--- title: "Management Review Isn't a Meeting: ISO 27001, 27701, 42001 Clause 9.3" description: "What Clause 9.3 management review requires in ISO 27001, 27701 and 42001: inputs, decisions, the evidence auditors expect, common findings and an agenda." image: https://www.cybercontrols.io/hubfs/Cybercontrols%20blog%20-%20Management%20review%20-%20header%201600x800.png --- [Skip to content](https://www.cybercontrols.io/blog/management-review-isnt-a-meeting-clause-9-3-iso-27001-27701-42001#main-content) [![Cybercontrols.io logo](https://www.cybercontrols.io/hs-fs/hubfs/cybercontrols-logo-white-bg-800.jpg?width=800&height=178&name=cybercontrols-logo-white-bg-800.jpg)Homepage](https://cybercontrols.io) - [Products](https://www.cybercontrols.io/blog/management-review-isnt-a-meeting-clause-9-3-iso-27001-27701-42001#products) - [Services](https://www.cybercontrols.io/blog/management-review-isnt-a-meeting-clause-9-3-iso-27001-27701-42001#services) - [Blog](https://www.cybercontrols.io/blog/management-review-isnt-a-meeting-clause-9-3-iso-27001-27701-42001#blog) - [About](https://www.cybercontrols.io/blog/management-review-isnt-a-meeting-clause-9-3-iso-27001-27701-42001#about) Get started - [Products](https://www.cybercontrols.io/blog/management-review-isnt-a-meeting-clause-9-3-iso-27001-27701-42001#products) - [Services](https://www.cybercontrols.io/blog/management-review-isnt-a-meeting-clause-9-3-iso-27001-27701-42001#services) - [Blog](https://www.cybercontrols.io/blog/management-review-isnt-a-meeting-clause-9-3-iso-27001-27701-42001#blog) - [About](https://www.cybercontrols.io/blog/management-review-isnt-a-meeting-clause-9-3-iso-27001-27701-42001#about) Get started ![Tony the Auditor quote: Management review isn't a meeting, it's a decision with minutes, with four Clause 9.3 requirements](https://www.cybercontrols.io/hs-fs/hubfs/Cybercontrols%20blog%20-%20Management%20review%20-%20header%201600x800.png?width=1600&height=800&name=Cybercontrols%20blog%20-%20Management%20review%20-%20header%201600x800.png) # Management Review Isn't a Meeting: ISO 27001, 27701, 42001 Clause 9.3 ![Marius van Aswegen](https://www.cybercontrols.io/hs-fs/hubfs/marius-van-aswegen.jpg?width=48&height=48&name=marius-van-aswegen.jpg) Marius van Aswegen October 30, 2026 **In short:** Tony the Auditor's quote this week is "Management review isn't a meeting. It's a decision with minutes." Clause 9.3 of ISO 27001, ISO 27701 and ISO 42001 asks top management to look at how the management system is performing and decide what to change. What an auditor wants to see is a defined set of inputs, a record of the decisions taken, and evidence that those decisions were acted on. Here is what the standards require, what auditors look for, the findings we raise most often, and an agenda you can use. ## What Clause 9.3 asks for All three standards share the harmonised structure, so Clause 9.3 reads almost identically in each. Top management must review the management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness. Suitability asks whether the system still fits the organisation. Adequacy asks whether it is enough. Effectiveness asks whether it is achieving what it was set up to achieve. Two phrases do a lot of work. "Top management" means the people who direct and control the organisation, not the compliance lead presenting to themselves. "Planned intervals" means you set the frequency, write it down and keep to it. Annual is common. Parts of the agenda can sit in regular leadership meetings, provided every input is covered across the cycle. ## The required inputs The core inputs, common to all three standards, are: - the status of actions from previous management reviews; - changes in external and internal issues relevant to the system; - changes in the needs and expectations of interested parties; - information on performance, including trends in nonconformities and corrective actions, monitoring and measurement results, and audit results; - opportunities for continual improvement. ISO 27001:2022 adds the fulfilment of information security objectives, feedback from interested parties, and the results of risk assessment with the status of the risk treatment plan. ISO/IEC 27701:2025 is now a standalone privacy information management system rather than an extension to ISO 27001, so the privacy system needs its own review, or a clearly separate strand of an integrated one, covering privacy risks, controller and processor obligations, data subject requests and privacy incidents. For ISO/IEC 42001:2023, an auditor will expect the performance picture to include your AI risk assessment, your AI system impact assessments and how the AI systems in scope are performing against their objectives. One point worth getting right. ISO 27001 Amendment 1 (2024) did not add a new management review input. It added a requirement in Clause 4.1 to determine whether climate change is a relevant issue, and a note in Clause 4.2 that interested parties can have climate-related requirements. Because changes in external and internal issues are already an input, your review should confirm whether that determination still stands. A single considered sentence is often enough. ## The required outputs The results of the review shall include decisions related to continual improvement opportunities and any needs for changes to the management system, and documented information must be available as evidence of those results. Decisions, not discussion. A minute that says "the board noted the risk register" records attendance. A minute that says "the board accepted the residual risk on supplier X until March and approved budget for phishing-resistant MFA, owner and date attached" records a management review. ## What auditors actually look for - A planned schedule, and evidence the review happened when planned. - Top management in the room, with names and roles recorded. - Every required input visibly addressed, ideally in the order of the clause. - Decisions