ISO 9001 Management Review: Clause 9.3 Complete Guide + Free Template

The management review is one of the most important — and most frequently mishandled — requirements in ISO 9001. Done right, it's a powerful tool for driving real improvement. Done wrong, it's an annual checkbox exercise that wastes everyone's time and still draws audit findings.

This guide covers everything you need to know about ISO 9001 Clause 9.3: what the standard actually requires, what auditors look for, common mistakes, and how to run a management review that adds genuine value. A free agenda template is included at the bottom.

What Is a Management Review?

A management review is a formal meeting (or series of meetings) where top management evaluates the overall health and effectiveness of the quality management system. It's the mechanism by which leadership stays connected to QMS performance — not just delegating quality to the quality manager, but actively reviewing data, making decisions, and allocating resources.

Clause 9.3 sits within Section 9 — Performance Evaluation — alongside internal audits (9.2) and monitoring and measurement (9.1). Together, these three clauses form the "check" phase of Plan-Do-Check-Act. The management review is where data gathered through monitoring and auditing gets elevated to leadership for action.

What Clause 9.3 Actually Requires

The clause is structured around three sub-clauses:

9.3.1 — General

Top management must review the QMS at planned intervals. The review must assess suitability, adequacy, effectiveness, and alignment with the organization's strategic direction. The standard doesn't specify frequency — "planned intervals" means you define the schedule and stick to it.

9.3.2 — Management Review Inputs

This is where many organizations fall short. The standard specifies seven required inputs that must be considered:

1. Status of actions from previous management reviews — Were last year's action items completed? What's still open?
2. Changes in external and internal issues — New regulations, market shifts, organizational changes, new risks or opportunities (links to Clause 4.1 and 4.2)
3. QMS performance and effectiveness — This is the bulk of the review, and includes:
   • Customer satisfaction and feedback
   • Quality objectives achievement
   • Process performance and product/service conformity
   • Nonconformities and corrective actions
   • Monitoring and measurement results
   • Audit results (internal and external)
   • External provider (supplier) performance
4. Adequacy of resources — Do we have what we need to run the QMS?
5. Effectiveness of actions taken to address risks and opportunities — Are the risk controls actually working?
6. Opportunities for improvement — What could we do better?

Every one of these inputs must be addressed. If you're skipping supplier performance or audit results, that's a finding waiting to happen.

9.3.3 — Management Review Outputs

The review must produce documented outputs — decisions and actions — in three areas:

• Opportunities for improvement — specific actions, not vague commitments
• Any need for changes to the QMS — process changes, procedure updates, scope changes
• Resource needs — budget, headcount, equipment, training

The outputs must be retained as documented information. An unsigned, undated meeting summary sitting in someone's email doesn't cut it.

How Often Should You Conduct Management Reviews?

ISO 9001 says "at planned intervals" — no specific frequency is required. In practice:

• Annual: The minimum most certification bodies accept. Works for stable, mature QMS environments.
• Semi-annual: Common for growing companies or those with active corrective action programs.
• Quarterly: Best practice for organizations with high transaction volume, significant quality issues, or rapid growth.

One note: the standard says intervals must be "planned," meaning the schedule should be set in advance and documented (typically in the QMS manual or a master schedule). An auditor asking "when is your next management review?" should get a specific answer, not a shrug.

You can also split the review into multiple shorter sessions covering different topics, as long as all required inputs are addressed within the review cycle and documented together.

Who Must Attend?

Clause 9.3 requires top management to conduct the review. ISO 9001 defines top management as the person or group directing and controlling the organization at the highest level — typically the CEO, President, owner, or equivalent. This is not a meeting that can be delegated entirely to the quality manager.

Typical attendees beyond top management:

• Quality Manager / QMS Representative
• Department heads (production, engineering, purchasing, HR, etc.)
• Anyone responsible for presenting a specific input area

Attendance should be documented. Auditors sometimes ask who was present — if your records only show a signature at the bottom and no attendee list, that creates doubt.

Common Audit Findings for Clause 9.3

Based on real-world audit findings, here's what gets cited most often:

• Missing required inputs: The review agenda covered some inputs but not all seven. Supplier performance and resource adequacy are commonly skipped.
• No evidence of top management participation: The quality manager ran the meeting alone. No evidence that leadership was actually involved.
• Vague outputs: "We will improve customer satisfaction" is not an actionable output. Auditors want to see specific decisions with owners and timelines.
• Open actions from prior reviews with no update: The 2024 review identified three actions. The 2025 review has no mention of them.
• No documented records: The meeting happened, but the minutes were never finalized, signed, or stored in the document control system.
• Review not tied to quality objectives: The organization has documented quality objectives, but the review never discusses whether they were achieved.

How to Run an Effective Management Review

The goal is to make the management review genuinely useful — not just compliant. Here's a practical approach:

1. Prepare data packages in advance. Each input area should have a brief data summary ready before the meeting. Don't compile data during the meeting — that's a waste of leadership time.
2. Use trend data, not snapshots. "We had 12 customer complaints this year" is less useful than "complaints increased 40% in Q3 after the new product launch and returned to baseline in Q4 after corrective action." Trends tell a story.
3. Link quality objectives to results. For each objective, show the target, the actual performance, and what you're doing if you're off track.
4. Make outputs specific and assignable. Every action coming out of the review should have a responsible person, a due date, and a measurable outcome. "Review the supplier qualification procedure by April 30 — owner: Jane Smith" is good. "Improve supplier management" is not.
5. Document everything formally. Meeting minutes should include date, attendees, all inputs reviewed, all decisions and actions, and signatures. Store them in your document control system with a unique document number and revision.
6. Follow up on open actions at the next review. The first agenda item of every management review should be the status of actions from the last one.

Management Review vs. Internal Audit: Understanding the Difference

These two clauses are often confused. Here's the distinction:

• Internal audits (Clause 9.2) verify conformance — do our processes match our documented procedures and ISO requirements? They're conducted by trained auditors examining specific processes or areas.
• Management reviews (Clause 9.3) evaluate overall effectiveness — is the QMS working, is it aligned with strategy, does it need to change? They're conducted by top management reviewing system-level data.

Internal audit results feed into the management review as one of the required inputs. The management review then makes strategic decisions based on what audits (and other data) reveal.

Free Management Review Template

Download our free Management Review Agenda and Minutes template. It includes:

• Pre-formatted agenda covering all seven required inputs
• Data summary sections for each input area
• Action item log with owner, due date, and status fields
• Signature block for top management approval
• Version history table for document control compliance

The Training Data Your Management Review Is Missing

One of the most underutilized inputs in management reviews is training and competence data. Clause 9.3.2 requires a review of QMS performance and effectiveness — and that includes whether your people are trained and competent.

Most organizations either skip this entirely or present a vague summary ("all employees have completed required training"). What leadership actually needs to make informed decisions:

• What percentage of required training is current vs. overdue?
• Which departments or roles have the highest training gaps?
• How are employees performing on competence assessments?
• Are retraining rates increasing after document revisions?

Training Tiger gives you this data in real time. The training reports show completion rates by employee, department, and document — exactly what you need to walk into a management review with confidence.

Frequently Asked Questions

Related Articles

• Internal Audit Checklist & Procedure — ISO 9001 Clause 9.2
• ISO 9001 Clause 7.2 Competence: What Auditors Actually Want to See
• Corrective Action Procedure (CAPA) Template: Free Download & ISO 9001 Guide