[{"data":1,"prerenderedAt":14},["ShallowReactive",2],{"article:en:the-iso-9001-management-review-the-13-inputs-and-3-outputs-of-clause-9-3-as-an-agenda-where-each-input-comes-from-and-what-the-minutes-have-to-show":3},{"locale":4,"slug":5,"title":6,"description":7,"published":8,"answer":9,"body":13},"en","the-iso-9001-management-review-the-13-inputs-and-3-outputs-of-clause-9-3-as-an-agenda-where-each-input-comes-from-and-what-the-minutes-have-to-show","The ISO 9001 management review: the 13 inputs and 3 outputs of clause 9.3 as an agenda, where each input comes from, and what the minutes have to show","Clause 9.3 of ISO 9001:2015 is the one meeting the standard writes the agenda for. Top management reviews the quality management system at planned intervals for suitability, adequacy, effectiveness and alignment with strategy (9.3.1); considers thirteen inputs, from the status of last time's actions to the performance of external providers (9.3.2); and decides on improvement, changes to the system and resources (9.3.3), with the results retained as documented information. The agenda, the record behind each input, what the minutes must show, and how the same meeting serves ISO 27001 and, for NIS2 entities, the annual policy review the Implementing Regulation requires.","2026-09-12",{"who":10,"when":11,"do":12},"Top management of a company running an ISO 9001 quality management system, and the quality manager who prepares the review for them: the standard writes the agenda for this one meeting, and the certification auditor reads the minutes against it line by line.","At planned intervals, once a year for most companies and before the certification audit, and whenever a change in the business or its customers needs a decision at the top; the actions from the previous review open the next one.","Put the thirteen inputs on the agenda in the clause's order with the record each comes from, judge the system on the four words of 9.3.1, decide on improvement, on changes to the system and on resources, give every action an owner and a date, and keep the minutes as documented information.","\nMost clauses of ISO 9001:2015 tell an organisation what to achieve and leave the how to it. Clause 9.3 is different: it tells top management to hold a meeting, lists what has to be on the table, and lists what has to come out. It is the clause an auditor reads the minutes against, line by line, and the one most often found wanting, because a management meeting that discussed quality is not the same thing as a management review with the thirteen inputs in front of it. This article is the clause as an agenda, the record each input comes from, and what the minutes have to show, in our reading of the text; the wording is ISO's and is not reproduced.\n\n## What the meeting is for (9.3.1)\n\n9.3.1 says top management reviews the quality management system at planned intervals to ensure it stays suitable, adequate and effective, and aligned with the organisation's strategic direction. Four words to check the system against, and a fifth requirement that is easy to miss: the review is top management's, not the quality manager's. The quality manager prepares it; the people who set the strategic direction hold it, because alignment with that direction is one of the four things being judged.\n\n\"Planned intervals\" is the only frequency the standard gives. Annual is the common practice and the one certification bodies expect to see between surveillance audits; for a NIS2 entity in the sectors of Implementing Regulation (EU) 2024\u002F2690, the security policy has to be reviewed by the management bodies at least annually anyway (point 1.1.2 of its Annex), and [the twelve records that Regulation asks of the management body](\u002Farticles\u002Fnis2-article-20-for-the-board-what-the-management-body-must-approve-oversee-and-learn-the-twelve-places-the-implementing-regulation-names-it-and-what-liability-means) fit the same meeting.\n\n## The thirteen inputs (9.3.2), as an agenda\n\n9.3.2 lists what the review is planned and carried out \"taking into consideration\". Six items, of which the third has seven sub-items, thirteen lines in all. Each is an agenda item, and each has a record somewhere else in the system that it is read from.\n\n| Item | Input | The record it comes from |\n| --- | --- | --- |\n| 1 | The status of actions from previous management reviews | The previous minutes and their action list |\n| 2 | Changes in external and internal issues relevant to the system | The context analysis of 4.1 and the interested parties of 4.2, updated |\n| 3 | Customer satisfaction and feedback from relevant interested parties | The monitoring of customer perception under 9.1.2: surveys, complaints, reviews, returns |\n| 4 | The extent to which quality objectives have been met | The objectives of 6.2 with their measures and results |\n| 5 | Process performance and conformity of products and services | Process indicators from 4.4, release records from 8.6 |\n| 6 | Nonconformities and corrective actions | The nonconformity register of 10.2 |\n| 7 | Monitoring