compile the input data. But the evaluation and the decisions must be made by the people who have strategic authority over the business.
In practice, a well-structured management review for a small or medium Australian business typically involves:
- The managing director or CEO — who must be present and actively participating, not receiving a summary after the fact
- Relevant operational managers — whose process performance data forms part of the review inputs
- The quality or compliance officer — who facilitates the review and maintains the records
- Any other senior staff with accountability for quality objectives or customer satisfaction outcomes
| ⚠️ THE MOST COMMON MANAGEMENT REVIEW FAILURE In ISO 9001 external audits, the most frequent management review finding is that the review was not genuinely conducted by top management. This takes several forms: the managing director attended for ten minutes and then left; the review was conducted by the quality manager and a summary was sent to the MD; or the “management review meeting” was a routine operations meeting with a QMS agenda item added at the end. None of these satisfy Clause 9.3. The standard requires top management to review the QMS. Not to receive a report about it. Not to endorse someone else’s conclusions. To review it. |
When Must the Management Review Be Conducted?
Clause 9.3 requires the review to be conducted at planned intervals. The standard does not specify a minimum frequency. In practice, most certification bodies and the ISO 9001 audit community interpret “planned intervals” to mean at least once per year for a fully functioning QMS.
Higher-risk or more complex organisations may benefit from more frequent reviews — semi-annual or even quarterly for businesses going through significant change. The frequency should be documented in the QMS and be consistent with the organisation’s risk profile and strategic context.
| Review Frequency | Appropriate For |
| Annual | Stable, lower-risk organisations with a well-functioning QMS and no significant operational or strategic changes during the year |
| Semi-annual | Businesses undergoing growth, restructure, or market change — where the QMS needs more frequent evaluation to remain aligned with operations |
| Quarterly | Complex, higher-risk, or highly regulated organisations where quality objectives and risk profiles change frequently enough to warrant quarterly management attention |
| Triggered review | An additional review outside the planned schedule, triggered by a significant customer complaint, a major nonconformity, a significant operational change, or a change in the regulatory environment |
The Required Inputs — Clause 9.3.2
Clause 9.3.2 specifies the information that must be considered in every management review. This is not a discretionary list. The standard uses the word “shall” — these inputs must be addressed. An internal audit finding that raises concerns about any of these input areas is particularly significant, because it means the management review is not receiving the information it is required to consider.
| # | Required Input | What This Means in Practice |
| 1 | Status of actions from previous reviews | Whether decisions and actions from the last management review have been implemented. A management review that does not follow up on its own previous decisions is not driving improvement. |
| 2 | Changes in external and internal issues | New regulations, market changes, operational restructures, or strategic shifts that affect the QMS context. This is where the climate change consideration introduced by the 2024 ISO amendment feeds into the management review. |
| 3 | Customer satisfaction and feedback | Customer complaint trends, satisfaction survey results, and any significant feedback from key clients. The management review must evaluate what the business is learning from its customers.customer satisfaction |
| 4 | Quality objectives performance | Whether the quality objectives set at the last review are being achieved, what the data shows, and what action is needed for objectives that are off track. Quality objectives must be measured — not just stated. |
| 5 | Process performance and product or service conformity | How well the operational processes are performing, and whether products or services are consistently meeting their defined requirements. This draws on operational data, not just anecdote. |
| 6 | Nonconformities and corrective actions | The number, nature, and status of nonconformities identified through internal audits, customer complaints, and operational monitoring. Whether corrective actions have been effective.nonconformities and corrective actions |
| 7 | Monitoring and measurement results | The results of all monitoring and measurement activities — not just quality objectives, but also process monitoring, product testing, and any other measurement the QMS has defined. |
| 8 | Audit results | The findings and trends from internal audits conducted since the last management review. The management review is the organisational forum where internal audit findings receive senior-level attention.internal audit program |
| 9 | Performance of external providers | How suppliers, subcontractors, and other external providers are performing against the organisation’s requirements. Significant supplier nonconformances should be reviewed at management level. |
| 10 | Adequacy of resources | Whether the human, infrastructure, environmental, and financial resources available to the QMS are adequate for the organisation to achieve its quality objectives. |
| 11 | Risk and opportunity actions | Whether the actions taken to address risks and opportunities identified in the risk assessment have been effective and whether new risks or opportunities have emerged. |
| 12 | Opportunities for improvement | Any improvement opportunities identified through the review process, separate from corrective actions for specific nonconformities. The management review should actively generate improvement ideas, not just confirm existing ones. |
| 🎓 FROM LEAD COMPLY’S COMPLIANCE EXPERIENCE In more than a decade of participating in and reviewing ISO 9001 management reviews — including sitting on QMS management review boards and accompanying BSI external auditors during surveillance and re-certification audits — the input that consistently receives the least substantive treatment is Input 4: quality objectives performance. Organisations typically state their quality objectives at the start of the year and then present the data at the management review without any genuine analysis. The data exists. The discussion does not. When an objective is off track, the management review minutes often record “noted” rather than a decision about what will change. An external auditor reviewing management review records over multiple cycles will identify this pattern. Quality objectives that are tracked but never drive decisions are not being managed. They are being monitored. The standard requires management — not monitoring. |
The Required Outputs — Clause 9.3.3
The outputs of the management review are the decisions and actions that result from the review process. Clause 9.3.3 specifies that the management review outputs must include decisions and actions related to three areas. These are mandatory — a management review that does not produce outputs in all three areas has not satisfied the clause.
