Management review is a requirement in all modern ISO management system standards. Yet many organisations carry out this process as an administrative ritual without real value. In this guide, we explain what management review is, what the ISO standards require, and how to make it a strategic tool rather than a burden.
Important to know: This article provides practical guidance on management review based on ISO requirements. For the exact standard text, you need access to the official ISO standards.
Management review is a formal process where your top management (the management team) reviews the management system. The purpose is to verify that the system works, delivers the right results, and supports your business strategy.
All modern ISO management system standards require this in clause 9.3:
Thanks to ISO's common framework, all these standards have identical requirements for management review. This means companies with multiple certifications can conduct an integrated process covering all systems.
The ISO standards require management review for five strategic reasons:
1. Engage leadership
Management systems must not become isolated projects run solely by the quality or environmental manager. Top management (the management team) must be involved and take responsibility.
2. Connect the system to strategy
The management system should support your business strategy, not run as a parallel track. Management review confirms this is the case.
3. Review performance
You review measurement data and results to see if the system delivers the desired effect. Are your processes working? Are you achieving your objectives?
4. Decide on improvements
Based on data, you make concrete decisions about changes, improvements, and priorities.
5. Allocate resources
You determine what resources (personnel, budget, tools) are needed for the management system to function.
The requirements for management review are essentially identical in ISO 9001, 14001, 45001, and 27001. Here is what you need to go through.
Follow-up from last timeStart by reviewing what you decided at the previous review. Have the actions been implemented? Did you achieve the expected effect?
Changes in the external environment and organisationHas anything significant happened since last time? New legislation, changed customer requirements, reorganisation, new products or services?
How you are performingReview key metrics and trends:
ResourcesDo you have enough personnel, the right competencies, and functioning tools?
Risks and opportunitiesIs your risk management working? Have new risks emerged? Are you capitalising on opportunities?
Improvement suggestionsWhat ideas have come in? Where are the bottlenecks?
Standard-specific inputsDepending on which standards you are certified to, you also need to address:
Management review should result in concrete decisions on:
ImprovementsWhat improvement actions should you implement? Who is responsible and when should it be completed?
Changes to the management systemDo you need to change processes, update policies, or introduce new working methods?
ResourcesWhat budget, personnel, or competencies are needed going forward?
Save minutes and supporting materials from the review. The certification auditor will want to see them.
Here is how you conduct an effective management review:
Set date and participants
Create agenda
Structure the agenda according to the ISO requirement inputs:
Total time: approximately 2–2.5 hours
Prepare documents
Send out materials
Share the supporting materials at least one week in advance so participants can prepare. A summary of 5–10 pages works better than 50 pages of raw data.
Focus on decisions, not just reporting
Document in real-time
One person takes notes on decisions directly in the minutes. Document:
Examples of concrete decisions:
Send out minutes
Send the minutes within 48 hours while the discussion is fresh.
Track actions
Add decided actions to your action tracking system or project plan. Follow up regularly.
Archive evidence
Save minutes and supporting materials. Certification auditors will review these.
Management review becomes concrete when you link it to a clear, reusable checklist. Without structure, you easily miss areas or get stuck in discussions without decisions.
AmpliFlow includes a complete management review checklist that systematically covers all requirements in 9.3.2 (inputs) and 9.3.3 (outputs). The checklist guides you through 18 main areas – from stakeholder analysis to final summary.
[IMAGE: Screenshot of AmpliFlow checklist left menu showing all 18 steps, from "Before Stakeholder Analysis Review" to "Management Review Summary"]
Each area in the checklist has two phases:
"Before" phase – The responsible person prepares the inputs before the meeting. The checklist specifies exactly what to check and update.
"Review" phase – The management team reviews the inputs and makes decisions. The checklist indicates what should be documented.
The structure separates preparation from decisions and ensures the right people do the right things.
Here is an overview of what a complete management review covers:
Here is what "Before Customer Requirements Review" contains in AmpliFlow:
The responsible person checks before the meeting:
[IMAGE: Screenshot of AmpliFlow checklist "Before Customer Requirements Review" with checkboxes and link to customer requirements matrix]
Question for management: "Are there new or changed customer requirements that management needs to be informed about?"
At "Customer Requirements Review": The management team makes decisions and documents them, e.g.: "The following new customer requirements have been identified: X. Management decides that Y is responsible for updating working methods by Z."
The AmpliFlow checklist gives you:
[IMAGE: Screenshot showing how a decision from management review creates a trackable action in AmpliFlow]
Without a structured checklist, it often happens that:
With AmpliFlow's checklist, you know exactly what to do, who is responsible, and when it should be completed. You avoid building your own structure – and can focus on content instead of form.
The ISO standards say "at planned intervals" – you decide the frequency yourself. Here is how to choose:
Suits you if:
Common timing:
Suits you if:
Suits you if:
Important: "Planned intervals" means you decide frequency in advance and maintain it. You cannot wait until the auditor asks and improvise.
Symptom: You go through a checklist, nod, and finish in 30 minutes without real decisions.
Solution: Prepare data in advance so time can focus on discussion and decisions. Ask questions: "What does this mean for our strategy?" "What actions should we take?"
Symptom: The quality manager conducts management review with their team without the management team participating.