and measurement results | The results of 9.1.1 |\n| 8 | Audit results | The internal audit reports of 9.2 and any external audit |\n| 9 | The performance of external providers | The supplier evaluations of 8.4 |\n| 10 | The adequacy of resources | 7.1: people, infrastructure, environment, measuring resources, knowledge |\n| 11 | The effectiveness of actions taken to address risks and opportunities | The risk and opportunity actions planned under 6.1 and their results |\n| 12 | Opportunities for improvement | 10.1, and everything above |\n\nItems 3 to 9 are the seven sub-items of the performance and effectiveness input, and the standard asks for trends in each, not a snapshot: a review that says \"customer satisfaction: good\" has not considered a trend. The thirteenth line is the input's own heading, information on the performance and effectiveness of the system, which the seven together make up.\n\nTwo of the inputs are the ones a first review most often lacks. Customer satisfaction (item 3) needs the 9.1.2 monitoring to have been set up beforehand; a company that never asked its customers has nothing to bring. Process performance (item 5) needs the indicators that 4.4.1 asks each process to have; a company that mapped its processes without measures has a map and no reading. Both are decided months before the meeting, which is why the agenda is worth reading at the start of the year rather than the week before.\n\n## The three outputs (9.3.3), and what the minutes have to show\n\n9.3.3 says the outputs of the review include decisions and actions on three things: opportunities for improvement, any need for changes to the quality management system, and resource needs. Then the sentence that makes the meeting a record: the organisation retains documented information as evidence of the results of management reviews.\n\nWhat that evidence has to show follows from the two lists. The minutes name the date and who attended, and that top management was among them. They show each of the thirteen inputs was considered, with the trend, not only that it was on the agenda. They record the decisions under the three headings of 9.3.3, and for each action an owner and a date, because item 1 of the next review is the status of exactly these actions. A one-line entry \"no changes needed\" against an output is a decision and is fine; an input with nothing against it is a gap an auditor will write up.\n\nWhat the minutes do not need is length. A review of a small company that reads twelve records and makes six decisions fits on two pages; the records themselves are retained where they live, under their own clauses, and the minutes point to them.\n\n## One review for ISO 9001 and ISO 27001\n\nClause 9.3 is part of the Harmonized Structure, the common skeleton of the ISO management system standards, and ISO\u002FIEC 27001:2022 has a clause 9.3 of the same shape: top management, planned intervals, inputs, outputs, retained evidence. The inputs overlap and differ. Both ask for the status of previous actions, changes in external and internal issues, nonconformities and corrective actions, monitoring and measurement results, audit results, the fulfilment of objectives and opportunities for improvement. ISO 27001 adds changes in the needs and expectations of interested parties, the results of the risk assessment and the status of the risk treatment plan, and feedback from interested parties; ISO 9001 adds customer satisfaction, process performance and product conformity, the performance of external providers, the adequacy of resources and the effectiveness of risk and opportunity actions.\n\nA company certified to both holds one review with the union of the two lists, and minutes that mark which standard each input serves. That is how StandardOS keeps it: one management review record per period, its agenda drawn from the standards the organisation holds, the inputs linked to the records they are read from and the actions carried into the next review as item 1. [Which ISO 9001 clauses the product covers in full, in part or not at all is published clause by clause](\u002Fiso-9001); 9.3 is among those marked in part, and the register says why. The documents the review reads and the [documented information clause 7.5 asks for](\u002Farticles\u002Fdoes-iso-9001-2015-require-a-quality-manual-what-clause-7-5-asks-for-instead-the-21-places-the-standard-names-documented-information-and-what-a-manual-is-for-today) are the companion piece.\n\n## Sources\n\n- ISO 9001:2015, clauses 4.1, 4.2, 4.4.1, 6.1, 6.2, 7.1, 8.4, 8.6, 9.1.1, 9.1.2, 9.2, 9.3.1, 9.3.2, 9.3.3, 10.1 and 10.2, cited by number; the text is ISO's and is not reproduced.\n- ISO\u002FIEC 27001:2022, clause 9.3, for the inputs the two reviews share and the ones they do not.\n- Commission Implementing Regulation (EU) 2024\u002F2690, Annex, point 1.1.2, for the annual policy review by the management bodies.\n\nThis is not certification advice. Whether a review is adequate is the certification body's judgement at audit; the clause above is what it reads the minutes against.\n",1789383983653]