ISO 27001 management review: inputs, outputs and evidence

What ISO 27001 clause 9.3 management review requires before certification

Clause 9.3 requires top management to review the information security management system (ISMS) at planned intervals against defined inputs, and to record defined results. The organization owns this review. An implementation partner can prepare the inputs, draft the agenda and help structure the minutes, but it cannot hold the review, make the decisions or sign off the outcomes on the organization's behalf. Certification bodies do not certify the review either. They test whether it ran, whether the inputs were the ones the standard requires, and whether the results were recorded and acted on.

Because the review is an organizational activity, its content depends on the organization's own ISMS maturity, scope and audit history. A first review after a new ISMS is set up will look different from the third review of a mature system with several internal audit cycles behind it. Before the first review, confirm who sits on top management, which decisions they are authorized to take, and where the minutes will be stored and version controlled. Also confirm that the inputs already exist: results from monitoring and measurement under clause 9.1, internal audit outcomes under clause 9.2, and the status of nonconformities and corrective actions under clause 10.2.

Check that each input has a source record before the meeting, not after. Auditors commonly ask for the internal audit programme and reports, the open and closed corrective actions, and the measurement results that the review relied on. A review whose minutes describe results that cannot be traced to these records is hard to defend at the certification audit. Ask your certification body, in writing, which records it expects to sample for the review, and plan the first review so that it covers every input the standard names, even where the findings are small.

Which inputs and results the management review must cover

Clause 9.3 sets two sides of the management review: the inputs top management must see, and the results it must record. The cards below explain each input and result in plain terms so the minutes show that every required topic was actually discussed. Confirm exact wording against the licensed text of ISO/IEC 27001:2022 before you build your agenda.

Status of actions from earlier reviews

The first input asks whether actions agreed at previous management reviews have been completed. Auditors expect each action from the prior minutes to appear with an owner, a status and a closing note, or a reason for carrying it forward. Keep the action log as a dated record so the current review can show follow-through. Check that open actions have new target dates rather than silently dropping off the agenda.

Changes in external and internal issues

Top management must review changes in the issues that shape the ISMS, including regulation, customer demands, technology, business strategy and organizational changes. These issues come from the context work in clause 4.1, so the review should show whether the list still holds. Record each change and whether it affects scope, risk or objectives. A reviewer will look for evidence that the context register was checked, not just that the topic was mentioned.

Information security performance and nonconformities

This input covers feedback on how the ISMS performs, including nonconformities and corrective actions, and the results of monitoring and measurement. It links directly to the metrics defined under clause 9.1 and the corrective action process in clause 10.2. Present trends, not only snapshots, and state which nonconformities are open, closed or repeated. Auditors often test whether a repeated nonconformity was handled as a systemic issue.

Internal and external audit results

Top management should receive the results of internal audits under clause 9.2 and any relevant external audit findings. The review should show the number and severity of findings, their root causes and the status of corrective actions. Confirm that the internal audit programme covered the scope in the Statement of Applicability. Missing or thin audit input is a common reason auditors raise a finding against clause 9.3.

Interested party feedback and risk status

The review must consider feedback from interested parties, such as customer complaints, contractual security queries, regulator letters and staff concerns. It must also cover the results of the risk assessment and the status of the risk treatment plan, including residual risks accepted by management. Record which risks changed rating, which treatments are overdue and who approved any risk acceptance. Keep the risk register version in the minutes so the discussion can be traced.

Improvement opportunities

The final input asks management to consider opportunities for continual improvement. These can come from audit findings, incidents, tooling gaps or changes in staff capability. Good minutes list the candidate improvements, the reason each was proposed and whether it was accepted, deferred or rejected. This input feeds directly into the decisions recorded as results under clause 9.3.3.

How the management review links to internal audit and corrective action

The sequence turns measurement data and audit findings into management decisions and closed corrective actions, and each hand-off leaves a record that an auditor can sample. Clause 9 holds 9.1, 9.2 and 9.3, and clause 10.2 covers nonconformity and corrective action.

