A management review is top management stepping back to ask whether the management system is still suitable, adequate and effective, and what needs to change. Every ISO management system standard requires one at planned intervals. Auditors read the minutes closely, because a review that skips required inputs is one of the most common nonconformities.
Who attends and how often
Top management must take part: the people who direct and control the business. In a small business that is the owner or directors, with the managers responsible for quality, safety or the environment presenting. Most hold a full review once a year, and many add shorter quarterly reviews.
The inputs to cover
- Status of actions from previous reviews.
- Changes in external and internal issues, and in the needs of interested parties, including compliance obligations.
- Performance and effectiveness: objectives, monitoring and measurement results, nonconformities and corrective actions, audit results.
- For ISO 9001: customer satisfaction and feedback, process performance and product conformity, and the performance of external providers.
- For ISO 45001: incidents, consultation and participation of workers, and legal compliance evaluation.
- For ISO 14001: significant environmental aspects and compliance evaluation.
- Adequacy of resources.
- Effectiveness of actions taken to address risks and opportunities.
- Opportunities for improvement.
The outputs to record
- Conclusions on whether the system is suitable, adequate and effective.
- Decisions on opportunities for improvement.
- Any changes needed to the management system, policy or objectives.
- Resource needs.
- Actions, with owners and dates.
Write the conclusion in a sentence. "The management system remains suitable, adequate and effective; the main risk for next year is supplier capacity" is far better than minutes with no conclusion at all.
Making it worth the time
- Circulate the data beforehand so the meeting is for decisions, not reading.
- Look at trends over several periods, not just this quarter.
- Link decisions to the business plan: the review should feel like part of running the company.
- Follow up the actions at the next meeting.
Frequently asked questions
Can the management review be part of a board meeting?
Yes, as long as every required input is covered and the outputs are recorded. Many small businesses add a standing management system item to the board agenda.
Does one review cover several ISO standards?
Yes. An integrated review can cover ISO 9001, 14001, 45001 and 27001 together, as long as the inputs specific to each standard are included.
What evidence does an auditor want?
Minutes or a report showing the date, attendees, each required input considered, the conclusions and decisions, and the actions with owners, plus proof the actions were followed up.
This guide is general information for UK businesses, not legal advice. Check the current regulations and HSE guidance at hse.gov.uk, and take professional advice for your situation.