ISO Management Review Checklist Template

What the ISO Management Review Checklist Covers

1. 1
   Phase 1

   Phase 1: Plan the Review

   6 tasks

   The management system lead plans the review with the chair. Enter the meeting date first: every due date counts back or forward from it. Why the review is happening and which standards it covers add the matching notes and tasks.

   • Record the management system, the meeting date and who leads the review — the organisation and the management system reviewed, the date of the meeting, which every due date counts from, the lead who prepares it and the member of top management who chairs it and approves the minutes
   • Confirm the attendees from top management — the people who direct and control the organisation at the highest level, not only their deputies, and the process owners who will present inputs
   • Set the period the review covers — normally from the last review up to now, so no month falls between two reviews
   • Confirm the standards and the scope this review covers — which management system standards are in scope, the sites, activities and parts of the organisation they cover, and whether one review covers several standards
   • Change-triggered review: describe the change and what it affects — a merger or acquisition, a new site, a major process, product or system change, a serious incident or a change in law, and the parts of the management system it could affect
   • Send the agenda and ask each input owner for their input — one agenda item per input, a named owner for each and a deadline at least a week before the meeting
2. 2
   Phase 2

   Phase 2: Previous Actions & Changes

   5 tasks

   Start where the last review ended. Then record what has changed, inside and outside the organisation, since that review.

   • Report the status of actions from previous reviews — every action with its owner, due date and status: done, in progress, overdue, or dropped with a reason
   • Record changes in external issues — changes in law and regulation, markets and competitors, technology, the economy, the climate and the local environment that affect the management system
   • Record changes in internal issues — new or closed sites, restructuring, key people joining or leaving, new products, services, processes or systems, and changes in culture or performance
   • Record changes in interested parties’ needs and expectations — customers, regulators, owners, workers, suppliers, neighbours and anyone else whose requirements the system must meet, and what each now expects
   • Check the scope, policy and objectives still fit — whether the changes above mean the scope, the policy or any objective should change before the next period
3. 3
   Phase 3

   Phase 3: Performance Information

   10 tasks

   Bring numbers and trends for the whole period, not last month’s figure. Each input owner summarises their own area, and a task for each standard in scope follows the shared inputs.

   • Summarise nonconformities and corrective actions — how many were raised and closed, which are overdue or keep coming back, and the main causes, from the CAPA log
   • Summarise monitoring and measurement results — the key performance indicators against their targets, with the trend over the period rather than a single figure
   • Summarise internal and external audit results — findings by grade and by process from internal audits, certification or surveillance audits and customer audits, and whether the audit programme ran as planned
   • Report progress against objectives — each objective with its target, the result so far and whether it is met, on track or behind
   • Summarise customer and interested-party feedback — complaints, satisfaction results and compliments, and concerns raised by workers, regulators or neighbours
   • Report the performance of suppliers and external providers — delivery, quality and responsiveness of the suppliers and outsourced processes that matter most, with any problems raised with them
   • Quality: report process performance and product and service conformity — how well the main processes performed, how much product or service did not conform, and what that meant for customers
   • Environment: report compliance obligations and significant environmental aspects — the results of the latest evaluation of compliance, changes to significant aspects, and any environmental incidents or complaints
   • Information security: report on risks, risk treatment and security incidents — changes to the information security risk assessment, progress on the risk treatment plan, and security incidents and near misses in the period
   • OH&S: report incidents, worker consultation and legal compliance — incidents, ill health and near misses and how they were investigated, what workers raised through consultation and participation, and the results of the latest evaluation of compliance
4. 4
   Phase 4

   Phase 4: Resources, Risks & Improvement

   5 tasks

   These inputs look forward. Then put every input into one pack and send it a week before the meeting, so attendees read it before they arrive.

   • Assess whether resources are adequate — people and competence, equipment, infrastructure, systems and budget, against what the management system needs in the next period
   • Review how well the actions on risks and opportunities worked — changes to the risk register in the period, whether the planned actions were taken, and whether they reduced the risk or realised the opportunity
   • List the opportunities for improvement — ideas from audits, staff, customers, suppliers and the data above, each with who raised it and the expected benefit
   • Integrated review: combine the inputs for each standard into one pack — shared inputs such as audit results, resources and supplier performance reported once, and the inputs that belong to one standard marked against it
   • Compile the input pack and send it to the attendees — every input from Phases 2 to 4 in one document, sent at least a week before the meeting
5. 5
   Phase 5

   Phase 5: Hold the Review Meeting

   5 tasks

   Top management chairs the meeting and makes the decisions. Work through every input on the agenda, then reach a conclusion on the management system as a whole.

   • Record who attended — top management present in person or remotely, apologies, and who presented each input
   • Discuss each input and record the main points — what the data shows, what the attendees questioned and what they agreed, item by item in the agenda order
   • Change-triggered review: decide how the system must change to stay effective — whether the change needs new or revised processes, controls, objectives, resources or training, and by when
   • Integrated review: check every standard’s inputs were covered — each standard in scope had its own inputs discussed and gets its own conclusion, even where the inputs were shared
   • Conclude whether the management system is still suitable, adequate and effective — one conclusion for each standard in scope, and whether the system still fits where the organisation is heading
6. 6
   Phase 6

   Phase 6: Record the Outputs

   5 tasks

   Outputs are decisions, not a summary of the discussion. Each decision that needs work becomes an action with one owner and a date.

   • Record the decisions on opportunities for improvement — which opportunities go ahead, which wait and which are declined, with the reason for each
   • Record any changes needed to the management system — changes to the scope, policy, objectives, processes, controls or documents, or a record that none are needed and why
   • Record the resources agreed — people, training, equipment, systems or budget top management agreed to provide, and when
   • Agree each action with an owner and a due date — one named person per action, never a department, and a date the owner has accepted
   • Draft the minutes — the date, the attendees, the inputs considered, the conclusions, every decision and the action plan
7. 7
   Phase 7

   Phase 7: Approve & Retain the Minutes

   4 tasks

   The minutes are the record that the review happened and what it decided. Nothing after the approval can be completed until top management records a decision.

   • Top management approves the minutes and the action plan — the chair checks the minutes match what was decided and that every action has an owner and a date
   • Issue the approved minutes to attendees and action owners — each action owner told what they own and by when
   • Retain the minutes as documented information — the approved minutes and the input pack stored where they are controlled, protected and easy to find at the next audit, for the retention period you have set
   • Communicate the outcomes to the people who need them — changes to the policy, objectives or processes explained to the people they affect, through briefings, the intranet or team meetings
8. 8
   Phase 8

   Phase 8: Follow Up Before the Next Review

   5 tasks

   A review is only as good as its follow-up. Check the actions between reviews, and carry anything still open into the next one.

   • Add the actions to the action or CAPA log — each action tracked where its owner already works, with a CAPA opened for any action that needs a root cause found
   • Set the date of the next review — at the planned interval, and sooner if a significant change happens in the meantime
   • Check progress on every action — about a month after the review, with overdue actions raised with their owner and, if needed, with top management
   • Verify completed actions worked — evidence that each completed action had the effect intended, not only that it was done
   • Carry open actions into the next review’s inputs — every action not yet complete listed for the next review, with its status and a new date if it moved