Management review inputs

What the requirement asks

Management review has to take into account: the status of actions from earlier reviews; changes in internal and external issues relevant to the ISMS; changes in the needs and expectations of relevant interested parties; feedback on security performance including trends in nonconformities and corrective actions, monitoring and measurement results, audit results and achievement of objectives; feedback from interested parties; risk assessment results and the status of the risk treatment plan; and opportunities for continual improvement.

What the guidance adds

The inputs are expected to include the status of previous actions, changes in context, performance, feedback from interested parties, risk results and improvement opportunities. The guidance treats each input as a question the review must answer, not an item to note.

What good looks like

Keep A management review agenda or input pack covering each required input with the clause record, and give it an owner and a review date.

Evidence an assessor asks for

• Review inputsA management review agenda or input pack covering each required input
• Review inputsTrend data on nonconformities, measurement, audits and objectives
• Review inputsStatus of previous review actions
• Review inputsRisk assessment results and treatment plan status presented to the review

The question an assessor will ask

An assessor will ask for A management review agenda or input pack covering each required input. The test for 9.3.2 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.

Common gaps

• Inputs are limited to a status update and omit trends
• Interested-party feedback and changes are missing
• The status of earlier actions is not reviewed
• Risk treatment progress is not presented

Before the next audit

Before the next audit, test this against one live record: inputs are limited to a status update and omit trends.