Monitor and measure the ISMS
Under clause 9.1, the organization monitors, measures, analyzes and evaluates the performance of the ISMS. Control owners, typically the security lead with system owners, record results for the controls, metrics and objectives they have defined. The output is a set of measurement results and trend analyses that show whether the ISMS is doing what it was set up to do. Check that each metric has a defined method, a responsible owner and dated results, because these records feed both the internal audit and the management review.
Run the internal audit programme
Clause 9.2 requires internal audits at planned intervals, split into general requirements in 9.2.1 and the internal audit programme in 9.2.2. An auditor independent of the area audited tests the ISMS against the organization's own requirements and the standard. The output is an audit plan, audit criteria, audit records and a list of findings classified as conformities, observations or nonconformities. Confirm that auditors are impartial and that the programme records the scope and criteria of each audit.
Prepare management review inputs
Clause 9.3.2 lists the topics that must be presented to top management. The ISMS coordinator assembles the status of actions from earlier reviews, changes in external and internal issues, feedback from interested parties, the monitoring results from step one, audit results from step two, and opportunities for improvement. The output is a dated pack of inputs that can be traced to its source records. Check that each input points to a record an auditor can open, not a summary written for the meeting.
Hold the review and record decisions
Top management evaluates the inputs at a planned meeting and reaches decisions. Clause 9.3.3 requires the results to cover decisions on continual improvement opportunities and any need for changes to the ISMS, along with resource needs. The output is approved minutes that name the attendees, the inputs considered, each decision and the owner of any follow-up action. Confirm that the minutes show top management actually deciding, because auditors check whether leadership involvement under clause 5 is visible in the record.
Raise nonconformities and corrective actions
Where the review or an audit finds a nonconformity, clause 10.2 requires the organization to react, decide whether action is needed to control and correct it, address its consequences, and review whether the cause has been removed. The output is a corrective action record that links the nonconformity, its root cause analysis, the action, and the evidence of effectiveness. Check that each action has an owner and that the record shows how the cause was identified, not only what was done.
Verify and close corrective actions
The action owner implements the fix and the internal audit function or the reviewer checks its effectiveness before the nonconformity is closed. The output is a closed record with the verification evidence and the date of closure, which can be carried into the next management review as a status item. Confirm that closure depends on evidence of effectiveness, since a corrective action marked complete without verification is a common finding in certification audits.
Feed outcomes into the next cycle
Decisions from the review, such as changed objectives, revised risk treatment or new internal audit focus areas, flow back into clauses 6 and 9.1 for the next cycle. The output is an updated set of objectives, audit programme and action log that the next review uses as its starting point. The sample an auditor typically takes covers the audit plan, the review minutes, the input pack and a selection of corrective action records, so confirm that each record in that sample links to the step before and after it.

How often to hold the review and what the certification cycle expects

The standard requires management review at planned intervals, but it does not fix a number of months, and the facts available for this page do not supply one either. That means the interval is a decision you make and document. Write it into your management review procedure, state who owns the calendar, and then keep to it. Confirm the chosen interval with your certification body before stage 1, because auditors test the records against the schedule you wrote, not against a generic figure. A review that is scheduled quarterly on paper but held once a year in practice will be read as a gap in performance evaluation, whichever interval you picked.

The certification cycle sets the outer boundary. Under ISO/IEC 17021-1, a management system certification runs for three years, and the certification body must carry out at least one audit, either a surveillance audit or the recertification audit, in every calendar year of that cycle (see the European Accreditation FAQ on the certification cycle). Each surveillance audit must include continuing operational control, so the auditor samples the ISMS in action, and the management review minutes are among the first records they pull. Plan the review dates so that at least one completed cycle of inputs and outputs exists before each surveillance visit.

If a review lapses in the middle of the cycle, the gap usually surfaces at the next audit as a nonconformity against clause 9.3, and it can also weaken the internal audit and corrective action records that depend on it. Treat the review calendar as a control with an owner, a reminder and a check: confirm each year that the planned reviews have occurred, record any deferral with the reason and the new date, and raise a corrective action if a meeting slips. Ask your certification body how it samples management review records across the cycle and whether a deferred review must be held before the next audit visit.

What certification auditors look for in the management review minutes

An auditor treats the management review minutes as evidence that clause 9.3 ran as a real governance step, not as a document written for the visit. When sampling, the auditor checks whether each meeting is traceable from the invitation to the decisions and then forward into the action log. The depth of that sampling is set by the certification body's audit programme, so confirm with your certification body how many review records it will examine and over what period.

Dates and attendance: Each record shows the meeting date, the participants and who was absent, with top management attendance or delegation visible.
Agenda against clause 9.3.2: Each input required by clause 9.3.2 has a visible agenda item or a clearly referenced pack section.
Recorded decisions and owners: Each decision names an owner and states what was agreed, not only that a topic was discussed.
Linkage to actions: Each action carries a due date and a status, and the auditor can trace it to the corrective action or improvement record under clause 10.2.
Carry-forward: Open actions from earlier meetings reappear with an updated status.

Before the visit, read the last two or three sets of minutes as an auditor would and confirm that each decision can be followed to a recorded outcome.

Who is paid for the management review work

This table compares who performs each part of the clause 9.3 management review work, whether the cost is one-time or recurring, and what drives the effort. No fee figures are given because none are supplied for this topic, so use the rows to structure a quote request and to see which costs stay inside the organization. The main takeaway is that the decisions, the minutes and the sign-off remain with top management, whoever prepares the material.

