ISO 27001 Clause 9.3: management review that survives audit

The auditor asks for your last two sets of management review minutes. They say "noted" and "discussed", record no decision and name no owner. This guide covers what ISO 27001 Clause 9.3 requires and the seven agenda inputs. It then shows how to record decisions auditors accept, who must attend, and how to automate the pack and the follow-up.

It is written for security leads, compliance managers and operations directors at 25–250-person firms heading for Stage 2 or a surveillance audit. The aim is a leadership review you can run in half a day and defend line by line.

What does ISO 27001 Clause 9.3 require, and how is it structured?

Clause 9.3 of ISO 27001:2022 requires top management to review the ISMS at planned intervals. It has three parts. 9.3.1 sets the review and its three judgements (fit, resourcing, performance). 9.3.2 fixes the seven inputs on the agenda, and 9.3.3 demands recorded decisions. Together they form the leadership decision engine.

Clause 9.3.1 puts the ISMS on the leadership calendar at intervals set in advance. Top management means the people who set strategy and control budgets, not their delegates. They step back and make three judgements:

• Fit: does the ISMS still match the business as it now operates?
• Resourcing: does it have the budget, people and tooling it needs?
• Performance: is it working, and can you show it?

Clause 5.1 is where leadership commits to the ISMS. Clause 9.3 is where that commitment is exercised and evidenced, on a recurring basis. The two sibling sub-clauses supply the mechanics: 9.3.2 fixes what the review must consider, and 9.3.3 fixes what it must decide and record.

Auditors use the clause to test whether security governance is real or ceremonial. A review the CEO never attends, or one that rubber-stamps a slide deck, tells the certification body the ISMS runs as a side project. Without a forum that forces resourcing decisions, security requests queue behind revenue work. Controls decay quietly until a surveillance audit or an enterprise prospect's due diligence finds the gap.

For a regulated firm, provable board-level oversight is part of the licence to operate. This clause is where you evidence it.

What are the seven inputs Clause 9.3.2 requires on the agenda?

Clause 9.3.2 fixes seven compulsory inputs: progress on previous actions; changes in internal and external context; shifts in stakeholder needs; security performance (findings, metrics, audit results, objectives); stakeholder feedback; risk assessment and treatment status; and improvement opportunities. Auditors check minutes against this list near-verbatim, so none can be skipped.

The list is the auditor's cheapest test. They lay your minutes beside the seven items, and every gap is a finding waiting to be written. A review fed a partial picture also makes partial decisions. Budget follows the loudest problem rather than the biggest risk, and last quarter's actions evaporate because nobody reopened them.

Build each input into the pack with a clear brief:

• Previous actions: the live action list from the last session, with status and closure evidence. Open every session here.
• Context changes: shifts in your market, structure, regulation and technology since last time.
• Stakeholder needs: new customer contract requirements, regulator expectations and partner demands.
• Security performance: trends in findings and fixes, measures such as patching and MFA coverage, audit outcomes, and objectives met or missed.
• Stakeholder feedback: what customers, regulators and other parties actually said about your security.
• Risk and treatment: the risk register's biggest movers and treatment progress, drawn from the live register rather than a stale copy.
• Improvement opportunities: proposals raised from audits, incidents and day-to-day operations.

Split the ownership. The security lead typically compiles performance and risk material, while the CEO or COO speaks to strategy and stakeholder shifts. The clause is satisfied by the review considering the material, not by one person authoring all of it.

Give leadership a short pre-read pack rather than presenting live: trends and exceptions, not raw exports. Then minute which inputs were tabled and what was decided off the back of each. Decisions traceable to inputs are what a mature review looks like from the auditor's chair.

Two pitfalls undo this quietly. Agenda drift happens when a tidy-up drops an input from the template and nobody notices until the auditor does the mapping. Copy-paste minutes repeat last cycle's wording, which auditors read as no meaningful discussion having happened. A locked template with one section per input stops the first; minutes written from the current pack stop the second.

What must a management review decide and record under Clause 9.3.3?

Clause 9.3.3 requires the review to end in recorded decisions on two fronts: where the ISMS should improve and what in it must change. Minutes or another decision record must be retained as evidence. A review ending in 'noted' produces no decision, so it fails the clause's exit test.

Decision-grade minutes read as commitments, not summaries. Write these down in the room:

• What will improve in the ISMS.
• What will change in the ISMS.
• What money or people leadership committed. "Approved budget for MDR tooling" is the sentence that later evidences leadership commitment under Clause 5.1.
• Which risks leadership chose to accept.

If the minutes could describe any company's meeting, they are too thin. UK regulators set the same bar elsewhere. For data protection oversight groups, the ICO Accountability Framework on leadership and oversight asks for detailed minutes that record discussions, actions and decisions.

Give each action one named owner, a person rather than "the IT team", and a realistic date. Group ownership diffuses accountability, and auditors treat an ownerless register as a red flag.

An action without a named person isn't an action. It's a wish.

Closure needs proof. An action closes when its owner attaches the artefact that shows it happened and an approver signs it off. The artefact might be the revised policy, the training log, the updated risk register or the test result.

An action closed on someone's word hasn't been closed.

Run actions from a live tracker rather than the minutes document, so overdue items are visible between reviews instead of rediscovered at the next one. A standing escalation rule, such as anything two weeks late going to the executive sponsor, beats ad hoc chasing.

Three patterns hollow out the output:

• Slideware: an hour of presentation with nothing decided.
• "Noted" minutes: no verb that commits anyone to anything.
• Floating deadlines: dates re-set each cycle without a decision to extend them.

Each leaves attendance on the record and governance off it.

How often should the Clause 9.3 review run, and who has to attend?

