Control 9.3.3Management review results
The results of the management review must include decisions related to continual improvement opportunities and any need for changes to the information security management system, and must be retained as documented information.
The operative word is decisions. A record that notes discussion and assigns nothing does not meet the clause, and it also means the review cycle has no effect: the inputs in 9.3.2 arrive, are considered, and nothing is required to change.
This is the point at which the management system either closes its loop or does not. Decisions here become actions under clause 10, changes under 6.3, resources under 7.1 and objectives under 6.2. An auditor traces a sample forward — a decision taken, an action assigned with an owner and a date, and evidence that it happened — and the trace either exists or it does not.
Minutes that record attendance and a list of papers presented are the most common form this clause takes, and the least useful.
How to put this in place
A review is only worth having if it produces decisions. The project must record what changed as a result and who will do it.
- State the decisions: improvements, changes to the ISMS and resources needed.
- Assign owners and dates to each action.
- Record the minutes and have top management approve them.
- Update the plan, the risk register or policies as decided.
- Report on the actions at the next review.
Evidence an auditor usually looks for: minutes with decisions, actions, owners and dates, and evidence that actions were followed up.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 5 (Check) of the implementation plan, which sets out the work and the gate that closes the phase.
Mandatory ISMS Documentation ChecklistExcel
Required Documents sheet, item MD-15: the typical form, what auditors accept instead and the gaps they reliably find.
Certification Readiness Self-AssessmentExcel
A blocking item in the readiness assessment, which treats it as needing to be operating before a Stage 2 audit.
Management Review Meeting PackWord
Lists the decisions to record (MD-1 to MD-7), with a minutes template and an action log.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.