ISO Management Review

The management review is where top management steps back and asks whether the management system is still doing its job. Clause 9.3 of both ISO 9001 and ISO 14001 requires it at planned intervals, and both expect it to end in decisions, not just a record that a meeting took place. In a small business it is often the most useful hour of the year for the system, and it is also one of the requirements auditors most often find thin.

What the standards require

ISO 9001 sets out the inputs the review must consider. In practice they fall into a handful of groups:

• Follow-up on actions from previous management reviews.
• Change: shifts in the external and internal issues that affect the system, including the needs of interested parties.
• Performance: customer satisfaction and feedback, whether quality objectives were met, process performance and product or service conformity, nonconformities and corrective actions, monitoring and measurement results, internal and external audit results, and how well external providers performed.
• Resources: whether they are adequate for the system to work.
• Risks and opportunities: how effective the actions taken to address them have been.
• Improvement: opportunities to make the system better.

ISO 14001 covers the same ground from the environmental side and adds its own inputs, such as compliance obligations, significant environmental aspects, environmental performance and relevant communications from interested parties, including complaints.

The outputs are just as defined. The review has to reach conclusions and decisions: opportunities for improvement, any changes needed to the system, and the resources required. ISO 14001 adds decisions on objectives that were not achieved and any implications for the organisation's strategic direction. Both standards require you to keep documented information as evidence of the results.

How often to hold it

Neither standard sets a frequency. "Planned intervals" means you decide, and your procedure says what you decided. Most small organisations hold a full review once a year. Some split the inputs across quarterly management meetings, which works as long as every required input is covered and recorded somewhere across the cycle.

If you are working towards certification, plan for at least one complete management review, and at least one full round of internal audits, before the certification body's stage 2 audit. Without them the auditor has no evidence that the system is being checked and steered by management.

Running a review that is worth having

The reviews that work best are prepared, not improvised:

1. Build the agenda from the required inputs, so nothing is missed and the minutes follow the same order.
2. Collect the data beforehand: audit results, complaints, objective tracking, supplier performance and corrective action status. The meeting should be for discussing the evidence, not gathering it.
3. Make sure top management is in the room. The standards place the review with top management, and an auditor will look at who attended.
4. Record decisions, not discussion. Each action needs an owner and a due date, and each input should end in a conclusion, even if that conclusion is "no change needed".
5. Close the loop. The first item on the next agenda is the status of the last review's actions.

What auditors look for

An auditor will usually read the minutes of the latest review and follow a few threads. Were all the required inputs covered? Do the conclusions match the data? For example, did falling customer satisfaction lead to a decision, or was it just noted? Were the actions actually carried out? Minutes that list every input but record no decisions are a common finding. So are actions that disappear between one review and the next.

Common weaknesses

• Treating the review as a formality held only because the audit is coming up.
• Minutes copied from last year with the dates changed.
• No link between the review and the quality or environmental objectives.
• Resource needs raised year after year and never resolved.
• Reviewing the quality side properly and skimming the environmental side, or the reverse, in an integrated system.

Templates for your management review

Our ISO 9001 pack includes a Management Review Procedure, a Management Review Schedule, a minutes form laid out input by input, and an audit checklist for checking the review itself. The ISO 14001 and combined packs include the environmental and integrated equivalents. The Management Review Minutes form from each pack is in our free ISO templates download, so you can see the structure before you buy.

The guides below go deeper into each step, from setting the agenda to evidencing the actions.