Many organisations associate the management review primarily with a requirement in the ISO standards. But organisations that derive the greatest value from the process see it as far more than a mandatory activity before an audit. When the management review is used correctly, it becomes a strategic tool that helps leadership evaluate the organisation’s direction, identify risks and ensure continual improvement.
Here we take a closer look at what a management review is, why it matters, and how organisations can carry out the process effectively with the help of a digital management system such as Certain QMS.
What is a management review?
A management review (also referred to as a management evaluation) is a structured and planned activity in which the organisation’s top management assesses whether the management system remains suitable, adequate and effective.
This is a central requirement in ISO standards such as ISO 9001, ISO 14001, ISO 45001 and ISO 27001. The purpose is to ensure that the management system supports the organisation’s strategy and contributes to achieving its objectives.
When the standards refer to suitability, this concerns whether the way the organisation operates continues to align with its strategy and needs. Adequacy concerns whether the organisation has the resources, structures and competence required to succeed. Effectiveness concerns the results — whether actions, decisions and processes are actually delivering the desired effect.
Many organisations carry out the management review once a year, but it is also possible to split the process into quarterly or half-yearly reviews. What matters most is that the process is carried out regularly and that it is actively used by management.
A management review is not an ordinary operational meeting
A common misconception is that the management review is simply an extended status meeting.
In reality, the review should lift the gaze above day-to-day operations and provide a holistic picture of the organisation. The purpose is not to discuss individual incidents or isolated challenges, but to assess how the organisation is functioning as a whole.
Management should be able to answer questions such as:
- Are we moving in the right direction?
- Does the management system support our strategy?
- Are there risks we cannot accept?
- Is there a need to adjust course?
- Are the actions we are implementing delivering the desired effect?
The review should therefore serve as a strategic checkpoint at which management assesses the organisation’s overall development.
What is actually being reviewed?
When the ISO standards require the organisation to review its management system, this encompasses far more than documentation and procedures.
A management system does indeed consist of processes, roles, responsibilities and digital tools. But it also concerns how the organisation actually functions in practice.
How are decisions made? How is risk managed? How are non-conformities followed up? How does learning and improvement happen? And how does the organisation behave when placed under pressure?
Through the data gathered in the management system, leadership gains a picture of the organisation’s actual behaviour over time. The management review therefore also becomes an assessment of the organisational culture.
It is not only about what the organisation says it does, but about what it actually does.
Why is the management review so important?
Many will be familiar with the expression “culture eats strategy for breakfast”.
Even the best strategy will have limited impact if the organisational culture pulls the business in a different direction. The management review is therefore an important arena for examining whether culture, behaviour and decisions support the direction the organisation wants to take.
If employees make decisions day to day that gradually move the organisation away from its strategy, culture will over time exert greater influence than management’s plans.
Although the ISO standards rarely use the word “culture”, clear expectations regarding this are embedded in the assessment of the management system’s suitability and effectiveness. The management review therefore gives leadership a unique opportunity to uncover gaps between strategy and actual practice.
When the process is used correctly, it becomes an important leadership tool for steering the development of the organisation.
What data should be included in the management review?
The ISO standards set out requirements for which inputs should be considered in the management review. At the same time, it is important to remember that the goal is not to gather as much data as possible.
The value lies in the analysis of the data.
Management should focus on patterns, trends and signals that say something about how the organisation is developing.
Typical areas considered include:
- Status of actions from previous management reviews
- Results from audits
- Non-conformities and corrective actions
- Risks and opportunities
- Changes in internal and external factors
- Objective achievement and performance
- Resources and competence
- Customer and stakeholder feedback
- Compliance with legal and other requirements
For organisations certified to multiple standards, certain requirements will be specific to the standard in question. For example, ISO 9001 places greater emphasis on customer satisfaction, whilst ISO 14001 focuses on environmental performance and ISO 27001 on information security.
From data to decisions
The real value of the management review does not arise when data is presented, but when management discusses what the data means.
If the review consists only of reporting without reflection and decisions, the organisation misses the most important part of the process.
Management must ask questions such as:
- Why are we not achieving our objectives?
- Which challenges keep recurring?
- Which risks should be prioritised?
- What are the trends telling us about the future?
- Which actions do we need to initiate?
A growing number of non-conformities, for example, is not necessarily the problem in itself. What is interesting is what the trend tells us about the organisation. Does the organisation lack competence? Is capacity too low? Have priorities been wrong?
The answers to these questions form the basis for decisions that can influence the organisation’s further development.
Documentation and follow-up are essential
A good discussion has little value if it does not result in concrete actions.
The decisions from the management review must therefore be documented and followed up systematically. These may include:
- Corrective actions linked to non-conformities
- Improvement proposals
- New objectives or priorities
- Resource decisions
- Changes to processes or working methods
All actions should have clearly assigned responsible parties, expected outcomes and planned deadlines.
Follow-up is essential to ensure that actions actually deliver the desired effect. If an action is not working as planned, the organisation must evaluate why and adjust course accordingly.
Continual improvement does not happen because a problem is recorded. It happens because the problem is followed up until it is resolved.
How can Certain QMS support the management review?
In many organisations, the information needed for the management review is spread across different systems, documents and spreadsheets. This makes the process both time-consuming and vulnerable.
In Certain QMS, the management review can be structured through the use of annual planners, tasks, risk, non-conformities, audits, document control and reporting.
An annual planner makes it possible to plan activities, assign responsibilities and ensure that the review is carried out at regular intervals. At the same time, the organisation can draw on insights from relevant modules such as:
- Non-conformities and improvements
- Risk assessments
- Audits
- Checklists and controls
- Document control
- Register for legal requirements and compliance assessments
- Dashboards and reports
By consolidating information in one place, management gains a better foundation for identifying trends, following up on decisions and documenting that the requirements of the ISO standards have been met.
Management review as part of organisational governance
The most mature organisations do not view the management review as an annual ISO exercise. They use it as an active management tool to ensure that strategy, culture and operations all pull in the same direction.
When the process is well planned, built on relevant data and leads to concrete decisions, the management review becomes an important part of the organisation’s leadership and continual improvement work. At that point it is no longer about satisfying a requirement in a standard — but about achieving better results.
Audhild Smith-Bergtun
Businesss Consultant