| Required Output Area | What This Means for Your QMS |
| Opportunities for improvement | The management review must produce specific improvement actions — not general statements of intent. Each improvement opportunity identified must result in a documented action, an owner, and a target date. |
| Changes needed to the QMS | Where the review identifies that the QMS needs to change — whether in its scope, its processes, its objectives, or its documented information — those changes must be explicitly decided and documented. This is how the QMS evolves in response to the business. |
| Resource needs | Where the review identifies that additional resources are needed to achieve quality objectives or maintain QMS effectiveness — people, training, equipment, infrastructure — those resource decisions must be recorded as outputs. |
How to Structure a Management Review That Is Both Compliant and Genuinely Useful
The management review works best when it is structured as a genuine strategic conversation about quality performance, not a compliance meeting where inputs are read aloud and minuted. The following structure is what Lead Comply recommends and implements for client management review programs.
| RECOMMENDED MANAGEMENT REVIEW STRUCTURE BEFORE THE REVIEW (preparation — 1 to 2 weeks before): The quality or compliance officer compiles the input data package: internal audit findings since the last review, quality objectives performance data, customer satisfaction results, nonconformity trends, supplier performance summary, and status of previous review actions. This package is distributed to all participants at least five business days before the meeting. OPENING (10 minutes): Confirm attendees and quorum. Review and confirm the agenda. Confirm that the previous management review minutes are an accurate record. STATUS OF PREVIOUS ACTIONS (15 minutes): Review each action from the previous management review. Confirm whether it was completed on time, is still in progress, or is overdue. For overdue actions, the review must make a specific decision: extend the deadline, escalate, or close as no longer relevant. QUALITY OBJECTIVES REVIEW (20 minutes): For each quality objective, present the current performance data. The discussion must address: Is the objective being achieved? If not, why? What is being done differently? Are the objectives still appropriate, or should any be amended? This is the most important discussion of the review. AUDIT AND NONCONFORMITY REVIEW (15 minutes): Present findings from internal audits conducted since the last review. Review the status of all open nonconformities. Identify any patterns or systemic issues that require management attention beyond the individual corrective action. REMAINING INPUTS (20 minutes); Customer satisfaction results and significant feedback. External provider performance. Changes in context or interested parties. Risk and opportunity review. Resource adequacy. DECISIONS AND OUTPUTS (15 minutes): The closing segment exists specifically to capture outputs. For each significant finding or discussion, the review must produce a decision: an improvement action with an owner and date, a change to the QMS, or a resource decision. General observations that do not lead to a specific action do not satisfy the output requirement. |
What External Auditors Look for in Management Review Records
When BSI or another accredited certification body conducts a surveillance or re-certification audit, management review records are one of the first document sets requested. The external auditor‘s assessment covers four areas.
