How do we run a management review that actually decides things?

Start

A management review is due

It meets at the planned interval, and before the first certification after the first internal audit cycle and before Stage 1. An extra review follows a major incident, a major nonconformity or a significant change. The certification body reads the minutes for three things: every input considered, decisions taken, and actions followed up.

• Then: Are the internal audit results ready as an input?

Decision

Are the internal audit results ready as an input?

Audit results are one of the review's inputs. A review held before the audit has to be held again. The ISMS manager writes the programme summary before every management review. If you do not know whether it will be ready, treat the answer as no.

• Yes: Will people who can commit resources be in the room?
• No, or not known: Get the audit summary first, or move the date

Step

Get the audit summary first, or move the date

Ask for the programme summary, or reschedule the review until the audit results are in. Before the first certification, the review must come after the first full internal audit cycle.

• Then: Will people who can commit resources be in the room?

Decision

Will people who can commit resources be in the room?

The review belongs to top management, not the security team. That is the group that can commit resources and change priorities, such as an executive committee, or two or three directors in a small firm. A review attended only by the security team is not a management review. Deputies are recorded in the minutes, with their authority.

• Yes: Ask each input owner for a short paper with a decision sought
• No, or not confirmed: Reschedule with top management present

Outcome

Reschedule with top management present

Ask the executive sponsor to secure the attendance. In a small organisation, hold the review as an item of an existing management meeting, with its own minutes and its full agenda. A meeting without the decision-makers can only note things.

Step

Ask each input owner for a short paper with a decision sought

Ask every owner for the same shape: the figure, its trend, what it means, and the decision they want. One or two pages, trends not snapshots. In the pack's defaults, papers reach the ISMS manager 10 working days before and the pre-read goes out 5 working days before. A paper with no decision sought belongs in the appendix.

• Then: Keep the standing agenda, with bad news first

Step

Keep the standing agenda, with bad news first

Past actions, what has changed inside and outside, what interested parties need, how security is performing, what interested parties are telling you, where the risks stand, where to improve, then decisions. Spend most of the time on performance, risks and decisions. Take overdue actions, repeat findings and risks outside appetite before anything that went well.

• Then: Open by asking whether the pre-read has been read

Step

Open by asking whether the pre-read has been read

Nobody presents slides that repeat it. Each item starts with the decision sought. A review turns into a ritual when it is a presentation of the pre-read to people who have not read it.

• Then: Did this item end in a decision?

Decision

Did this item end in a decision?

'No change' is a decision: record it with the reason. 'Noted' is not a decision. A meeting that noted everything passes the certification body's first test, that inputs were considered, and fails the other two.

• Yes, for every item: Is anyone asking for people, money or time?
• No: it was 'noted': Ask the chair for the decision before moving on

Step

Ask the chair for the decision before moving on

Restate the decision sought and the options. If the meeting cannot decide, the decision is who will bring what back, and by when. That becomes an action with an owner and a date.

• Then: Did this item end in a decision? (back to an earlier step)

Decision

Is anyone asking for people, money or time?

A request for resources comes to the meeting as options with costs: what it buys, what it costs, and what happens if it is refused. Without that, the meeting has nothing to decide between.

• Yes: Agree or refuse it, and state the consequence of a refusal
• No: Are risk owners asking management to accept residual risks?

Step

Agree or refuse it, and state the consequence of a refusal

Record the resources agreed or refused. A refusal is a valid decision, as long as its consequence is written down, so the next review can see what it cost.

• Then: Are risk owners asking management to accept residual risks?

Decision

Are risk owners asking management to accept residual risks?

The risk item shows the top risks and their movement, risks outside appetite, treatment progress, and the residual risks put forward for acceptance.

• Yes: Accept each one, or send it back for treatment
• No: Record the review's results one by one

Step

Accept each one, or send it back for treatment

Decide each risk separately and record the decision. Sending a risk back for treatment is as valid as accepting it. Who may accept a given risk still follows your own risk acceptance rules; that is “Who can accept a risk, and does the answer change with its rating?”. Record the acceptance in your risk acceptance records after the meeting.

• Then: Record the review's results one by one

Step

Record the review's results one by one

Does the ISMS still fit, is it enough, and does it work, one sentence each; improvements taken up or declined; changes to scope, policy, objectives or controls; resources; risks; in a certification year, go ahead with or move the next audit; and the next review's date. Ask one hard question: what would we do differently if we started again today?

• Then: Read the actions back, each with an owner and a date

Step

Read the actions back, each with an owner and a date

Actions leave the room with an owner and a date, confirmed aloud at the end. One action log runs across reviews, carried forward until every action is closed.

• Then: Issue the minutes, track the actions, update the documents

Step

Issue the minutes, track the actions, update the documents

In the pack's defaults, minutes go out within 3 working days and the changed documents are updated within 10 working days: scope, policy, objectives, Statement of Applicability, risk acceptances, audit programme. Track actions with the other ISMS gaps, review them monthly, and escalate overdue ones to the executive sponsor.

• Then: Could these minutes be swapped with the last review's?

Decision

Could these minutes be swapped with the last review's?

If the minutes of two reviews in a row could be swapped without anyone noticing, the review has become a ritual. Look at the decisions recorded, not at the agenda headings, which are meant to stay the same.

• Yes: Change the format before the certification body points it out
• No: A review that decided: inputs, decisions and actions on record

Outcome

Change the format before the certification body points it out

Shorten the papers, cut the presentations, and make every paper end in a decision sought. Check the right people are attending rather than deputies.

Outcome

A review that decided: inputs, decisions and actions on record

The minutes are the record the certification body reads at Stage 1 and Stage 2, and one of the blocking items: without a completed review, a Stage 2 audit cannot pass. The action log is the first paper of the next review.