with owners and dates, carried into an action log. - Traceability: those decisions turning up later in objectives, the risk treatment plan, budgets or the Statement of Applicability. Certification bodies also expect to see at least one completed management review, alongside an internal audit, before the stage 2 audit. ## The nonconformities we see most often - A mandatory input missing, most often changes in interested parties or the status of previous actions. - Minutes that record a presentation but no decisions. - Actions with no owner or date, or last year's actions quietly dropped. - Top management absent, with the review delegated to the person who runs the system. - A review held a week before the audit, built for the auditor rather than the business. - An integrated review that covers ISO 27001 thoroughly and gives privacy or AI a single line. ## A practical agenda and minutes template One integrated review can cover all three standards, provided each input is addressed for each system. This is the agenda we recommend: 1. Attendees, apologies and the scope of the review. 2. Actions from the last review: closed, open and overdue. 3. Changes in context and interested parties, including whether climate change remains relevant. 4. Performance: objectives, metrics, nonconformities and corrective actions, audit results and incidents. 5. Risk: security, privacy and AI risk assessment results, impact assessments and treatment plan status. 6. Feedback from customers, staff, suppliers and regulators. 7. Opportunities for improvement. 8. Decisions: changes to the system, objectives, resources and risk acceptance. 9. New actions, each with an owner and a due date. Write the minutes under the same headings. If an auditor can match each heading to a line in Clause 9.3, testing this clause takes minutes. ## From clauses to controls This post closes our Clause 4 to 10 series. From next week, Tony moves on to Annex A with a new series, "Show me the evidence", taking one control at a time: what good evidence looks like, how an auditor tests it, and how to fix a finding. Cybercontrols holds [ISO 27001](https://www.cybercontrols.io/it-compliance/iso-27001-certification) and [ISO 42001](https://www.cybercontrols.io/it-compliance/iso-42001-certification) certification ourselves, and our own management review is held to the same test. If you would like an independent look at yours before the certification body arrives, our [internal audit service](https://www.cybercontrols.io/it-compliance/iso-27001-internal-audit) covers ISO 27001, ISO 27701 and ISO 42001, led by senior lead auditors who also audit for certification bodies. [Book a free scoping call](https://www.cybercontrols.io/contact) or email [hello@cybercontrols.io](mailto:hello@cybercontrols.io). And for a new piece of audit advice every Friday, [meet Tony](https://www.cybercontrols.io/tony-the-auditor). *Marius van Aswegen is founder and CEO of Cybercontrols and a senior lead auditor and implementer.* ## Share this post [mailto:https%3A%2F%2Fwww.cybercontrols.io%2Fblog%2Fmanagement-review-isnt-a-meeting-clause-9-3-iso-27001-27701-42001](mailto:https%3A%2F%2Fwww.cybercontrols.io%2Fblog%2Fmanagement-review-isnt-a-meeting-clause-9-3-iso-27001-27701-42001) ## Keep reading ### [![Cybercontrols graphic: Patch it, mitigate it, or take it offline. A five-point check for the NCSC's PHP alert: find every PHP system, update and harden, mitigate or go offline, check for compromise, watch your vendors.](https://www.cybercontrols.io/hs-fs/hubfs/blog-images/cybercontrols-blog-php2shell-header-1600x800.png?width=1600&height=800&name=cybercontrols-blog-php2shell-header-1600x800.png) PHP2Shell: What the NCSC's PHP Alert Means for UK SMEs, and What to Do This Week](https://www.cybercontrols.io/blog/php2shell-what-the-ncscs-php-alert-means-for-uk-smes-and-what-to-do-this-week) ### [![Tony's auditor quote of the day: A nonconformity isn't a failure. It's free advice with a deadline. What Clause 10.2 asks of you: react and correct, find the real cause, act so it cannot recur, review and record. Cybercontrols.io](https://www.cybercontrols.io/hs-fs/hubfs/Cybercontrols%20blog%20-%20Nonconformity%20-%20header%201600x800.png?width=1600&height=800&name=Cybercontrols%20blog%20-%20Nonconformity%20-%20header%201600x800.png) A Nonconformity Isn't a Failure: How to Handle ISO Audit Findings Well](https://www.cybercontrols.io/blog/a-nonconformity-isnt-a-failure-how-to-handle-iso-audit-findings-well) [![Cybercontrols.io logo](https://www.cybercontrols.io/hs-fs/hubfs/cybercontrols-logo-white-bg-800.jpg?width=800&height=178&name=cybercontrols-logo-white-bg-800.jpg "Cybercontrols.io logo")](https://cybercontrols.io) - [Products](https://www.cybercontrols.io/blog/management-review-isnt-a-meeting-clause-9-3-iso-27001-27701-42001#products) - [Services](https://www.cybercontrols.io/blog/management-review-isnt-a-meeting-clause-9-3-iso-27001-27701-42001#services) - [Blog](https://www.cybercontrols.io/blog/management-review-isnt-a-meeting-clause-9-3-iso-27001-27701-42001#blog) - [About](https://www.cybercontrols.io/blog/management-review-isnt-a-meeting-clause-9-3-iso-27001-27701-42001#about) --- Privacy Policy · Legal · © 2026 CyberControls. All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Marius van Aswegen", "url" : "https://www.cybercontrols.io/blog/author/marius-van-aswegen" }, "dateModified" : "2026-10-30T06:38:04.562Z", "datePublished" : "2026-10-30T06:38:04.000Z", "headline" : "Management Review Isn't a Meeting: ISO 27001, 27701, 42001 Clause 9.3", "image" : [ "https://www.cybercontrols.io/hubfs/Cybercontrols%20blog%20-%20Management%20review%20-%20header%201600x800.png" ], "mainEntityOfPage" : { "@id" : "https://www.cybercontrols.io/blog/management-review-isnt-a-meeting-clause-9-3-iso-27001-27701-42001", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.cybercontrols.io/hubfs/cybercontrols-logo-white-bg-800.jpg" }, "name" : "CyberControls" } } ```