Summary
In short
- The outputs are prescribed and they are decisions. Improvement opportunities, changes needed to the system, resource needs, and implications for strategic direction.
- The inputs are also prescribed and are routinely incomplete. Status of actions from previous reviews is the input most often missing, and it is the one that reveals whether the last review changed anything.
- Attendance by top management is the requirement, not attendance by the quality or safety function presenting to them.
- ISO 45001 adds inputs the quality standards do not: consultation and participation of workers, and the adequacy of resources for maintaining an effective system.
- A review where nothing was contested is usually a review where nothing was decided. Genuine reviews involve disagreement about priorities and resources.
- The single most informative measure is what proportion of previous review actions were completed, and it is rarely presented.
What it is
What it is
What is a management review?
A review by top management, at planned intervals, of the management system's continuing suitability, adequacy and effectiveness, using defined inputs and producing defined outputs including improvement opportunities, changes to the system, and resource needs.
Why is it a decision requirement?
Because the standards specify outputs that are decisions rather than conclusions: opportunities for improvement, need for changes to the system, resource needs, and, in ISO 45001, any implications for the strategic direction. A review producing observations without decisions has not delivered the required outputs.
When to use it
When to use it, and when not to
This records the review itself. The information reviewed is generated elsewhere.
Use it for
- Scheduled management review at planned intervals, typically annually or more often
- Additional review following a significant incident, change, acquisition or external finding
- Combined reviews across quality, safety, environment and other systems where they are integrated
- Reviewing the adequacy of resources and the need for changes to the system
- Recording decisions with owners, dates and the resources committed
Not for
- Internal audit results and reports, which are an input to this review
- Performance data and dashboards, which are inputs rather than the review
- Corrective action tracking, which is a separate ongoing process
- Risk registers, which the review examines rather than contains
- Operational meetings, which address delivery rather than system effectiveness
Standards
What it is built against
Management review is specified with unusual precision about both inputs and outputs.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 45001 cl.9.3 | Top management to review the OH&S management system at planned intervals for suitability, adequacy and effectiveness | Header |
| ISO 45001 cl.9.3(a) | Status of actions from previous management reviews | Inputs reviewed |
| ISO 45001 cl.9.3(c) | Adequacy of resources for maintaining an effective management system | Decisions made |
| ISO 45001 cl.9.3(d) | Relevant communication with interested parties, and consultation and participation of workers | Inputs reviewed |
| ISO 45001 cl.9.3 outputs | Conclusions on suitability, improvement opportunities, changes needed, resources, and strategic implications | Outputs |
| ISO 9001 cl.9.3.2 | Inputs including customer satisfaction, process performance, nonconformity, audit results and supplier performance | Inputs reviewed |
| ISO 9001 cl.9.3.3 | Outputs including improvement opportunities, system changes and resource needs | Outputs |
| ISO 14001 cl.9.3 | Environmental management system review with its own specified inputs including compliance obligations | Inputs reviewed |
What it does not cover
- Internal audit reports, which are an input to the review.
- Performance dashboards, which supply information rather than constituting the review.
- Corrective action tracking, an ongoing process the review examines in aggregate.
- Risk and opportunity registers, which the review considers.
- Operational and production meetings, which address delivery rather than system effectiveness.
Filling it in
Filling it in well
Cover the specified inputs, contest the priorities, and record decisions with owners and resources.
It is a specified input in every version of the standard and it is the one most often skipped. Reviewing what was decided last time and what happened to it establishes immediately whether the review process has any effect, and a low completion rate is the most important finding available at the start of the meeting.
The requirement is a review by top management, not a report to them. Where the same person prepares the pack, presents it, answers the questions and writes the minutes, the review has been conducted by the management representative with senior people in attendance.
The prescribed outputs are decisions. A decision without an owner and a date is a sentiment, and a decision requiring resource without the resource committed is a deferral. The minutes should distinguish between what was noted, what was decided and what was funded.
ISO 45001 requires review of the adequacy of resources for maintaining an effective system. That is an uncomfortable question and it is the one the standard specifically obliges leadership to answer, which is why it is usually converted into a description of what resources exist rather than a judgement about whether they are enough.