Component	Who performs it	One-time or recurring	What drives the effort
Top management review time	Top management and the ISMS owner, inside the organization	Recurring, at each scheduled review	Number of risks, open nonconformities, incidents and changes to report on
Internal audit staff or outsourced internal auditor	Internal auditors under clause 9.2, employed or contracted	Recurring, through the audit programme	Size and complexity of the ISMS, number of sites, and auditor independence from the work audited
Implementation partner preparing inputs and minutes template	Implementation partner, under a written scope, with organization sign-off	One-time to design the template, then periodic updates	Number of input sources to collect, degree of existing reporting, and how much of the evidence is already automated
Certification body auditing the records	Independent certification body, which issues the certificate	Recurring, at audits within the three-year cycle	Depth of sampling, number of reviews held since the last audit, and whether minutes show decisions and follow-up
Tooling for evidence and action tracking	Organization, with any vendor or open-source platform it selects	One-time setup, then recurring hosting and maintenance	Number of data sources, integration with ticketing and risk registers, and who maintains the platform
Corrective action follow-up	Control owners, with internal audit verifying closure	Recurring, after each review	Volume of nonconformities, root cause analysis effort and the time needed to verify effectiveness

What must be in place before the first management review

Clause 9.3 assumes the management system has already produced its inputs. Before the first review, the procedure, audit programme, monitoring results, risk treatment plan, corrective action log and minutes template should exist and show real activity, because an auditor will trace each review output back to these sources.

Documented review procedure

Write a procedure that sets the review interval, the attendees by role, the agenda mapped to the clause 9.3.2 inputs and the required outputs under clause 9.3.3. Check that top management, not only the ISMS manager, is named as attending, since clause 5.1 places leadership responsibility with top management. An auditor will ask for the approved procedure, its version history and the calendar invitations for the planned review dates.

Completed internal audit programme

Under clause 9.2.2, the organization must plan audits that consider the importance of the processes concerned, prior audit results and changes affecting the ISMS. Confirm that the programme exists, that auditors are independent of the areas they examine and that at least one audit cycle has produced findings. An auditor will ask for the programme, the audit plans, the reports and the records of who audited what.

Monitoring and measurement results

Clause 9.1 requires the organization to decide what to monitor, the methods, when monitoring occurs and when results are analyzed. Check that the chosen metrics have recorded values over time, not just definitions, and that someone has evaluated them against the information security objectives. An auditor will ask for the measurement log, the analysis of trends and the evidence that results were fed into the review agenda.

Current risk treatment plan

The risk assessment and risk treatment outputs must be up to date before the review, because clause 9.3.2 asks about changes in risks and the effectiveness of risk treatment. Confirm that each treatment has an owner, a status and a link to the Statement of Applicability. An auditor will ask for the risk register, the treatment plan and evidence that risks were reassessed after recent incidents or changes.

Corrective action log

Clause 10.2 requires the organization to react to nonconformities, correct them, deal with consequences and review whether the cause has been removed. Keep a single log that records each nonconformity from internal audit, monitoring or incidents, with root cause, action, owner and closure evidence. An auditor will ask to see open and closed items and how each one was verified as effective.

Minutes template and records

Prepare a template that captures the attendees, each clause 9.3.2 input as reviewed, the decisions and the actions with owners and due dates, mirroring clause 9.3.3 outputs. Store the template under document control with the other documented information required by clause 7.5. An auditor will ask for the minutes of the last review, the action items raised and proof that each action was tracked to completion.

Questions buyers ask about the ISO 27001 management review

Can a consultant run the ISO 27001 management review for us?

A consultant can prepare the review, but the organization must own it. Clause 9.3 is a meeting held by top management, so the people who chair it, make the decisions and sign off the results must be the organization's own leaders. An implementation partner can draft the agenda, collect the inputs from the risk register, audit reports and metrics, prepare the papers and record a draft of the minutes. Top management still has to read the inputs, discuss them and decide the outcomes. Certification auditors test that involvement through clause 5, so a review that a consultant ran alone will not show it. Ask any partner to state in writing which steps they prepare and which steps stay with your leaders.

How much time does the review take from top management?

The time depends on how many inputs the organization has to cover and how many decisions the meeting must reach, so no fixed duration applies to every organization. Top management spends time on the preparation papers, the meeting itself and the follow-up on actions assigned. Drivers include the number of in-scope sites and systems, the number of open nonconformities, changes to the context or risks since the last review, and whether the internal audit results are ready in time. A well-prepared pack lets leaders focus on decisions rather than data collection. Ask your implementation partner for a written plan that states the expected leadership hours and the papers each leader must read before the meeting.

Does the management review have to happen before the certification audit?

