Management review is clause 9.3 in ISO 9001:2015, and it's one of the easiest requirements to get quietly wrong. Most businesses hold the meeting. Far fewer give auditors what they're actually looking for: proof that top management is steering the quality system, not just sitting through a summary of it once a year.
It's not just a meeting
The standard doesn't ask for an annual get-together with a slide deck. It asks for a review, at planned intervals, that top management actually owns. I've sat in plenty of "management reviews" that were really just an operations update dressed up for the audit file. The giveaway is always the same: no decisions, no actions, just a record that people were in the room. Clause 9.3 is built around inputs and outputs, and if either side is thin, the review hasn't done its job, whatever the minutes say.
The inputs auditors check for
Clause 9.3.2 sets out what the review has to consider: the status of actions from previous reviews, changes in external and internal issues relevant to the QMS, and performance data covering customer satisfaction, progress against quality objectives, process performance, nonconformities and corrective actions, audit results, the performance of external providers, and whether resources are adequate. It also has to look at how effective your actions on risks and opportunities have been, and surface opportunities for improvement. Auditors work down this list. Miss two or three categories and it shows immediately.
Who actually needs to be in the room
Clause 9.3 says top management, not the quality manager standing in for them. In smaller businesses that's usually fine — the MD is close enough to operations to engage properly. In larger ones, I regularly see the review delegated so far down the chain that the people who can actually commit resource or change direction never see the data at all. That's not a paperwork issue, it's the review failing at the one thing it's meant to do: give leadership a real decision point on the system's performance.
Where businesses get caught out
The most common gap isn't a missing agenda item, it's missing trend data. Reviews that report "customer satisfaction: good" with nothing behind it don't meet the requirement — the standard expects you to look at trends, not a single snapshot. The second gap is audit results turning up as a line item rather than something that actually gets discussed. The third, and the one I flag most often, is risks and opportunities never making it onto the agenda at all, even though clause 9.3.2 explicitly asks for it.
The outputs that actually matter
A compliant review produces decisions, not just discussion. Clause 9.3.3 expects outputs on opportunities for improvement, any need for changes to the QMS, and resource needs. If your minutes read like a status report with no actions attached, you haven't met the output requirement, even if every input was covered. You also need to retain documented information as evidence of the results — an email summary afterwards isn't enough on its own.
A practical fix
Build your agenda directly from the 9.3.2 input list and keep it as a standing template, so nothing gets skipped between reviews. Assign an owner and a deadline to every output, and link those actions back into your corrective action log so they don't disappear until the next review comes round. It's a small change, and it's usually the difference between a review that satisfies an auditor and one that generates a finding.
If you want a quick check, pull the minutes from your last management review and tick them off against the 9.3.2 and 9.3.3 lists. Most businesses find at least one gap. Better to find it yourself than have an auditor find it for you.
Ready to talk about your business?
Book a free, no-obligation call. We will tell you exactly what certification would involve for your size, sector, and starting point.