| What the Auditor Assesses | What a Strong Record Shows |
| Frequency and top management attendance | Minutes that record the date, attendees by name and title, and duration. Top management names must appear as present — not “represented by” someone else. |
| All required inputs were addressed | The minutes or supporting documents must show that all 12 required inputs under Clause 9.3.2 were considered. An input not mentioned in the record is treated as an input not addressed. |
| Outputs are specific and actionable | Each output must name an action, an owner, and a target date. “Management agreed to monitor customer complaints more closely” is not an output. “Quality Manager to implement monthly complaint trend report by 31 July 2026” is an output. |
| Connection to previous review outcomes | The auditor will cross-reference this management review’s opening section with the previous review’s outputs. Actions that were recorded as outputs in the previous review must appear as status items in the current one. Untracked outputs signal a management review that is not driving genuine improvement. |
| 🎓 FROM LEAD COMPLY’S COMPLIANCE EXPERIENCE The pattern that appears most consistently in management review records across the organisations Lead Comply has worked with is outputs that are vague and unattributed. The minutes record that “management agreed to review the supplier approval process” without naming who is responsible, by when, and what specifically will be reviewed. When the next management review opens, that action cannot be properly followed up because it was never specific enough to be assessed as complete or incomplete. An external auditor will identify this pattern within minutes of reading management review records across two or three cycles. It signals a management review that produces the appearance of decisions without the accountability structures that make those decisions real. The fix is simple: every output must have a named owner and a specific target date. No exceptions. This single change transforms management review records from compliance documents into genuine management tools. |
How Lead Comply Supports ISO 9001 Management Review Programs
Lead Comply integrates management review design into every ISO 9001 QMS engagement. This means every client program includes a management review procedure that specifies the required inputs, the expected outputs, the attendee requirements, the documentation standard, and the connection to the internal audit program and quality objectives framework.
For clients preparing for an initial certification audit, Lead Comply facilitates the first management review to demonstrate compliance with Clause 9.3 before the certification auditor assesses it. For clients in ongoing programs, Lead Comply conducts an annual management review assessment to verify that the review records meet the standard and to identify any input areas that are receiving insufficient management attention. For businesses considering ISO 9001 certification for the first time, the management review is one of the requirements Lead Comply addresses in the initial QMS design phase.
Businesses already certified to ISO 9001:2015 should also be aware that management review requirements are expected to remain in the ISO 9001:2026 revision — with potentially strengthened expectations around the connection between management review outputs and quality objectives. Building a genuine management review practice now is the most efficient way to prepare for the upcoming standard transition.
| 📋 WHAT GOES WRONG IN PRACTICE — WHAT LEAD COMPLY SEES Three management review failures Lead Comply identifies consistently when reviewing QMS programs: 1 — The management review was not attended by top management. The minutes record the quality manager and two operational supervisors. The managing director is listed as “apologies.” This does not satisfy Clause 9.3. Top management reviewing the QMS means the people with strategic authority for the business are present and making decisions — not receiving a summary report afterward. 2 — Not all required inputs are addressed. The most commonly omitted inputs are performance of external providers (suppliers) and status of actions from previous reviews. An organisation that skips these in consecutive management reviews will face a nonconformity at the next external audit. 3 — Outputs are vague, unattributed, and not followed up. Management reviews that conclude with general observations rather than specific actions do not produce improvement. They produce minutes. When the next review opens and the previous outputs cannot be assessed as complete or incomplete, the auditor concludes that the management review is not driving the improvement it is designed to create. |
| ✓ WHAT A COMPLIANT AND EFFECTIVE MANAGEMENT REVIEW LOOKS LIKE – Conducted at planned intervals with top management genuinely present and leading the discussion – All 12 required inputs under Clause 9.3.2 addressed with substantive data and discussion. – Internal audit findings presented as a key input — not a side note. – Quality objectives performance reviewed with actual data — and decisions made where objectives are off track. – All three output categories covered: improvement actions, QMS changes, and resource decisions. – Every output has a named owner and a specific target date. – Previous review actions reviewed as the first agenda item — every time. – Minutes retained as documented information — accessible for external audit review. – QMS program designed to make the management review useful — not just compliant. |
| Frequently asked questions on ISO 9001 management reviews: Can we combine the management review with another meeting? — Yes, provided the combined meeting specifically addresses all 12 required inputs and produces the required outputs. Many organisations combine the management review with an annual strategic planning meeting. The risk is that quality management gets insufficient time in a crowded agenda. How long should a management review take? — For most Australian SMEs, a well-prepared management review takes 90 minutes to two hours. Organisations that find their reviews taking 30 minutes or less have almost certainly not covered all required inputs with sufficient depth. Do we need to keep management review minutes forever? — ISO 9001 does not specify a retention period for management review records. Most certification bodies expect records from at least the last two to three review cycles to be available for audit review. What if top management is unavailable for the planned review date? — Reschedule. Do not conduct the review without top management and call it a management review. A management review conducted without the people Clause 9.3 assigns the responsibility to is not a management review under the standard. |
Book a free 30-minute Clarity Call with Lead Comply. In 30 minutes you will know whether your management review structure, inputs, outputs, and records satisfy Clause 9.3 — and what a genuine, audit-ready management review looks like for your business.
