The management review agenda that satisfies Clause 9.3 combines three parts: a timed running order, a checklist of the required Clause 9.3 inputs, and a decision-and-action register with named owners and deadlines. That structure works for a routine 60 to 90 minute quarterly session and scales into a longer annual review without changing its backbone. Everything below shows you how to build and run it.
TL;DR:
- Map each agenda item to its Clause 9.3.2 input, attach dated evidence for all required inputs, and record a decision rather than discussion alone.
- Hold quarterly reviews with a fuller annual session, and add an ad hoc meeting after a major incident, significant scope change, or failed audit finding.
- Send the numbered agenda and evidence pack at least three working days ahead; include executives with budget authority, the ISMS owner, and relevant department heads.
- Give every action a named owner, deadline, acceptance criteria, evidence link, and independent verifier; update one master register monthly and carry closure proof forward.
- If risks related to climate affect your organization, document them under changes in relevant internal or external issues following the 2024 amendment.
Table of Contents
- What Clause 9.3 requires: purpose, scope, and definitions
- What changed in ISO/IEC 27001:2022 and the 2024 amendment
- Required management review inputs: an auditable checklist
- Audit-ready management review agenda template
- Preparing and running the review: attendees, materials, and roles
- Documenting results and the action register
- Following up: tracking, verifying, and closing actions
- What auditors check and findings to avoid
- How ISMS Calculator speeds up meeting prep
- Practical perspective: make reviews traceable, not ritual
- ISMS Calculator: build your audit-ready meeting pack
- FAQ
- Sources
What Clause 9.3 requires: purpose, scope, and definitions
Clause 9.3 of ISO/IEC 27001:2022 exists to make top management periodically confirm that the information security management system remains suitable, adequate, and effective. It is not a status update. It is a decision point where leadership either adjusts the ISMS or confirms it is on track, based on evidence rather than impressions.
“Top management” usually means the people who can commit budget, change policy, and reallocate staff: a chief executive, an operations director, a chief information security officer, or an equivalent group depending on organization size. In a small company this might be two people. In a larger one it might be a steering committee. Whoever attends must be able to approve resourcing and policy changes on the spot, or the review becomes a reporting exercise with no teeth.
The clause works on a simple chain:
- Inputs are gathered (audit results, incident data, risk status, metrics, feedback).
- Top management reviews those inputs against the ISMS objectives.
- Decisions and actions come out the other end, each with an owner.
Skipping any link in that chain is the most common way organizations fail this clause during audits.
What changed in ISO/IEC 27001:2022 and the 2024 amendment
The 2022 edition sharpened the language around continual improvement and tied management review more explicitly to risk treatment outcomes and resource decisions. A few shifts matter for how you build your review pack:
- Inputs now place clearer weight on the status of actions from previous reviews, not just new findings.
- The standard expects visible linkage between review outputs and resourcing or policy changes, not just a list of concerns.
- ISO/IEC 27001:2022/Amd 1:2024 adds climate action considerations to the standard, which can surface as a “change in external and internal issues” input where climate-related risk is relevant to your organization.
Where your review touches environmental or supply chain risk, the amendment gives you a defensible reason to document it as a formal input rather than an informal aside. For exact wording, treat ISO’s own standard text as the authoritative source rather than summaries, including this one.
Required management review inputs: an auditable checklist
Clause 9.3.2 lists specific inputs top management must consider. Treat this as a checklist you literally tick off in your meeting pack, because an auditor will look for each one by name, not by implication.
| Required input (Clause 9.3.2) | Evidence example | How to present it |
|---|---|---|
| Status of actions from previous reviews | Closed, open, and overdue action items with dates | Annotated action register extract |
| Changes in external and internal issues relevant to the ISMS | New regulation, market shift, climate-related exposure | One-page summary with date-stamped sources |
| Changes in needs and expectations of interested parties | Customer security questionnaires, regulator updates | Short bullet list with source and date |
| Feedback on ISMS performance, including trends in nonconformities and corrective actions | Internal audit findings, nonconformity log | Trend chart over the last two to four review cycles |
| Monitoring and measurement results | KPI dashboard, incident counts, patch compliance rate | Single dashboard screen or table |
| Audit results (internal and external) | Internal audit summary, certification body findings | One-page audit summary with open items highlighted |
| Fulfillment of information security objectives | Objective-by-objective status | Simple status table: on track, at risk, missed |
| Feedback from interested parties | Survey responses, complaints, partner feedback | Short narrative with representative examples |
| Results of risk assessment and status of the risk treatment plan | Risk register snapshot, treatment plan progress | Register extract filtered to high and medium risks |
| Opportunities for continual improvement | Suggestions log, lessons learned from incidents | Prioritized list with proposed next step |
The minimal acceptable version of this table is a bullet under each heading with a date and a source. Better practice replaces bullets with a chart or dashboard screenshot wherever a trend matters more than a single number, because top management reacts faster to a line going the wrong way than to a paragraph describing it.
