3.5 Auditing Clause 9.3: Management Review Inputs, Outputs and Decisions
Key Takeaways
- ISO 14001:2015 Clause 9.3 requires top management to review the EMS at planned intervals for continuing suitability, adequacy and effectiveness.
- Seven lettered inputs a) to g) are mandatory, and input d) requires trends in nonconformities, monitoring results, compliance fulfilment and audit results.
- Outputs must include conclusions on suitability, adequacy and effectiveness plus decisions on improvement, EMS changes, resources and strategic direction.
- Action is mandatory where environmental objectives have not been achieved — recording a missed objective with no action breaches the clause.
- A review attended only by EHS staff without top management does not satisfy Clause 9.3 regardless of how the minutes are titled.
Auditing Clause 9.3: Management Review Inputs, Outputs and Decisions
Quick Answer: ISO 14001:2015 Clause 9.3 requires top management to review the EMS at planned intervals to ensure its continuing suitability, adequacy and effectiveness. The clause prescribes seven lettered inputs a) to g) and a defined set of outputs, and requires documented information to be retained as evidence of the results. Management review is the clause where a lead auditor tests whether environmental management has actually reached the top of the organization — and, alongside internal audit, it must be examined at every surveillance audit.
The Seven Required Inputs
| Input | Requirement | What the auditor asks for |
|---|---|---|
| a) | Status of actions from previous management reviews | The previous minutes, and evidence each action was closed or carried forward with reasons |
| b) | Changes in: 1) external and internal issues relevant to the EMS; 2) needs and expectations of interested parties, including compliance obligations; 3) significant environmental aspects; 4) risks and opportunities | Evidence that Clauses 4.1, 4.2, 6.1.2, 6.1.3 and 6.1.1 outputs were actually revisited, not just listed |
| c) | The extent to which environmental objectives have been achieved | Objective-by-objective status against the Clause 6.2.2 action plans |
| d) | Information on environmental performance, including trends in: 1) nonconformities and corrective actions; 2) monitoring and measurement results; 3) fulfilment of compliance obligations; 4) audit results | Trend data over time, not a single-period snapshot |
| e) | Adequacy of resources | An explicit management judgement on whether resource is sufficient — Clause 7.1 links here |
| f) | Relevant communications from interested parties, including complaints | The external communications log from Clause 7.4.3, including neighbour complaints |
| g) | Opportunities for continual improvement | The bridge into Clause 10.1 and 10.3 |
The word trends in input d) is heavily examined. A management review pack that reports "four nonconformities this year" satisfies nothing; input d) requires trend information, which means performance presented over time so that direction of travel is visible. A single-period bar chart is not a trend.
The Required Outputs
The outputs of management review shall include:
- conclusions on the continuing suitability, adequacy and effectiveness of the EMS;
- decisions related to continual improvement opportunities;
- decisions related to any need for changes to the EMS, including resources;
- actions, if needed, when environmental objectives have not been achieved;
- opportunities to improve integration of the EMS with other business processes, if needed;
- any implications for the strategic direction of the organization.
The organization shall retain documented information as evidence of the results of management reviews.
Two output requirements do most of the grading work in practice:
- The suitability / adequacy / effectiveness conclusion is three separate judgements. Minutes that say "the EMS is working well" reach none of them. Suitability asks whether the EMS still fits the organization's context; adequacy asks whether it is sufficient to meet requirements; effectiveness asks whether it delivers the intended outcomes.
- Actions where objectives were not achieved are mandatory, not discretionary. If the minutes record a missed objective and no action, the clause is breached on its face.
