5.3 Clause 9.3 — Management review

Clause 9.3 closes the loop between the operational evidence gathered in 9.1 and 9.2 and the strategic decisions only top management can make. Where clause 9.1 asks "what does the data say?" and clause 9.2 asks "is the system being independently checked?", clause 9.3 asks top management to step back, at planned intervals, and ask "is this QMS still fit for purpose?"

9.3.1 General

Clause 9.3.1 requires top management -- the term matters, since this cannot be fully delegated to a quality manager -- to review the organization's QMS at planned intervals to ensure its continuing:

• suitability -- is it still the right system for the organization as it is today?
• adequacy -- is it resourced and structured well enough to work?
• effectiveness -- is it actually delivering intended results?
• alignment with the strategic direction of the organization -- a requirement new in the 2015 revision, tying the QMS explicitly to business strategy rather than treating it as a stand-alone compliance activity

ISO 9001 does not mandate a specific frequency. Annually is common, but higher-risk or fast-changing organizations often review quarterly, and whatever interval is chosen should be justified and consistently followed.

9.3.2 Management Review Inputs

Clause 9.3.2 lists the topics that must be planned for and considered. This is one of the most heavily tested lists on the exam, because auditors are expected to check that every item is genuinely present rather than assumed:

Notice that "audit results" covers both internal audits (9.2) and, where relevant, external certification and surveillance audits -- management review is meant to draw on the whole audit picture, not just self-generated data. In practice, the two inputs most often missing from a review are the performance of external providers, since organizations tend to treat supplier management as purely an 8.4 activity, and the adequacy of resources, a topic that is easy to skip because it invites uncomfortable conversations about budget and headcount.

9.3.3 Management Review Outputs

Reviewing inputs is not the point of the clause. Clause 9.3.3 requires the review to produce decisions and actions related to:

1. Opportunities for improvement
2. Any need for changes to the QMS
3. Resource needs

The organization must retain documented information as evidence of management review results, typically meeting minutes, but the content matters more than the format. Minutes that simply record "reviewed and discussed" against each input, with no decision, no owner, and no due date, do not satisfy 9.3.3. A conforming record shows a decision was taken and can be traced forward to whether it was actioned.

Auditing Clause 9.3

To gather objective evidence against clause 9.3, a lead auditor typically requests:

• The management review schedule or calendar, and attendance records confirming top management participated
• Minutes or a review pack mapped against each of the required 9.3.2 inputs, checking for gaps rather than merely confirming a meeting occurred
• Evidence that actions from the previous review were followed up and their status reported at the current review, closing the 9.3.2(a) loop
• Traceability from review outputs to actual changes: a resourcing decision that led to a hire, a QMS change that led to a revised procedure, an improvement opportunity that fed into a project

A Realistic Nonconformity Scenario

A mid-sized manufacturer holds a documented, well-attended annual management review. The minutes cover customer complaints, audit results, and quality objective performance in detail, but make no reference to supplier performance data, despite the organization having recorded two late deliveries and one quality escape from a key supplier earlier in the year. This is a textbook nonconformity against 9.3.2: the input existed in the organization's own records, so the data was available, but it was never brought into the review. The correction is straightforward -- add supplier performance to the next review agenda -- but the corrective action, per clause 10.2, requires the organization to ask why the input was omitted from the review template in the first place, so the gap does not recur at the next cycle.

Management review is also distinct from simply circulating a report for top management to read. The clause implies active review: attendance, discussion, and decision-making by the people who hold the authority to allocate resources and change the QMS. An organization that emails a summary document to the managing director, who never responds or meets to discuss it, has not conducted a review in the sense clause 9.3.1 intends, even if a record of the email exists somewhere in the files. Auditors should look for evidence of genuine participation -- an attendee list, discussion notes, questions raised, decisions recorded against a name -- rather than accepting a passively distributed document as proof the review took place.