ISO 27001 How to conduct a Management Review

The Most Important Meeting of Your ISO 27001 Year

The ISO 27001 Management Review is not just another meeting—it’s a mandatory, formal assessment of your entire Information Security Management System (ISMS) by top leadership. Walking into this high-stakes meeting unprepared, missing a required agenda item, or failing to properly document the outcomes can lead to a major non-conformity in your certification audit. How do you ensure your review is both productive and fully compliant?

Our ISO 27001 Management Review Meeting Template is your complete guide to planning, conducting, and documenting a successful review. It provides a pre-built agenda covering every mandatory input required by the standard, a professional template for recording meeting minutes, and a structured process to ensure you generate the actionable, auditable outputs that certification bodies demand.

From the Experts at ISO 27001 Pro

From the experts at ISO 27001 Pro, this template is designed to take the stress and guesswork out of this critical meeting. We’ve structured it to ensure you can present the performance of your ISMS to leadership confidently and clearly, turning a mandatory compliance task into a genuinely valuable strategic review that drives continual improvement.

In-Depth ISO 27001 Compliance Breakdown

This template is your direct response to the mandatory requirements of ISO 27001 Clause 9.3 (Management review). It provides the structure and documented evidence to prove your compliance with every part of the clause:

• Clause 9.3.1 – General: The template helps you schedule your reviews at ‘planned intervals’ (e.g., annually) and provides a professional format to invite and record the attendance of top management.
• Clause 9.3.2 – Management review inputs: Our pre-built agenda is a checklist that includes every single mandatory input listed in the standard, ensuring you will not miss a topic. This includes the status of previous actions, results of risk assessments, nonconformities, audit results, performance metrics, and feedback from interested parties.
• Clause 9.3.3 – Management review results: The meeting minutes template is structured to capture the mandatory outputs from the meeting. This includes recording all decisions related to continual improvement opportunities and documenting any required changes to the ISMS, creating the official record your auditor needs to see.

FAQ: Common Questions about the Management Review

• How often do we need to hold a Management Review meeting? The standard requires them to be held at ‘planned intervals’. For almost all organizations, this means you must hold at least one formal Management Review per year to maintain your certification. Many companies choose to hold them more frequently, such as quarterly or semi-annually, to keep leadership more actively engaged with the ISMS.
• Who from ‘top management’ must attend this meeting? ‘Top management’ refers to the person or group of people who direct and control the organization at the highest level. This typically includes C-level executives (CEO, CTO, CISO) and other senior leaders who have the authority to make decisions and assign resources for the ISMS. The attendance list in your meeting minutes is key evidence of leadership commitment for your auditor.
• What’s the most common mistake companies make in this meeting? The most common mistake is failing to discuss all the mandatory inputs listed in Clause 9.3.2. It’s easy to forget one, such as ‘feedback from interested parties’ or the ‘results of monitoring and measurement’. Another common error is failing to produce clear, documented outputs in the form of decisions and actions. Our template’s agenda and minutes structure is designed specifically to prevent these mistakes.
• Is this template just an agenda, or does it include more? It’s a complete meeting pack designed to ensure success. It includes: 1) A formal procedure document explaining the ‘how-to’ of your management review process from start to finish. 2) A pre-built, compliant meeting agenda template you can circulate beforehand. 3) A professional meeting minutes template structured to capture all required inputs and outputs during the meeting.