The Audit Trail
INPUT SIDE REVIEW OUTPUT SIDE
---------- ------ -----------
4.1 / 4.2 changes ------\ /---> conclusions on
6.1.1 risks & opps ------ \ / suitability,
6.1.2 sig. aspects ------- \ TOP MANAGEMENT / adequacy,
6.1.3 obligations -------- --> at planned ------> effectiveness
6.2 objective status ----- / intervals \
9.1 monitoring trends ---- / \---> decisions on
9.1.2 compliance status -/ \ improvement,
9.2 audit results ------/ \ EMS changes,
7.4.3 complaints -----/ \ resources,
7.1 resource view --/ \ objectives,
\ integration,
\ strategic
direction
|
v
10.1 opportunities determined
10.3 continual improvement
Practical sequence for a Stage 2 or surveillance audit:
- Establish the planned interval and confirm the review actually happened within it. "At planned intervals" means the organization defines the frequency and then meets it; annual is common but not required.
- Confirm top management participation. Clause 9.3 places the obligation on top management. A review chaired by the EHS Manager with no executive attendance does not satisfy the clause, whatever the minutes are titled.
- Trace each of the seven inputs into the pack. Missing inputs are the single most common Clause 9.3 finding.
- Test input d) for trend data specifically.
- Trace outputs to decisions with owners and dates. A review that produces observations but no decisions has not met the output requirement.
- Trace one decision forward. Pick a decision on resources or improvement and follow it into Clause 7.1 resourcing, a revised objective under 6.2, or a change to operational control under 8.1. This is the test of whether management review is a governance process or a ceremony.
- Verify retained documented information.
Grading Guidance
| Evidence found | Typical grade | Reasoning |
|---|---|---|
| No management review has been held since certification | Major | Complete absence of a required top-management process |
| Reviews held, but attended only by the EHS Manager and a site engineer; no top management present | Major | The clause obligation rests on top management; the process as operated cannot deliver strategic decisions |
| Four of the seven inputs are absent from every review pack across three years | Major | Systemic, repeated omission defeating the purpose of the review |
| Objectives reported as missed for two consecutive years with no action recorded | Major | Explicit output requirement breached, and the EMS is not achieving its intended outcomes |
| Input f) (external communications and complaints) omitted from one of three review packs | Minor | Isolated omission in an otherwise complete process |
| Performance reported as single-period figures rather than trends | Minor | Input d) breach; escalate if it prevents any conclusion on effectiveness |
| Minutes retained but unsigned and undated | Minor | Documented information control issue under Clause 7.5.3 |
Worked Scenario: The Review That Reviewed Nothing
Evidence. A logistics company's 2026 management review minutes run to one page. Attendees: EHS Coordinator, Fleet Supervisor. The minutes list the number of internal audits completed and state "the EMS remains effective". The site's two environmental objectives — a 10 percent reduction in fleet fuel consumption and elimination of uncontained refuelling spills — are not mentioned. Fuel consumption data shows the objective was missed by a wide margin. Three neighbour complaints about depot noise and diesel odour were logged under Clause 7.4.3 during the year and do not appear.
Analysis. Input c) (extent to which objectives have been achieved), input d) (performance trends), input f) (communications including complaints) and input a) (status of previous actions) are all absent. Top management did not attend. The mandatory output requiring action where objectives have not been achieved is unmet. The single assertion "the EMS remains effective" does not deliver conclusions on suitability, adequacy and effectiveness.
Finding. A major nonconformity against Clause 9.3. The reasoning to state in the finding is not "several inputs were missing" but that the review, as operated, cannot produce the conclusions and decisions the clause requires — which raises significant doubt about the EMS's capability to achieve its intended outcomes (ISO/IEC 17021-1 Clause 3.12).
Statement discipline. Cite the requirement (Clause 9.3 inputs a), c), d), f) and the output requiring action on unachieved objectives), state the failure, and give traceable evidence (minutes dated, attendee list, objective register reference, complaint log entries). Do not tell the client to invite the Managing Director — that is the remedy, and the remedy is theirs.
Which of the following is a mandatory input to management review under ISO 14001:2015 Clause 9.3?
A management review records that both environmental objectives were missed during the year, notes the shortfall, and closes with no further entry. Which requirement is breached?
A site's management review is chaired by the EHS Manager and attended by a site engineer. No director or executive attends. All seven inputs are present and decisions are recorded. How should the lead auditor evaluate this?
Which set correctly states the three judgements that the conclusions from a management review must address?