ISO 27001 Management Review: Agenda and Evidence
An ISO 27001 management review is a formal meeting in which top management examines whether the information security management system is still working, still suitable and still resourced. Clause 9.3 requires it at planned intervals, which in practice means at least annually. It runs 60 to 120 minutes, must consider seven specified inputs, and must produce recorded decisions. The minutes are the evidence your auditor will ask for.
Most organisations do the meeting and still pick up a finding, because the meeting covered six of the seven required inputs, or because the discussion happened but nobody wrote down a decision. The sections below set out the inputs, a workable agenda, and what the record needs to contain.
What does ISO 27001 clause 9.3 require?
ISO 27001 clause 9.3 requires top management to review the information security management system at planned intervals to confirm its continuing suitability, adequacy and effectiveness. The clause has three parts: 9.3.1 sets the general obligation, 9.3.2 lists the inputs the review must consider, and 9.3.3 requires documented information as evidence of the results.
Two words in that clause do a lot of work. The first is top management, which means the people who can actually commit money and change direction, not the person who maintains the ISMS. The second is planned intervals, which the standard deliberately leaves open. Annual is the norm and is what most certification bodies expect, though organisations going through heavy change often review every six months.
The review is one of three recurring obligations that keep certification alive, alongside the internal audit and the surveillance audit. They are related but distinct, and an auditor will check all three.
What are the seven inputs an ISO 27001 management review must cover?
Clause 9.3.2 lists the inputs an ISO 27001 management review must consider. Covering six of the seven is the most common cause of a nonconformity against this clause, so work from the list rather than from memory.
The inputs are the status of actions from previous management reviews, changes in external and internal issues relevant to the ISMS, the needs and expectations of interested parties, feedback on information security performance including nonconformities, monitoring results, audit results and the fulfilment of objectives, feedback from interested parties, the results of risk assessment and the status of the risk treatment plan, and opportunities for continual improvement.
Each input needs a source you can point to. Audit results come from your internal audit report and the certification body’s last report. Risk treatment status comes from the risk register and the Statement of Applicability. Interested party needs come from customer contracts and regulatory change. If an input has no source document, that is a gap in your ISMS rather than a gap in the meeting.
Who should attend an ISO 27001 management review?
An ISO 27001 management review must be attended by top management, meaning the people with authority to allocate budget and change direction. In a company of fifteen people that is typically the managing director and one or two others. In a larger organisation it is the executive team or a nominated security steering group with delegated authority.
A practical attendee list for an Australian SMB looks like this:
- The managing director or chief executive, who owns the resourcing decisions
- The ISMS manager or information security lead, who presents the inputs
- The head of technology or operations, who owns most of the controls
- A representative from sales or legal, who brings customer and contractual requirements
- The internal auditor, either attending or supplying their report in advance
The ISMS manager running the meeting is fine. The ISMS manager being the only decision maker in the room is not, and an auditor will notice. If your top management genuinely cannot attend a 90 minute meeting once a year, that itself is a finding about management commitment under clause 5.1.
How long does an ISO 27001 management review take and what is the agenda?
An ISO 27001 management review usually runs 60 to 120 minutes for a small to medium Australian organisation, with two to three hours of preparation by the ISMS manager beforehand. The meeting works best when the inputs are circulated in advance and the time is spent on decisions rather than on reading slides aloud.
| Agenda item | Time | What good looks like |
|---|---|---|
| Actions from the last review | 10 min | Each prior action closed, or a reason and a new date |
| Changes in context and interested parties | 15 min | New customers, new regulations, new systems named |
| ISMS performance, incidents and objectives | 20 min | Numbers against targets, not a narrative |
| Internal and external audit results | 15 min | Findings and their corrective actions |
| Risk assessment and treatment status | 20 min | Movement in the risk register since last time |
| Opportunities for improvement | 10 min | Suggestions raised and triaged, not just noted |
| Decisions, resources and actions | 20 min | Owners and dates assigned before anyone leaves |
Preparing the inputs is where the real effort sits. If you are starting from scratch, a gap analysis will tell you which of the seven inputs you can currently evidence.
How do you keep management review evidence organised?
The evidence for an ISO 27001 management review is the set of input documents you considered plus the minutes recording what was decided. Auditors ask to see both. The practical requirement is that each of the seven inputs can be traced to a dated document, and that every decision in the minutes has a named owner and a date.
Keeping management review evidence together is mostly an organisation problem. A spreadsheet and a shared drive are enough for a small ISMS, and a consultant can run the cycle for you. At the tool end, CertAssist publishes a flat list price of US$375 per month and holds registers and evidence in one workspace without connecting to your systems, while platforms such as Vanta and Drata automate evidence collection through deep integrations instead.
Whatever you use, the minutes themselves should be short and specific. A reviewer should be able to read them cold and see what was considered, what was decided, who owns each action and when it is due. Our guide to ISO 27001 mandatory documentation covers where the management review record sits alongside the rest of your documented information.
What goes in ISO 27001 management review minutes?
ISO 27001 management review minutes must record the results of the review, which clause 9.3.3 requires you to retain as documented information. At minimum the minutes name the date and attendees, confirm each required input was considered, capture the decisions reached, and list the resulting actions with owners and due dates.
- Date, attendees and apologies, so the auditor can confirm top management was present
- A heading for each of the seven inputs, with a line on what was considered and the source
- Decisions on changes needed to the ISMS, including scope, policy or objectives
- Decisions on resources, which is where budget and headcount commitments are recorded
- An action table with owner and due date for every action raised
- Sign-off by the chair, dated
The most common weakness is minutes that record discussion but no decision. If the outcome of an item was that nothing needed to change, write that down as a decision. Silence in the record reads as an input that was never considered. Australian organisations working to the standard can obtain the adopted version through Standards Australia.
Common questions
What is an ISO 27001 management review?
An ISO 27001 management review is a formal meeting where top management assesses whether the information security management system remains suitable, adequate and effective. Required by clause 9.3, it considers seven specified inputs covering audits, risks, incidents, objectives and interested party needs, and must produce recorded decisions on changes, improvements and resources. The minutes are retained as audit evidence.
What does ISO 27001 clause 9.3 require?
Clause 9.3 requires top management to review the ISMS at planned intervals. Clause 9.3.1 sets the obligation, 9.3.2 lists the inputs that must be considered, and 9.3.3 requires documented information as evidence of the results. The clause does not prescribe a frequency, but annual review is the norm and is what most certification bodies expect to see.
How often is an ISO 27001 management review required?
ISO 27001 requires management review at planned intervals rather than at a fixed frequency. In practice, almost all certified organisations review annually, and certification bodies expect at least one review in each certification year. Organisations going through significant change, such as a merger or a major platform migration, often review every six months instead.
Who should be in an ISO 27001 management review team?
The review must involve top management, meaning people who can commit budget and change direction. A typical Australian SMB attendee list is the managing director, the ISMS manager, the head of technology or operations, and someone from sales or legal who can speak to customer and regulatory requirements. The internal auditor attends or supplies their report in advance.
Do you need an ISO 27001 management review template?
A template is useful because it stops you missing one of the seven required inputs, which is the most common cause of a clause 9.3 nonconformity. Any template that lists the inputs as agenda headings and includes an action table with owners and due dates will work. The content and the decisions matter to an auditor far more than the document format.
Getting the review right
A management review that produces real decisions is one of the cheapest ways to keep an ISMS healthy, and one of the easiest to get wrong on a technicality. If you want help preparing the inputs, chairing the meeting or building the record your auditor will accept, our ISO 27001 services cover the full certification and maintenance cycle. Get in touch and we can look at where you are.