ISO 9001 Management Review: How to Run One That Passes Audit and Is Actually Useful

Management review is the meeting where top management looks at how the quality management system is performing and decides what to do about it. ISO 9001 requires it under clause 9.3, tells you what has to be on the agenda, tells you what has to come out of it, and requires you to keep minutes. It is one of the few places in the standard where the auditor can see leadership engaging with the system directly, which is why they read the minutes closely.

Done badly, it is a form filled in once a year the week before the audit. Done well, it is the business’s quarterly operations review with a few extra items on the agenda. This guide covers what the clause requires, a working agenda, how often to hold it, and the minutes template from our toolkit. For where clause 9.3 sits in the standard, see the ISO 9001 clauses guide.

Download the free management review minutes template (Word)

The template has the meeting details, the full inputs agenda in order, a discussion notes section, and an outputs table for decisions and actions with owner, due date and status. The example entries show the level of detail that works. No sign-up needed.

What clause 9.3 requires

Three things.

It happens at planned intervals. The standard does not say how often. Once a year is the minimum most certification bodies accept; quarterly is what works for most small businesses, because the inputs are then recent enough to act on.

It considers a defined list of inputs. The agenda is not yours to choose; clause 9.3.2 lists what must be covered (below). You can add items, you cannot drop them.

It produces defined outputs. Decisions and actions on improvement opportunities, on changes needed to the QMS, and on resources (9.3.3). Minutes with no decisions in them are a finding.

The required inputs

Every management review must consider:

• The status of actions from previous reviews
• Changes in external and internal issues relevant to the QMS (your clause 4.1 context)
• Customer satisfaction and feedback from relevant interested parties
• The extent to which quality objectives have been met
• Process performance and conformity of products and services
• Nonconformities and corrective actions
• Monitoring and measurement results
• Audit results (internal and external)
• The performance of external providers (suppliers and subcontractors)
• The adequacy of resources
• The effectiveness of actions taken to address risks and opportunities
• Opportunities for improvement

That is twelve items, which sounds like a long meeting. It is not, if the data exists. Each input is a two-minute item when someone brings the number and a one-line commentary. It is a long meeting when the data has to be assembled in the room.

The required outputs

The minutes must record decisions and actions on:

• Opportunities for improvement
• Any need for changes to the QMS
• Resource needs

In practice that means an actions table: what was decided, who owns it, when it is due, and its status at the next review. The first input of the next review is the status of these actions, so the loop closes.

A working agenda

This is the agenda in the minutes template, which follows the inputs in order so nothing is missed:

1. Actions from the last review: status of each
2. Changes in context: anything in the market, the regulations, the organisation or the customer base that affects the QMS
3. Customer satisfaction: survey results, complaints trend, repeat business, anything from interested parties
4. Quality objectives: each one, with its current value against target and a RAG status
5. Process performance: the KPIs for the core processes, and any product or service conformity issues
6. Non-conformances and corrective actions: numbers opened and closed, anything overdue, anything repeating
7. Monitoring, measurement and audit results: internal audit findings since the last review, any certification audit findings
8. External providers: supplier performance, any problems, any changes to the approved list
9. Resources: are people, equipment, systems and budget adequate for what the QMS is being asked to do
10. Risks and opportunities: whether the actions taken worked, anything new
11. Improvement opportunities: from any source
12. Decisions and actions

A quarterly review of a ten-person business on this agenda takes about an hour with prepared inputs.

How to make it useful rather than ceremonial

Hold it as a business meeting. If you already have a monthly or quarterly leadership meeting, add the agenda items to it rather than creating a separate ritual. The standard does not require a separate meeting; it requires the inputs to be considered and the outputs to be recorded.

Bring numbers, not impressions. “Customer satisfaction is fine” is not an input. “Satisfaction score 4.5 out of 5, up from 4.2, eleven responses, two complaints both closed” is.

Make the objectives the centrepiece. The objectives review is where the policy commitments turn into a conversation about whether the business is delivering them. If an objective is amber, the review should decide what to do, not just note it.

Record decisions, not discussion. Nobody needs three pages of narrative. Decision, owner, date, status.

Let it change things. The review has the authority to change the QMS, reallocate resources and set new objectives. If the minutes never show it doing any of those, the auditor will conclude it is not really a review.

Worked example

A four-line extract from the kind of minutes that pass without comment, based on the template’s examples:

The third action is the one auditors like to see: a resource decision made by top management in response to QMS data.

How often

Annual is the minimum. Quarterly is what we recommend for a small business, and what we set up with clients, for three reasons: the inputs are current, the actions get followed up within a useful time, and the certification auditor sees a pattern rather than a single event. Larger or faster-moving businesses sometimes go monthly on the operational inputs with a fuller annual review.

If you also run ISO 27001, one combined review can cover both systems; the inputs overlap substantially and the leadership is the same. We cover running both standards together separately.

Mistakes auditors see most

• One review, held the week before the audit. The minutes are dated and the auditor can read a calendar.
• Inputs missing. External providers and the adequacy of resources are the two most often skipped.
• No actions. A review that considered everything and decided nothing.
• Actions never followed up. The next review does not start with the previous actions, so they stay open indefinitely.
• Top management absent. The quality manager held it alone. Clause 9.3 says top management shall review; they need to be in the room.

What changed in ISO 9001:2026

The mechanics are the same. The inputs list has grown to reflect the new emphases elsewhere in the standard: the review should now consider the quality culture and ethical behaviour that clause 5.1 asks leadership to promote, and risks and opportunities are considered separately rather than as one item, matching the split in clause 6.1. The organisational knowledge expectation in clause 7.1 also tends to surface here. If you are transitioning from 2015, the practical change is two or three extra lines on the agenda. The ISO 9001:2026 changes article has the full list.

Where to go next

The template is one of the 32 documents in the free ISO 9001 toolkit, alongside the objectives register and corrective actions log that feed into the review. Most of the inputs come from three other parts of the system: the quality objectives register, the non-conformance and corrective action logs, and the internal audit programme. If internal audit is the gap, we run independent internal audits for small businesses. If the whole system needs building, our ISO 9001 consultancy programme sets up the review cycle in the final workshop and runs the first one with you.

Frequently asked questions