7.2 Clause 9.3: Management Review Inputs, Outputs & Governance

7.2 Clause 9.3: Management Review Inputs, Outputs & Governance

Lead Auditor Core Concept: Management review under Clause 9.3 is the ultimate governance checkpoint of an ISO 45001 management system. It is neither an administrative status briefing nor an informal departmental presentation; it is an active executive evaluation where top management interrogates whether the OH&S management system remains aligned with corporate strategy and capable of protecting workers. A Lead Auditor must look past polished PowerPoint slides to verify genuine leadership interrogation, evidence-based evaluation of suitability, adequacy, and effectiveness, and substantive resource decisions.

---

1. The Governance Mandate of Clause 9.3

ISO 45001:2018 Clause 9.3 mandates that top management shall review the organization's OH&S management system at planned intervals. Under the Annex SL Harmonized Structure and Clause 5.1 (Leadership and commitment), executive leadership cannot delegate ultimate accountability for this review to a safety coordinator or external consultant. Top management must personally direct the review process.

Determining "Planned Intervals"

The standard does not mandate an arbitrary annual frequency. Instead, it requires reviews at planned intervals. Depending on the complexity of hazards, organizational volatility, and rate of change, an organization may fulfill this requirement through:

• An annual comprehensive executive summit reviewing all mandatory inputs and outputs;
• Quarterly executive management reviews evaluating rolling subsets of performance data;
• Monthly operational steering meetings integrated into standard board or executive committee governance.

Regardless of cadence, a Lead Auditor must verify that within a complete audit cycle, every mandatory input under Clause 9.3(a–g) has been thoroughly evaluated, and every mandatory output category has generated documented decisions.

---

2. The Core Evaluation Triad: Suitability, Adequacy, and Effectiveness

The fundamental purpose of the management review is to ensure the continuing:

1. Suitability: Does the OH&S management system fit the organization's context, operational profile, culture, and strategic direction? If an enterprise shifts from manual warehousing to high-speed automated robotic distribution, an OH&S system built around manual handling hazards is no longer suitable.
2. Adequacy: Is the management system sufficiently resourced, staffed, funded, and equipped? An organization may have suitable procedures, but if the EHS department lacks the budget to service gas detection monitors, replace ventilation filters, or train new recruits, the system lacks adequacy.
3. Effectiveness: Is the management system achieving its intended outcomes? Under Clause 1, the intended outcomes are: preventing work-related injury and ill health, fulfilling compliance obligations, and achieving OH&S objectives. If injury rates are escalating or regulatory citations are recurring, the management system is ineffective, regardless of how well-documented it appears.

---

3. Comprehensive Breakdown of Mandatory Review Inputs (Clause 9.3 a–g)

Clause 9.3 explicitly prescribes the minimum data inputs that top management must review. Lead auditors treat this list as an auditable inventory:

                    MANDATORY MANAGEMENT REVIEW INPUTS (CLAUSE 9.3)
┌─────────────────────────────────────────────────────────────────────────────┐
│ 9.3(a) Status of actions from previous management reviews                   │
├─────────────────────────────────────────────────────────────────────────────┤
│ 9.3(b) Changes in external/internal issues, interested parties,             │
│        legal requirements, and risks and opportunities                      │
├─────────────────────────────────────────────────────────────────────────────┤
│ 9.3(c) Extent to which OH&S policy and OH&S objectives have been achieved   │
├─────────────────────────────────────────────────────────────────────────────┤
│ 9.3(d) Performance information and trends:                                  │
│        • Incidents, nonconformities, corrective actions & improvement       │
│        • Monitoring and measurement results                                 │
│        • Legal and regulatory compliance evaluation results                 │
│        • Internal and external audit results                                │
│        • Consultation and participation of workers                          │
│        • Risks and opportunities status                                     │
├─────────────────────────────────────────────────────────────────────────────┤
│ 9.3(e) Adequacy of resources for maintaining an effective OH&S system       │
├─────────────────────────────────────────────────────────────────────────────┤
│ 9.3(f) Relevant communication(s) with interested parties (regulators/public)│
├─────────────────────────────────────────────────────────────────────────────┤
│ 9.3(g) Opportunities for continual improvement                             │
└─────────────────────────────────────────────────────────────────────────────┘

