Clause 9.3 · management review

Seven things go in, two things come out

What goes in
1
Actions agreed at the last review
2
Changes inside and outside the company
3
What customers and other interested parties now expect
4
Performance: metrics, audits, nonconformities, objectives
5
Feedback from interested parties
6
Where risk assessment and treatment stand
7
Opportunities to improve
What has to come out
1
Decisions about improvements
What gets better, and who does it
2
Decisions about changes to the ISMS
Scope, resources, policies, priorities
Both written down as evidence