Audit findings
Common audit findings
Management review findings concentrate on whether it is a review at all.
| Finding | Clause | What fixes it |
|---|---|---|
| Status of previous actions not reviewed. | ISO 45001 cl.9.3(a) | A specified input and the fastest indicator of whether reviews produce change. |
| Outputs recorded as observations rather than decisions. | ISO 45001 cl.9.3 | The prescribed outputs are decisions; record owner, date and resource. |
| Top management not present, or present without deciding. | ISO 45001 cl.9.3 | The review is by top management, not to them. |
| Resource adequacy described rather than judged. | ISO 45001 cl.9.3(c) | Answer whether resources are adequate, which is what the clause asks. |
| Worker consultation and participation not among the inputs. | ISO 45001 cl.9.3(d) | An explicit ISO 45001 input frequently absent from reviews inherited from quality systems. |
| Specified inputs partially covered with no record of omissions. | ISO 9001 cl.9.3.2 | Cover all inputs or record why one was not relevant. |
| Review conducted at an interval that cannot respond to events. | ISO 45001 cl.9.3 | Planned intervals should suit the rate of change, and significant events warrant additional review. |
| Decisions made without any change in resource allocation. | ISO 45001 cl.9.3 | A decision requiring resource without the resource committed is a deferral. |
| Same improvement opportunities recorded across consecutive reviews. | ISO 45001 cl.10.3 | Recurrence indicates the review records intent rather than producing action. |
| Minutes do not distinguish noted from decided. | ISO 45001 cl.7.5 | Separate them; the record should show what leadership actually committed to. |
Worked case
Case in point: three years of the same slide
A manufacturer held annual management reviews with full attendance, complete input coverage and detailed minutes. The certification body raised no findings against clause 9.3 in three consecutive surveillance visits.
Reviewing three years of minutes together, the same improvement opportunity appeared each year: strengthening contractor management. Each year it was recorded as an opportunity, each year no owner was assigned, and each year the following review recorded it again without noting that it was a repeat.
The status of previous actions had been presented each year as a percentage completion figure covering actions that had owners. The recurring opportunity had never become an action, so it never appeared in that figure and was never recorded as outstanding.
Definitions
Definitions and key terms
- Top management
- The person or group directing and controlling the organisation at the highest level, whose review the clause requires.
- Suitability
- Whether the system remains appropriate to the organisation's context, purpose and strategic direction.
- Adequacy
- Whether the system is sufficient to meet requirements, including whether resources are enough.
- Effectiveness
- Whether the system is achieving its intended results, judged on outcomes rather than on activity.
- Specified inputs
- The information the standard requires the review to consider, listed explicitly in clause 9.3.
- Specified outputs
- The decisions the review must produce, including improvement opportunities, system changes and resource needs.
- Strategic implication
- An ISO 45001 output requiring consideration of what the review means for the organisation's direction.
- Action status
- What happened to decisions from previous reviews, a specified input and the clearest measure of review effectiveness.
FAQ
Frequently asked questions
What makes a management review real rather than nominal?+
Whether anything moved. The prescribed outputs are decisions: improvement opportunities, changes needed to the system, resource needs and strategic implications. A review that covered every input, was fully attended and produced no decision has met the attendance requirement and not the output requirement.
What input is most often missing?+
The status of actions from previous reviews. It is specified in every version of the standard and it is the fastest available indicator of whether the review process has any effect. Where it is presented as a completion percentage, check whether items recorded as opportunities without owners are counted at all.
Does ISO 45001 differ from ISO 9001 here?+
It adds inputs the quality standard does not, notably consultation and participation of workers, and the adequacy of resources for maintaining an effective management system. Organisations that built their review from a quality system template frequently omit both, and the worker participation input is the one most often absent.
Who must attend?+
Top management, meaning those directing and controlling the organisation at the highest level. The requirement is a review by them rather than a report to them, and where the same person prepares the pack, presents it, answers every question and writes the minutes, the review has effectively been conducted by the management representative.
How can we tell if ours is working?+
Read the last three reviews together and identify items appearing more than once. Recurring improvement opportunities that never acquired an owner are the clearest evidence that the review records intention rather than producing action, and the pattern is invisible in any single review because each is closed when signed.
The agents
What the agents do with it
The review is where leadership decides. What fails is a presentation received and an opportunity recorded three years running.
Assembles the specified inputs including previous action status, and records outputs as decisions with owner, date and resource committed.
Compares consecutive reviews and flags items recurring without an owner, which is invisible within any single review.
Supplies the ISO 45001 specific inputs including worker consultation and participation, which quality-derived templates omit.
Connects resource adequacy discussions to competence gaps, which are a common and rarely quantified component of the answer.
This template lives in KnowComply — audit and governance. Audit programmes, legal register, management review, risk and certification.
Sources
Sources
- ISO 45001:2018 clause 9.3, management review
- ISO 9001:2015 clauses 9.3.1, 9.3.2 and 9.3.3
- ISO 14001:2015 clause 9.3, management review
- ISO 45001:2018 clause 5.1, leadership and commitment
- ISO 19011:2018, guidelines for auditing management systems