An ISO 9001 management review is a meeting where top management examines data about the quality management system and makes decisions about it. Clause 9.3 requires the review at planned intervals, lists the exact inputs the meeting must cover, and names the outputs it must produce. You must keep records as evidence of the results.
The standard does not set a frequency. Many small manufacturers meet quarterly in the year before certification, because each review builds the records a Stage 2 auditor will sample. After certification, two to four reviews a year is a common rhythm. One real 60-90 minute meeting with current data is worth more than a thick set of minutes written the week before the audit. Auditors are trained to spot the difference.
This article gives you the full input list from clause 9.3.2, the output list from 9.3.3, a working agenda you can run this month, and the traps that generate audit findings.
What Management Review Is (and What It Is Not)
Clause 9.3.1 says top management shall review the quality management system at planned intervals. The review checks that the system is still suitable, adequate, and effective, and that it lines up with the company's strategic direction. Those words carry the intent: does the QMS still fit the business, does it have what it needs, is it working, and is it pointed the same way the company is.
Top management means the people who direct and control the company — the owner, president, or general manager, plus the leaders who control resources. The quality manager can build the data packet and run the meeting. But leadership must attend and make the decisions. An auditor who sees minutes signed only by the quality manager, with no sign that anyone with budget authority took part, will dig deeper.
It is a business meeting, not a ceremony. If your monthly ops meeting already covers scrap, delivery, and complaints, you are closer than you think. Management review adds structure: a defined input list, recorded decisions, and follow-through you can prove.
Required Inputs: The 9.3.2 Checklist
Clause 9.3.2 lists what every review must consider. The list uses "shall," so missing an item is a legitimate nonconformity. Build your agenda from this table and you cannot miss one.
| 9.3.2 input | What to bring to the meeting |
|---|---|
| a) Status of actions from previous reviews | The action list from the last review, each item marked done or open, with dates |
| b) Changes in external and internal issues | New or lost customers, new regulations, staffing changes, new equipment, market shifts that affect the QMS |
| c-1) Customer satisfaction and feedback | Complaint log, returns, customer scorecards, survey results, feedback from other interested parties |
| c-2) Extent to which quality objectives are met | Each objective (clause 6.2) with its target and its current number |
| c-3) Process performance and product conformity | Scrap rate, rework, first-pass yield, on-time delivery |
| c-4) Nonconformities and corrective actions | Open NCRs (clause 8.7) and the corrective action log (clause 10.2) with status |
| c-5) Monitoring and measurement results | KPI trends, inspection data, calibration status (clause 7.1.5) |
| c-6) Audit results | Internal audit findings (clause 9.2), plus any customer or registrar audit results |
| c-7) Performance of external providers | Supplier scorecards (clause 8.4): late deliveries, rejected material |
| d) Adequacy of resources | Hiring needs, equipment condition, training gaps (clause 7.2), budget requests |
| e) Effectiveness of actions on risks and opportunities | The risk register (clause 6.1) with action status and whether the actions worked |
| f) Opportunities for improvement | Ideas from staff, audit observations, anything the data suggests |
The seven trend items under input (c) are where most of the meeting time goes. Bring trends, not snapshots. "Scrap was 2.1% this quarter, down from 3.4%" supports a decision. "Scrap exists" does not.
Required Outputs: The 9.3.3 List
Outputs are decisions and actions. Clause 9.3.3 names three categories.
| 9.3.3 output | What it looks like in the minutes |
|---|---|
| a) Opportunities for improvement | Decisions to pursue specific improvements, each with an owner and a due date |
| b) Any need for changes to the QMS | Procedure revisions, new or retired processes, scope changes, updated objectives |
| c) Resource needs | Approved spending: a hire, a machine, calibration services, training |
Every output needs an owner and a due date, or it will still be open at the next review. The next review must report on it either way, because open actions are input (a). Clause 9.3.3 also requires retained documented information as evidence of the results. Minutes with a decisions-and-actions section satisfy this. No special form is required.
How Often Should You Hold It?
Clause 9.3.1 says "planned intervals" and nothing more. Once a year meets the letter of the standard. It is also the weakest choice for a company building a new QMS.
Quarterly is the common pattern before certification, for two reasons. First, certification needs about three months of operating records before the Stage 2 audit, and a completed management review sits near the top of that evidence list. Quarterly reviews mean you walk into Stage 2 with one or two real reviews behind you, plus follow-up on their actions. Second, a new system drifts fast. Quarterly reviews catch a stalled objective or a dead procedure in month three, not month eleven.