Run the Clause 9.3 review at least annually, and quarterly if your business or threat picture moves fast. Top management must be in the room: the CEO or MD, alongside whoever runs security day to day. A delegate without budget authority defeats the clause, because cyber governance is a board-level responsibility, not an IT task.

The NCSC Cyber Security Toolkit for Boards states plainly that cyber security is a board-level responsibility. That is why a review attended only by IT fails on substance, not just on paperwork.

For a firm of 25–250 people, we recommend this cadence:

• Annual floor: a planned interval, but it leaves controls drifting for a year between judgements.
• Quarterly: smaller packs, fresher data and less pre-audit panic.
• Standing slot: a recurring agenda item in the quarterly board or leadership meeting, rather than a new ritual that gets postponed.
• Forward schedule: book the next session before closing the current one. A pre-booked calendar is itself evidence of planned intervals.
• First review before Stage 2: hold it once internal audit results and Clause 9.1 monitoring data exist to feed it.

Budget a half-day per cycle once the routine settles, covering preparation, the session, minutes and follow-up. Expect up to two days of preparation while the data still lives in separate systems.

Attendance is judged by interview as well as by the attendee list. Auditors ask executives to describe the ISMS's performance in their own words, and a rehearsed answer gives way quickly.

Two traps recur. In the delegation trap, leadership sends apologies and the security lead reviews their own work, which is the oversight failure the clause exists to prevent. In the siloed review, the session runs apart from the enterprise risk, privacy or quality governance the same executives already attend. Fold it into those rhythms rather than running a parallel ceremony.

What will an auditor ask about Clause 9.3, and what do they sample?

Auditors ask to see your last two sets of review minutes, who attended, when the next review is scheduled, what leadership decided and what changed as a result. They then sample minutes against the seven inputs and trace one or two decisions from the minutes through owner, deadline and closure evidence.

Expect the questions to follow the three sub-clauses:

• 9.3.1: "Show me your last two sets of minutes and who was in the room." "When is the next one scheduled?" "What did leadership decide, and what changed as a result?"
• 9.3.2: "Walk me through your agenda: where does each mandatory input appear?" "This decision in the minutes: which input prompted it?" "What happened to the previous review's actions?"
• 9.3.3: "Show me the decisions, not the discussion." "Pick any action: who owned it, when was it due and what proves it's done?" "What did leadership commit in budget or people?"

The sampling follows the questions. The auditor maps one or two sets of minutes item by item against the seven inputs and checks that the risk material matches the live register. They then take two or three closed actions and pull the thread: decision, owner, deadline, closure evidence and sign-off. Open items are checked for drift, such as dates repeatedly pushed or owners reassigned with no escalation.

These artefacts satisfy that sampling at this scale:

• Minutes whose decisions read as commitments, each attributable to someone.
• Attendance that shows genuine top-management participation: calendar invites, sign-offs or the board pack.
• The forward schedule, plus proof that past sessions ran on it.
• The input pack in the form leadership actually consumed it.
• An action log with owners, dates, status and history.
• Budget or headcount approvals traceable to review decisions.

That last item is the strongest sign the forum has teeth. Approved spend appearing in deployed tooling, or an ordered policy change appearing in the revised document, proves the decision landed.

Is a weak Clause 9.3 management review a major or minor nonconformity?

The pattern decides. In GRCMANA's reading of certification-audit grading practice, no review held, or no record that it produced any decision, grades major. A lapsed schedule, one skipped input or actions without owners grade minor, aggregating to major when repeated across cycles.

This grading comes from certification-body practice rather than the text of the standard, so treat it as a way to decide which failures to fix first:

• Likely major: no review held, no documented outputs at all, minutes showing the review never produces decisions, or an agenda that structurally ignores several inputs.
• Likely minor: a lapsed schedule, one input missed in one cycle, actions without owners or dates, an item closed without evidence, or a stale tracker.

Loop-closure is what keeps a minor from growing. Put last audit's findings against this clause on the next agenda, and minute the fix and its evidence. A finding that reappears at the next surveillance audit tells the certification body the review steers nothing.

Check inherited templates before the audit does. A template recycled from the 2013 edition may not match the 2022 input list. A template built around attendance and agenda rarely captures decisions and evidence. Fix absence first, then missing inputs, then owners and closure evidence.

How do you automate Clause 9.3 review packs, action tracking and loop-closure?

Automation turns Clause 9.3 from a quarterly scramble into a by-product of normal work. Connected monitoring, audit and risk data generate the review pack. Decisions become tickets with owners and dates, and closure requires an evidence attachment. Next cycle's first agenda item is a live query of this cycle's actions.

The engineered path has seven parts:

1. Self-assembling pack. Monitoring metrics, audit findings, incidents and risk data feed a generated report. Preparation drops from days to about an hour, and the numbers are current.
2. Agenda as a templated record. A mandatory field per input makes an incomplete review impossible to file.
3. Decisions as tickets. Minute the review in a tool that spawns tracked items, with owner, date and evidence field, at the point of capture.
4. Evidence-gated closure. The workflow refuses to close an item without an attachment and an approver.
5. Automatic escalation. Deadline nudges and overdue escalations fire from the tracker's own rules.
6. Scheduling safety net. Automation books the cycle, chases the pack and flags a missed session before it becomes a year's gap.
7. Context feeds. Regulatory changes and customer requirements logged as they occur accumulate into the context input.

A review pack assembled by hand is out of date before leadership reads it.

Add a standing executive dashboard of control health and risk trend, and leadership arrives already informed. The quarterly conversation gets shorter and sharper, which makes the executive time you ask for easier to protect.

The timestamped history is the by-product auditors want: decision, owner, evidence and sign-off in one view, with no reconstruction. In enterprise due diligence, the same record is the cheapest proof of board-level oversight a reviewer will accept.

Frequently asked questions