The management review is a meeting where top management examines how the ISMS is performing and decides what to change. The minutes are the evidence. Good minutes show the inputs reviewed, the decisions made, who owns each action and the date. Auditors expect to see them.
Why auditors care
The review exists to keep the ISMS suitable, adequate and effective. It is also where leadership shows involvement. Guidance on clause 9.3 describes the minutes as a mandatory record. A missing or empty record is one of the easiest findings for an auditor to write.
What to bring as inputs
The standard lists required inputs. Check the current clause text for the exact list. In practice teams bring a short pack covering:
- Status of actions from the previous review.
- Changes in internal and external issues relevant to the ISMS.
- Results of internal audits and monitoring against your objectives.
- Nonconformities and corrective actions.
- Feedback from interested parties, such as customers.
- Risk assessment results and the state of risk treatment.
- Opportunities for improvement.
Keep the pack to a few pages. A twenty page deck that nobody reads is worse than a clear one pager.
What the minutes should say
Record the date, the attendees by name and role, and the inputs covered. Then record decisions, not discussion. For example: "Approved budget for a second backup test per year. Owner: head of infrastructure. Due: 30 March." Each action should have an owner and a date.
Also record decisions to change nothing, with a reason. "No change to scope this cycle" is a decision.
How often
Guidance says to hold the review regularly and to define the timing in advance. The standard does not set an interval in the guidance we reviewed. Many teams do it at least once a year, and some do it quarterly. Pick a rhythm you will keep and write it down.
Common mistakes
Leaving out top management is the most common one. A review run by the security analyst alone is not a management review. Another is reusing last year's minutes with the date changed. Auditors compare.
A one page agenda that works
Use the same order each time so the minutes are easy to compare across years. Start with actions from the last meeting, then the inputs one by one, then decisions, then new actions. Allow time at the end to confirm owners and dates aloud, because actions with no named owner rarely happen.
Send the pack at least a few days ahead. Ask each attendee to note one question. A review where leaders have read the material produces better decisions than one where they see it for the first time.
Keep the evidence trail
Store the pack, the minutes and the action list together. When the auditor asks what happened to an action from last year, you can show it closed with a date. If an action stayed open, show the reason and the new date.
If your top management is small, one person may play several roles. That is fine. Record the roles each person holds and who signed off.
Quick check
Can the review be part of a regular leadership meeting?
Yes, if the inputs are covered, decisions are recorded and the minutes are kept. Label that agenda item clearly.
Sources
Last reviewed: 19 October 2026.