Pro Tip: Keep every input on one page per item. If an input needs two pages to explain, it belongs in an appendix, not the main pack.
Audit-ready management review agenda template
Number every agenda item to match the Clause 9.3.2 input it covers. That numbering is what lets an auditor trace a line in the minutes straight back to the standard’s requirement, which is the single fastest way to close out a management review finding during certification or surveillance audits.
A timed 75 minute quarterly agenda:
- Opening and review of previous actions (10 minutes): Clause 9.3.2(a). Facilitator asks: which actions are closed, which are overdue, and why.
- External and internal context changes (10 minutes): Clause 9.3.2(b). Facilitator asks: what has changed since last quarter that affects our risk picture.
- Interested party needs and feedback (10 minutes): Clause 9.3.2© and (h). Facilitator asks: has any customer, regulator, or partner raised a new expectation.
- ISMS performance and audit results (15 minutes): Clause 9.3.2(d) and (f). Facilitator asks: what do the trend lines show, and what did the last audit find.
- Risk assessment and treatment plan status (15 minutes): Clause 9.3.2(g). Facilitator asks: which risks moved, and is the treatment plan on schedule.
- Objectives and improvement opportunities (10 minutes): Clause 9.3.2(e) and (i). Facilitator asks: are we hitting our stated objectives, and what should we try next.
- Decisions, resourcing, and action assignment (5 minutes): Clause 9.3.3 outputs. Facilitator asks: who owns each new action, and by when.
For an annual review, expand items 2, 4, and 5 to 20 to 25 minutes each and add a dedicated slot for a full-year trend review, since twelve months of data needs more room than one quarter’s update.
Pro Tip: Send the numbered agenda with the pre-read pack so attendees arrive already matching slides to clause numbers instead of asking what each section means.
Preparing and running the review: attendees, materials, and roles
The meeting succeeds or fails before it starts, based on who is in the room and what they have already read.
- Attendees: top management with budget authority, the information security manager or ISMS owner, and any department head whose area has open risk items.
- Pre-read pack: the numbered agenda, the input checklist with evidence attached, internal audit results, action register status, and a one-page risk register extract.
- Cadence: quarterly for most organizations, with a fuller annual session; add an ad-hoc review after a major incident, a significant scope change, or a failed audit finding.
- Chair: usually the ISMS owner or security manager, responsible for keeping time and making sure every numbered item gets a decision, not just a discussion.
- Scribe: records decisions and actions in real time, not from memory afterward.
- Action owner: the named person accountable for closing each action, distinct from whoever raised it.
- Evidence owner: the person who collects and attaches proof that an action is actually closed, which is often different from the action owner.
Circulating the pack at least three working days ahead lets attendees come with questions instead of spending meeting time reading for the first time.
Documenting results and the action register
Minutes that satisfy Clause 9.3.3 need to show the decisions made, not just the topics discussed. At minimum, record: each numbered agenda item, the input it addressed, the decision or conclusion reached, and any resulting action with an owner and a deadline.
- Write actions with four parts: owner, deadline, acceptance criteria, and a link to the evidence that will prove closure.
- Store minutes and the action register in a version-controlled location, with a date and version number on every revision.
- A minimal record lists the decision in one line. A recommended record adds the evidence reference and links back to the specific Clause 9.3.2 input number.
- Keep a single master copy of the action register rather than one per meeting, so action history is visible across review cycles.
Practitioner guidance on management review structure generally recommends mapping agenda items directly to the standard’s input list, which is exactly the traceability auditors look for when they pull a sample of minutes and ask you to show where a decision came from.
Statistic Callout: ISO/IEC 27001 frames management review as a keystone mechanism for continual improvement, meaning the review itself is audited evidence that your ISMS is actively managed, not a formality to file away.
Following up: tracking, verifying, and closing actions
An action register only earns its keep if actions actually close and that closure is provable.
- Build the register with columns for owner, deadline, status, verification method, and evidence link, so nothing closes without proof attached.
- Assign a verifier who is not the action owner, since self-verification is a common weak point auditors flag.
- Define what “closed” means before the action starts: a passed test, a new metric threshold, or a signed-off document, not just a status change.
- Update the register at a fixed cadence, such as monthly, so items do not sit untouched between quarterly reviews.
- Open each subsequent review with the status of prior actions, showing closed items with their evidence link rather than just a checkmark.
This loop, preparation leading to execution, execution leading to documentation, documentation leading to follow-up, is the structure practitioner guides and checklists consistently build management review around, because it is the sequence auditors expect to see evidence of.
