Control 9.3.2Management review inputs

The management review must consider: the status of actions from previous reviews; changes in external and internal issues relevant to the ISMS; changes in the needs and expectations of interested parties; feedback on information security performance, including trends in nonconformities and corrective actions, monitoring and measurement results, audit results, and fulfilment of the information security objectives; feedback from interested parties; the results of risk assessment and the status of the risk treatment plan; and opportunities for continual improvement.

The list is prescriptive and it is a checklist an auditor will work through. Two inputs are routinely thin: trends — as opposed to counts — in nonconformities, which is where a systemic problem becomes visible; and feedback from interested parties, which requires having asked.

The status of actions from previous reviews being first on the list is not accidental. A review that repeats last year’s findings without closing them is the clearest evidence available that the system is not improving, and it is the first thing the clause makes management look at.

How to put this in place

The review needs the right information in front of it. Minutes that omit changes in context, interested parties, audit results or risk are a regular finding.

List the inputs the review must consider and who prepares each.
Collect them before the meeting: previous actions, changes in issues and in interested parties' needs, performance (nonconformities, measurement, audit results, objectives), interested-party feedback, risk results and treatment progress, and improvement opportunities.
Circulate a pre-read.
Cover every input on the agenda.
Record that each was considered.

Evidence an auditor usually looks for: a pre-read and minutes that show every input considered.

What is in the packs for this

From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.

ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 5 (Check) of the implementation plan, which sets out the work and the gate that closes the phase.
Management Review Meeting PackWord
Sets out the agenda (items MR-1 to MR-7) and the pre-read pack.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.