Solution: The ISO requirement is clear – top management (the management team) should participate. Book in the management team well in advance and explain why they must be present.
Symptom: You go through some key metrics but miss half of the ISO requirements for inputs.
Solution: Use a checklist based on 9.3.2 in your standard. Tick off all points in the agenda.
Symptom: The minutes say "we note that customer satisfaction is declining" but no action is decided.
Solution: Every problem you find should lead to: decision on action, responsible person, and deadline. If you choose not to act, document why.
Symptom: Thin notes without evidence of what decisions were made or what inputs were reviewed.
Solution: Create a template for minutes that covers all ISO requirements. Attach inputs (key metrics, audit reports) as appendices.
Symptom: Last year's decisions are forgotten, no actions are implemented.
Solution: The first item at every review is status from the previous one. Track actions in a system and follow up quarterly.
"Can't we just address this at our regular management team meeting?" Understandable question, but there are important differences:
Management review aims to review the management system strategically. It occurs at planned intervals (often annually) and focuses on the system's suitability and effectiveness. The inputs are defined by ISO standard (9.3.2), and the outcome is specific decisions that ISO requires. Documentation is a formal protocol for certification.
Management team meeting aims to run operations. It occurs regularly (weekly or monthly) and focuses on daily issues and projects. The agenda is free and based on needs, and the outcome is operational decisions and follow-up. Documentation is regular meeting minutes.
Can you combine them? Yes, but only if:
Management review is the executive management's responsibility and focuses on the management system according to ISO requirements. Participants are the management team and system managers, and requirements come from the ISO standard.
Board meeting is the board's (owner representatives') responsibility and focuses on corporate governance from an owner perspective. Participants are board members and CEO, and requirements come from company law and articles of association.
Management review is the executive management's responsibility, not the board's. They cannot replace each other.
Management review means top management reviews the system. The outcome is decisions on system changes.
Internal audit means the auditor reviews compliance. The outcome is non-conformities and recommendations.
Internal audit results are inputs for management review – internal audit provides data that management uses. Internal audit is a tool that provides inputs to management review, but not the same thing.
Management review is just one part of a management system. What makes a real difference is how well all parts connect – from daily non-conformities to annual strategic review.
AmpliFlow is a complete management system where all the tools you need are gathered:
Stakeholder analysis and context
Your stakeholder analysis is in AmpliFlow. At management review, you click the link in the checklist and see current data – no manual compilation needed. Read more in our guide on stakeholder analysis in ISO 9001. Want to deepen the context analysis with SWOT? That's included in our MAXI package where you get help from a management consultant.
Customer requirements matrix and legal register
All customer requirements and legal requirements are registered with status, responsible party, and how you fulfil them. The checklist leads you directly to the right view.
Risk register
Your risk management provides direct inputs on how well you are handling risks and opportunities. See our guide on operational risk management.
Objectives and KPIs
Quality objectives and environmental objectives gathered in one place. You track objective achievement continuously, not just at annual review.
Non-conformity dashboard
All non-conformities, customer feedback, and improvement suggestions are gathered with grading and trends. Filter by severity, time period, or process – you create the inputs in minutes instead of hours.
[IMAGE: Screenshot of AmpliFlow non-conformity dashboard with graph showing non-conformities by severity level]
AmpliFlow's cloud library contains ready-made checklists for management review according to ISO 9001, 14001, 45001, and integrated systems. The checklist:
Automatic archiving
Minutes and supporting materials are saved with version and timestamp. You can always go back and see exactly what you decided.
Complete audit trail
When the certification auditor asks "Show me the latest management review," you retrieve everything in seconds – checklist, inputs, decisions, and follow-up.
Actions that are followed up
Decisions from management review become actions with responsible party and deadline. The next review starts with a status report on what has happened.
[IMAGE: Screenshot showing how management review minutes are archived in AmpliFlow with links to decided actions]
If you are certified to multiple ISO standards (e.g. ISO 9001 + ISO 14001 + ISO 45001), you can conduct one management review for all systems simultaneously. Here is how:
Create integrated agenda
Structure the agenda so each input area covers all standards:
Example: Performance and objective achievement
Gather standard-specific inputs
Some input requirements are unique to each standard:
Group these under common headings for flow.
Standard-specific focus in management review
Management review according to ISO 14001 focuses on environmental aspects, legal compliance, and environmental performance. Management review according to ISO 45001 requires employee consultation, incident analysis, and occupational health and safety objectives. Management review according to ISO 9001 reviews supplier performance, product conformity, and customer satisfaction. By integrating these into one process, you get a holistic perspective on your operations.
One protocol, clear connections
Write one joint protocol but be clear about which decisions relate to which standard:
Example:
Management review does not have to be an administrative burden. When you do it right, it becomes a strategic tool that:
If you want to do it yourself:
If you want support:
AmpliFlow gives you:
Management review is just the beginning. With AmpliFlow, you get a complete management system where everything connects – from the employee's non-conformity report to management's strategic decisions.
[IMAGE: Screenshot of AmpliFlow main menu showing all tools: Processes, Risks, Objectives, Non-conformities, Audits, Checklists, etc.]
Related articles:
Want to see how it works? Book a demo so we can show you how AmpliFlow's management review checklist works in practice.