Whatever interval you pick, write it into your management review procedure and hit it. A procedure that says quarterly, sitting next to minutes that show one review in fourteen months, is a self-inflicted finding.
A Working 60-90 Minute Agenda
This agenda covers every 9.3.2 input in about 85 minutes. If your data is clean and current, compress the five-minute items and you can finish in an hour.
| Agenda item | Minutes | Input covered |
|---|---|---|
| Actions from the last review | 5 | a |
| Changes inside and outside the business | 5 | b |
| Quality objectives scoreboard | 10 | c-2 |
| Customer feedback and complaints | 10 | c-1 |
| Process and product performance data | 15 | c-3, c-5 |
| Nonconformities and corrective action status | 10 | c-4 |
| Internal and external audit results | 5 | c-6 |
| Supplier performance | 5 | c-7 |
| Resource review | 5 | d |
| Risk and opportunity actions | 5 | e |
| Improvement decisions, new actions, recap | 10 | f, plus all outputs |
Assign a note-taker who is not running the meeting. The notes need three things per topic: the data shown, the outcome of the discussion, and any decision or action with an owner and a date. That is the whole records requirement.
The Theater Anti-Pattern
The most common management review failure is not a bad meeting. It is a fake one: minutes for four "quarterly" reviews, all written in one sitting the week before the certification audit.
The fix costs less than the fake. Run one real 75-minute meeting with the data you have. Thin data honestly presented — "we have two months of scrap tracking; here is the trend so far" — passes audits. Polished fiction does not.
How Outputs Feed Objectives and Corrective Action
Management review is the pump that moves clauses 9 and 10. Two connections matter most.
- To quality objectives (6.2): when input (c-2) shows an objective is met, stale, or unrealistic, output (b) is where you retire it, raise the target, or replace it. The revised objective then gets a plan — who, what, resources, deadline — and its progress becomes input (c-2) at the next review.
- To corrective action (10.2): when the data shows a repeating problem — the same complaint three quarters running, scrap stuck at one work center — the review opens a corrective action. Its status then reports back under input (c-4) until the review confirms the fix worked and closes it.
Auditors trace these threads. An internal audit finding (9.2) should appear in input (c-6). If it triggered a corrective action, that action's status appears under (c-4). If the review closed it, the output record says so. When those threads connect across two or three review cycles, the auditor sees a working system. When they do not connect, no volume of minutes helps.
Your First Review Before Certification
Before Stage 2 you need a management review procedure, an input data packet, and at least one held review with records. You have two ways to get the documents. Write the procedure, agenda, and minutes form yourself from the 9.3.2 and 9.3.3 lists above — this article contains everything they must cover. Or buy the documentation: ISO Delivered's $8,000 flat-fee package includes about 44 documents, with the management review procedure and forms among them, delivered two to four weeks after you complete the questionnaire. Either way, the meeting itself is yours to run. No outside firm can hold it for you, and top management cannot delegate the decisions.
Frequently asked questions
How often does ISO 9001 require management review?
Clause 9.3.1 only says "at planned intervals" — no frequency is stated. One review per year meets the minimum, and auditors generally expect at least that. Quarterly is common for companies working toward certification, since each review adds records the Stage 2 auditor will sample.
Who has to attend a management review?
Top management — the people who direct and control the company at the highest level. The quality manager can prepare the data packet and run the meeting, but cannot stand in for leadership. Auditors look for evidence that people with authority over resources and direction made the decisions.
Can we split management review across regular meetings instead of one sitting?
Yes. The standard requires the inputs to be reviewed at planned intervals; it does not require a single meeting. Some companies cover the inputs in monthly ops meetings and roll the results up. If you do this, keep a map showing where each 9.3.2 input was covered and where each decision is recorded, because the auditor must be able to trace all of it.
Do I need a management review before my Stage 2 audit?
Yes. Stage 1 checks that management review is planned and scheduled; Stage 2 expects at least one completed review with records. Since certification needs about three months of operating records anyway, hold the review inside that window so it covers real data.
What records does clause 9.3 require?
Retained documented information as evidence of the results of management reviews. In practice that means minutes showing each 9.3.2 input was covered, the decisions made, and the actions assigned with owners and due dates. No specific format is required.
What do auditors check in management review minutes?
They check the dates against your stated interval, confirm every 9.3.2 input appears, and verify that actions from one review show up as status in the next. They also cross-check numbers in the minutes against source records — the complaint log, the NCR log, the internal audit report. Consistent threads across reviews are the strongest evidence the system works.