Management review

Review from live registers, not a blank agenda.

ISO 9001, 45001 and 14001 all ask top management to review the system. PolicySystem builds that review from incidents, CAPA, training expiry and the internal audit score, then files agenda, inputs and minutes. It is not a board portal.

What goes in

Counts from the registers you already run: incidents and near misses still open, hazards on the book, corrective actions open or overdue, expired training tickets, and the latest internal audit score. Prior actions come forward so they do not vanish between meetings. That is clause 9.3 in practice, for a small Australian business, not a corporate pack.

What you file

A controlled management review record: date, inputs, discussion, decisions, and actions to raise. You can print it with the same document control as the policies. An assessor who asks "show me the last management review" should get this, not a calendar invite.

What this is not

Not a board paper system and not a strategy offsite. Not SWMS review on a job. We are not a certification body. The review proves you look at the system. The JAS-ANZ body still decides whether that system meets the standard.

A management review agenda that satisfies clause 9.3

  1. Actions from the previous review: closed, open or overdue.
  2. Changes that affect the system: new work, new sites, new legislation, new clients.
  3. Incidents and near misses since the last review, and what was learned.
  4. Corrective actions: raised, closed, overdue, and the trend.
  5. Training: expired or expiring tickets, inductions completed.
  6. Internal audit results and the current score by clause.
  7. Consultation with workers: toolbox talks, issues raised, how they were answered.
  8. Legal compliance and interested party requirements (clients, portals, regulators).
  9. Resources: people, equipment, budget, and whether they are adequate.
  10. Objectives: are they being met, do they need to change.
  11. Decisions and actions, each with an owner and a due date.

Doing it in an hour in a small business

The reason management review feels like a corporate ritual is that most templates start with a blank agenda and expect someone to go hunting for numbers. When the registers are live the numbers are already there. The owner, the supervisor and whoever runs the office sit down with the pre-filled agenda, talk through each item, write a line of discussion and a decision, and raise actions straight into the CAPA register. The minutes are filed as a controlled record. One hour, once a year, and the clause is met.

How assessors test it

They ask for the last minutes. They check the date is within the planned interval. They look for real numbers rather than "no issues". They pick an action and follow it into the corrective action register to see whether it was closed. Then they ask whether the previous review's actions came forward. A review built from live data passes all of that by construction.

Where to next

Document control · ISO 9001 and 45001 for tenders · ISO certification cost · Induction and training · HSEQ software

Common questions.

Clause 9.3. Top management (in a small business, the owner or director) reviews the management system at planned intervals to make sure it is still suitable, adequate and effective. The standard lists the inputs to consider and the outputs to record. It is a meeting with an agenda and minutes, not a gut feel.

The standard says planned intervals. Most small businesses do it annually, with a shorter quarterly check on open actions. Certification bodies want to see at least one full review with minutes before Stage 2, and one every year after.

Status of actions from the last review. Changes in external and internal issues. Performance data: incidents, nonconformities, corrective actions, monitoring results, audit results, legal compliance. Adequacy of resources. Consultation with workers (45001). Risks and opportunities. Opportunities for improvement. PolicySystem pulls the performance data from the registers so the agenda is pre-filled.

Decisions on improvement opportunities, any need to change the system, resource needs, and actions. Each action should have an owner and a due date and land in the CAPA register so it is tracked to closure, not lost in the minutes.