Quality Management
Management Review: How to Run a Meeting That Is Not a Formality
There is one record written in almost every company two weeks before the external audit. The date on it is three months old, three people attended, and the content is a list of bullet points copied from the standard, ending with the sentence “the system is adequate and effective”.
Auditors recognise it instantly — not because they are suspicious, but because such a record contains no decision at all. And the management review is precisely that: the place where decisions are made.
Key Takeaways
- Management review is required by clause 9.3 and is held “at planned intervals” — the standard does not say “once a year”; that is practice, not a requirement.
- The inputs are listed explicitly in 9.3.2, and omitting any one of them is the most common finding in this area.
- The output is decisions, not an opinion — on improvement, on changes to the system and on resources. A record with no decisions does not meet the requirement.
- Top management must take part. A review run by the quality manager alone is not a management review.
- Documented information is mandatory — the record is the evidence that the review took place.
- ISO 9001:2026 keeps clause 9.3 but raises expectations for evidence of management commitment.
What a management review is
A management review is a planned evaluation of the management system by top management, checking that it remains suitable, adequate, effective and aligned with the strategic direction of the organisation. Those four adjectives are not rhetoric — they are four separate questions:
| Criterion | The question behind it |
|---|---|
| Suitability | Does the system still fit what the company actually does today? |
| Adequacy | Does it cover all applicable requirements? |
| Effectiveness | Does it achieve the planned results? |
| Alignment | Does it work in the direction the business is heading? |
A company that added a production line or entered a new market in the past year almost certainly has a problem with the first criterion — the system describes yesterday’s organisation. That is the most useful finding a review can deliver.
The inputs: the list you cannot trim
- Status of actions from previous reviews — what was decided and what became of it.
- Changes in external and internal issues — new requirements, new competitors, new technology, changes in the team.
- Customer satisfaction and feedback from interested parties.
- Extent to which quality objectives have been met.
- Process performance and conformity of products and services.
- Nonconformities and corrective actions.
- Monitoring and measurement results.
- Audit results — internal and external.
- Performance of external providers.
- Adequacy of resources.
- Effectiveness of actions taken on risks and opportunities.
- Opportunities for improvement.
The most common finding in this area is a missing item from that list — usually the performance of external providers or the effectiveness of actions on risks. The auditor is not checking whether you made the right decisions; they are checking that you considered everything the standard requires. The simplest defence is an agenda that repeats the list verbatim.
The output: decisions, not observations
- Opportunities for improvement. Specifically what will improve, who owns it and by when.
- Need for changes to the management system. Scope, processes, documents, responsibilities, objectives.
- Resource needs. People, equipment, training, software, budget.
The test for a good record is simple: reading it a year later, you should be able to say what was decided and whether it happened. A record full of phrases like “noted”, “discussed” and “the system is functioning” does not pass that test.
A useful format for the three decisions: a table with four columns — what, who, by when, and how we will know it worked. The fourth column is what turns a decision into something measurable. It also becomes an input to the next review.
How often, and who attends
| Situation | Sensible frequency |
|---|---|
| Small organisation, stable activity | Once a year |
| Growing company or a new certificate | Twice a year |
| Several sites or an integrated system | Quarterly, in short form |
| After a serious incident or major change | An extraordinary review |
On attendance the standard is firmer: the review is by top management. That means people with authority to allocate resources. If nobody in the room can approve spending or change a priority, the meeting cannot produce a decision — and therefore is not a management review.
The usual mistakes
Mistake 1: the review is done for the auditor. A record written two weeks before the audit carrying a date from three months earlier is not just a formality but a risk — the mismatch between the document and reality usually shows.
Mistake 2: only the quality manager speaks. If half the agenda is one person presenting, the rest are an audience, not management.
Mistake 3: data without analysis. A table of 40 indicators with no conclusion is not an input to a decision. Five indicators with a comment on what they mean works better.
Mistake 4: decisions are not tracked. If last year’s decisions are not the first item on the agenda, the system is being reviewed rather than improved.
Mistake 5: one review for an integrated system that covers only quality. With an integrated system the agenda must include inputs from the other standards too — environmental aspects, safety incidents, the results of the relevant audits.
How it connects to the rest of the system
The management review is the last link in the improvement chain and depends entirely on the quality of its inputs. If the internal audit is superficial, if corrective actions close with “a briefing was held”, and if indicators are gathered at the last minute, the review has nothing to work with.
The reverse also holds: a well-prepared review makes the next certification audit considerably easier, because the auditor sees a system that corrects itself.
What changes with ISO 9001:2026
The new version of the standard, published on 16 September 2026, keeps clause 9.3 and the list of inputs. What changes is the weight of evidence for management commitment and quality culture. In practice this means the auditor will talk to top management rather than only read the record — and will judge whether the decisions in it are real.
The transition itself is covered in our article on ISO 9001:2026.
Want a review that delivers value rather than a record?
We prepare the agenda and the data, facilitate the meeting itself and frame the decisions so they stand up to an auditor and are achievable for your team.
Conclusion
The management review is the one point in the standard where the owner or managing director is obliged to look the quality system in the eye. Most companies waste that opportunity on forty minutes of formality once a year.
The alternative does not take more time — it takes a different agenda. Five indicators with analysis, a review of last year’s decisions, and three new decisions with an owner and a deadline. That fits into ninety minutes and, unlike the record saying “adequate and effective”, it leaves a mark on the following year.
Frequently Asked Questions
How often should a management review be held?
ISO 9001 requires the review to be held at planned intervals without specifying a frequency. In practice most organisations do it once a year, while growing companies and those with an integrated system hold it two to four times a year. What matters is that the interval is defined in advance and respected.
Who must attend the management review?
The review is carried out by top management — the people with authority to allocate resources and change priorities. It is good practice for the owners of key processes to attend as well, since they bring the data. A review conducted only by the quality manager does not meet the requirement.
What are the mandatory inputs?
Clause 9.3.2 requires consideration of the status of actions from previous reviews, changes in issues, customer satisfaction, the extent to which objectives were met, process performance, nonconformities and corrective actions, monitoring and audit results, the performance of external providers, the adequacy of resources, the effectiveness of actions on risks, and opportunities for improvement.
What must the record contain?
The record must contain decisions and actions relating to opportunities for improvement, any need for changes to the management system, and resource needs. Each decision should carry an owner, a deadline and a criterion for completion. The record itself is mandatory documented information and is the evidence that the review took place.
Can the review be held online?
Yes. The standard prescribes an outcome, not a format. The meeting may be in person, online or mixed, provided the participants are top management, all required inputs are considered, and decisions are taken and documented in a record.
Is one review enough for an integrated system?
Yes, one review is sufficient and even preferable, but the agenda must cover the inputs required by all applicable standards — for example environmental aspects and compliance under ISO 14001, or incidents and worker consultation under ISO 45001. Omitting inputs for one of the standards is a nonconformity.
Does ISO 9001:2026 change the review requirements?
Clause 9.3 and the list of inputs are retained in the new version published on 16 September 2026. What changes is the expected level of evidence for management commitment and quality culture, which in practice means the auditor will speak with top management rather than rely on the record alone.