Yes. Before a certification audit, the ISMS must already have run its performance evaluation activities, which include monitoring and measurement under clause 9.1, internal audit under clause 9.2 and management review under clause 9.3. An auditor will look for records showing that at least one review has taken place and that its inputs and results were recorded. A review held only as a plan, or a review whose minutes were written after the audit was booked, gives the auditor little to test. Confirm with your certification body how it expects the review to be evidenced for your scope and what sample of records it will request during the stage 1 and stage 2 audits.

What if we have no internal audit yet?

You cannot skip it. Clause 9.2 requires the organization to conduct internal audits of the ISMS at planned intervals, and the management review depends on those results as one of its inputs. If internal audit does not exist yet, the first step is to define an audit programme that covers the ISMS scope, selects auditors who are independent of the work they check, and records the findings. Many organizations start with a small first cycle and expand it as the ISMS matures. Confirm with your certification body how it will treat an ISMS that has only just completed its first internal audit, because that choice affects when your first management review can be evidenced.

Does NIST CSF 2.0 need a separate governance review?

NIST CSF 2.0 does not require a separate review if your ISO 27001 management review already covers the relevant outcomes. The NIST Reference Tool maps the CSF outcome ID.IM-02 to ISO/IEC 27001 clauses 9.2, 9.3, 10.1 and 10.2 and to Annex A controls 5.19 and 5.35. This means one well-documented management review can serve as evidence for both frameworks, provided the minutes name the improvement decisions and the corrective actions clearly. Check the mapping yourself in the NIST reference export before you rely on it in an assessment, and confirm with your assessor which mappings they accept for your engagement.

Who checks the management review minutes?

The certification body's auditor checks the minutes during the certification audit and every surveillance audit, and the internal audit function checks them against the internal audit programme. Auditors test whether the minutes show the required inputs being considered, whether the results record decisions on improvement and resource needs, and whether top management is named as taking part. They also look for actions with owners and due dates that later appear as completed. Your implementation partner can help you prepare the records, but only the independent auditor issues findings or a certificate. Ask your auditor which level of detail they expect in the minutes before the first review takes place.

When to bring in an outside partner for the management review

The management review belongs to top management, and that boundary decides what an outside partner can do. The organization's top management must chair the review, take the decisions on its results and be able to show that it did so. An implementation partner can design the procedure, prepare the input pack, build the minutes template, and collect the evidence behind each agenda item, such as internal audit reports, nonconformity logs, objective measurements and changes in interested party requirements. The partner cannot decide the outcome, sign off the minutes on the organization's behalf or stand in for the leaders whose involvement clause 5 requires. Auditors will ask a manager to explain each decision, so that manager needs to have made it.

The certification body is the independent party that audits the review, and it must stay independent of the work that prepared it. Preliminary audit and consultancy impartiality rules apply here: a certification body that gave consultancy to the same client, or that carries a conflict of interest, must manage that risk under its accreditation requirements. Before you hire anyone, read the European Accreditation FAQ on consultancy and ask your certification body how it handles a partner that also prepared your management review pack. Confirm in writing which documents the partner drafted and which the organization approved.

Scope the engagement so the partner's deliverables are clear: a review procedure, an agenda and input checklist, a minutes template, and an evidence index that maps each input and result to where it is stored. Ask for a named owner on the client side for every decision, and confirm that the partner will not attend or speak for top management in the review itself. Plan for the recurring cost as well as the first cycle, because the review runs again each cycle and must keep pace with the three-year certification cycle described in the pillar. Ask the partner to show a sample pack from another engagement with client details removed, labeled as illustrative.

How DeployOpen prepares management review evidence

DeployOpen helps organizations prepare the systems, records and evidence that a management review under clause 9.3 draws on, while the organization runs the review itself. We do not issue audit reports or certificates; an independent certification body does that.

How we scope

The written scope lists which ISMS inputs the review must cover, such as audit results, risk changes and nonconformity status.
Scope names the owners who supply each input and the records they produce before each review meeting.
Engagements are fixed-scope, so deliverables and timelines for the review cycle are agreed in writing before work starts.

How we build

We configure ticketing, logging and reporting tools so that review inputs can be exported as dated, versioned records.
We set up templates for review agendas, minutes and action tracking that map each required input and result to a record.
We link management review actions to the internal audit programme and the corrective action log so the trail can be followed.

How we hand over

Handover includes documented procedures, the evidence register and a walkthrough showing where each input and result is stored.
Minutes are delivered as templates and examples that the organization completes, approves and retains itself.
Each deliverable is documented so internal staff can run the next review cycle without DeployOpen present.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer for keeping review evidence current.
Support can cover preparing inputs for a surveillance or recertification audit, with the organization retaining ownership of decisions.
Before any certification audit, confirm with your certification body which review records it will sample and how far back it looks.

ISO 27001 management review: inputs, outputs and evidence (clause 9.3)