ISO 9001 §9.3 management review: the required inputs

Management review is the clause most often held with the wrong agenda. ISO 9001:2015 clause 9.3.2 lists what the review shall be planned and carried out taking into consideration. The list is not a suggestion, and an auditor reads the minutes against it. This is the list, item by item, and what each one is there to do.

What the clause requires

Clause 9.3.1 sets the purpose: top management shall review the organization's quality management system, at planned intervals, to ensure its continuing suitability, adequacy, effectiveness and alignment with the strategic direction of the organization.

Clause 9.3.2 then lists the inputs. In the structure of the 2015 edition they are:

a) the status of actions from previous management reviews. The review starts where the last one ended. A review that does not revisit its own previous outputs has no way of knowing whether they were done.

b) changes in external and internal issues relevant to the quality management system. This connects the review to clause 4.1. The issues identified there are not static; the review is where their movement is considered.

c) information on the performance and effectiveness of the quality management system, including trends in: — customer satisfaction and feedback from relevant interested parties; — the extent to which quality objectives have been met; — process performance and conformity of products and services; — nonconformities and corrective actions; — monitoring and measurement results; — audit results; — the performance of external providers.

This is the largest input and the one most reviews compress into a single slide. The clause says trends, which means data over time rather than a snapshot, and it names seven things. A review that covers four of them has covered four of them.

d) the adequacy of resources. Whether the system has what it needs — people, infrastructure, environment, knowledge — to do what it is asked to do.

e) the effectiveness of actions taken to address risks and opportunities. The link to clause 6.1. Not whether risks were identified, but whether the actions taken about them worked.

f) opportunities for improvement. Distinct from the corrective actions in c), which respond to nonconformities. This input is the forward-looking one.

Why the list is a list

Each input closes a loop that another clause opened. Previous actions close the loop on the last review. External and internal issues close the loop on context. Performance data closes the loop on objectives, processes and monitoring. Resources close the loop on clause 7. Risks and opportunities close the loop on planning. Improvement opens the next one.

Read that way, management review is not a meeting. It is the point where every other clause reports back to the people who own the system. That is why the standard gives it to top management, and why an auditor treats the inputs as evidence rather than as an agenda.

Clause 9.3.3 requires the outputs to include decisions and actions related to opportunities for improvement, any need for changes to the quality management system, and resource needs — and clause 9.3.3 requires documented information as evidence of the results. Minutes that record attendance and a summary, without decisions, actions and resource needs, do not meet the clause.

How an auditor reads the minutes

Against the list. For each input in 9.3.2: was it considered, and is there evidence that it was? For the outputs in 9.3.3: are decisions, actions and resource needs recorded? Then against clause 9.3.1: were the intervals planned, and did top management take part rather than receive a report?

Absence of an input is a finding. So is an input that is named on the agenda and not actually examined — a line reading "audit results: discussed" with no results attached.

A note on the revision

ISO 9001:2026 was published in September 2026 as the sixth edition, replacing ISO 9001:2015 including Amendment 1:2024. Under the transition requirements issued by Global ACI, certificates to the 2015 edition remain valid until 30 September 2029 at the latest, and the clause numbers above are the 2015 edition's. In the 2026 edition, management review is set out in clauses 9.3.1 to 9.3.3, with the inputs in 9.3.2. This article will be updated against the published 2026 text when CAS's accredited certification moves to that edition.

What this means for you

If you run the review: put the seven trends in c) on the agenda by name, with data. That single change closes most management review findings we raise.

If you prepare it: start from the previous review's actions. Input a) is first for a reason.

If you are being audited: the auditor will read the minutes against 9.3.2 and 9.3.3. Read them the same way first.

CAS — An EGAC accredited MS certification body No. 012418. Accredited scope: ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO 50001 and ISO 22301. Certificates accredited for ISO 9001, 14001, 45001, 22000 and 50001 fall within EGAC's IAF MLA scope; ISO 22301 is accredited by EGAC and sits outside that scope.

Verify any certificate: cas.com.eg/certsearch