What auditors check and findings to avoid
Auditors tend to pull a sample of past reviews and check for the same handful of things every time.
- Presence of every required Clause 9.3.2 input, not just the convenient ones.
- Clear evidence that a decision was made, not just that a topic was mentioned.
- Follow-up proof that prior actions were tracked to closure, with dates.
- Visible signs of continual improvement rather than the same findings repeating unaddressed.
Common nonconformities trace back to thin minutes that summarize discussion without recording a decision, missing evidence links so an action’s closure cannot be verified, and unclear ownership where two people assume the other is responsible. Committee guidance on auditing risk management processes notes that organizations may choose their own risk methodology, but the review must still show evidence that the chosen method was actually applied and reviewed.
Pro Tip: Before an external audit, pull your last two review packs and confirm every Clause 9.3.2 input has a dated evidence item attached. Gaps found now are cheap to fix; gaps found by an auditor are a finding.
If your organization handles basic technical controls alongside policy work, a practical checklist of small business security measures is a useful cross-check for the kind of day-to-day control evidence that ends up feeding your performance metrics input.
How ISMS Calculator speeds up meeting prep
Several review inputs are easier to produce with structured tools than with a blank spreadsheet.
- A readiness snapshot from the free 2-minute check gives you a quick baseline you can attach as evidence of current ISMS status.
- The ISO 27001 Readiness Assessment produces maturity scores across the four Annex A control themes, useful for the performance and objectives inputs.
- Exportable charts and Gantt timelines from the assessment work directly as the dashboard or trend-chart format auditors respond well to.
- A simple workflow: run the mini-assessment, export the resulting report, attach it to the meeting pack, then update the action register with any gaps it surfaces.
Each export carries a date and a defined methodology behind it, which matters when an evidence owner needs to explain where a number came from months later.
Practical perspective: make reviews traceable, not ritual
Numbering every agenda item to match its Clause 9.3.2 input is the single highest-value habit in this whole process. It turns a vague meeting into a document an auditor can trace line by line, and it forces whoever is chairing to notice when an input has been quietly skipped for two quarters running.
Reviews fail not from missing enthusiasm but from missing decisions: a room that discusses risk trends without naming an owner has produced nothing an auditor can credit. Scale the cadence to your organization’s maturity, a small team might run a lean quarterly check-in, while a larger one needs the fuller annual version, but never let the format replace the discipline of writing down who owns what and by when.
— Martin
ISMS Calculator: build your audit-ready meeting pack
We built our tools around the reality that most of the work in preparing a management review is gathering and formatting evidence, not deciding what to say. Our ISO 27001 Readiness Assessment scores your ISMS across the four Annex A control themes and exports a report you can drop straight into your meeting pack. Our free 2-minute check requires no signup and gives you an instant readiness snapshot to attach as evidence before your next review.
If budgeting for remediation work is part of your next agenda item, our ISO 27001 Cost Calculator gives you a tailored estimate based on your company size, industry, and current maturity, with editable assumptions you can challenge and adjust. Run a mini-assessment today and walk into your next review with evidence already in hand.
FAQ
What is the purpose of an ISO 27001 management review?
The purpose is for top management to confirm the information security management system remains suitable, adequate, and effective, and to make decisions on resourcing or policy changes based on documented evidence under Clause 9.3 of ISO/IEC 27001:2022. It is a decision point, not a status report.
How often should we hold an ISO 27001 management review?
Most organizations run a quarterly review with a fuller annual session, adding an ad-hoc review after a major incident or significant scope change. The right cadence depends on organizational size and ISMS maturity rather than a fixed rule in the standard.
What inputs must a management review cover under Clause 9.3.2?
Clause 9.3.2 requires inputs including the status of previous actions, changes in internal and external issues, interested party feedback, ISMS performance trends, audit results, objective status, and risk assessment and treatment plan status. Each input needs documented, dated evidence rather than a verbal update.
What should management review minutes include to satisfy auditors?
Minutes should record each agenda item against the Clause 9.3.2 input it addresses, the decision reached, and any resulting action with a named owner, deadline, and evidence link. Auditors specifically look for traceability between inputs, decisions, and follow-up closure.
Can ISMS Calculator help prepare evidence for a management review?
Yes, our ISO 27001 Readiness Assessment produces maturity scores and exportable reports across the four Annex A control themes that can serve as performance and objective evidence in a review pack. Our free 2-minute check also generates an instant readiness snapshot with no signup required.
Sources
- ISO/IEC 27001:2022 - Information security management systems
- ISO/IEC JTC 1/SC 27 N 23202 (committee guidance on auditing risk management processes)