Critical Audit Scrutiny on Inputs

Auditors must pay special attention to three commonly neglected inputs:

• Results of Evaluation of Compliance (9.3d.3): Top management must review the concrete outcomes of compliance audits conducted under Clause 9.1.2, including any detected statutory violations.
• Worker Consultation & Participation (9.3d.5): Feedback, complaints, and safety committee resolutions submitted by non-managerial workers under Clause 5.4 must be presented directly to leadership.
• Status of Prior Actions (9.3a): Leadership cannot treat management review as an isolated event. Every decision made in the prior review must be accounted for and tracked to closure.

---

4. Mandatory Review Outputs: Decisions and Strategic Alignment

Reviewing data is meaningless without decision-making. Clause 9.3 dictates that the outputs of the management review must include decisions related to:

• Continuing Suitability, Adequacy, and Effectiveness: A formal, documented determination by top management assessing the system's operational viability;
• Continual Improvement Opportunities: Approving strategic safety initiatives, technology investments, or culture change programs;
• Need for Changes to the OH&S Management System: Restructuring responsibilities, updating policies, or modifying operational control procedures;
• Resources Needed: Allocating financial capital, authorizing safety personnel hiring, or investing in engineered safeguards;
• Actions Needed: Assigning specific operational corrective measures with designated owners and target completion dates;
• Integration with Other Business Processes: Merging OH&S criteria into procurement, capital expenditure approvals, product design, and performance appraisals;
• Implications for Strategic Direction: Adjusting corporate strategic plans to accommodate emerging health and safety challenges or regulatory shifts.

---

5. Documented Information Retention and Worker Communication

Clause 9.3 establishes two mandatory concluding requirements:

1. Documented Information Retention: The organization must retain documented information as evidence of the results of management reviews (e.g., formal signed minutes, decision matrices, approved capital expenditure requests, and action item logs).
2. Communication to Workers: Top management must communicate relevant management review outputs to workers and, where they exist, workers' representatives. Decisions affecting operational procedures, staffing levels, or hazard controls cannot be withheld from the shop floor.

---

6. Comparative Analysis: The Three Pillars of Management Review Evaluation

---

7. Real-World Audit Scenario: The 15-Minute 'Rubber-Stamp' Management Review

Audit Context: During a Stage 2 certification audit of a chemical logistics terminal, the Lead Auditor evaluates documented information for Clause 9.3 (Management review).

Audit Investigation:

1. Top management provides a copy of the annual management review meeting minutes. The records indicate the meeting lasted 20 minutes and was attended by the Managing Director, Financial Controller, and EHS Manager.
2. The meeting minutes contain a single summary sentence: "The EHS Manager presented the annual safety slide deck; all items were accepted as presented, and the system is declared effective."
3. Further examination of audit records reveals that in the preceding eight months, the terminal had received two formal enforcement notices from the national environmental and safety agency for uncontained solvent leaks. Neither of these legal enforcement actions was mentioned in the management review agenda or minutes.
4. Furthermore, the Joint Worker Safety Committee had submitted three formal recommendations requesting local exhaust ventilation upgrades in the drum decanting bay. The minutes show no record that these worker proposals were reviewed, nor was any budget allocated.
5. When questioned, the Managing Director stated: "Our EHS Manager has full authority over safety details. I rely on him to handle the inputs; my job is to endorse his summary."

Lead Auditor Evaluation: The Lead Auditor issues a Major Nonconformity citing ISO 45001:2018 Clause 9.3. Top management failed to actively review mandatory inputs—specifically legal compliance evaluations under Clause 9.3(d)(3) and worker consultation results under Clause 9.3(d)(5)—and failed to generate substantive decisions regarding adequacy, resources, or necessary system changes. A superficial rubber-stamp meeting does not satisfy the governance mandate of Clause 9.3.

---

8. Common Exam Traps and Candidate Errors

• Trap 1: Treating Management Review as a Departmental Briefing Rather than an Executive Decision-Making Forum. Management review is an active governance process, not a lecture where an EHS manager reads slides to passive executives. An audit finding will be issued if outputs lack concrete leadership decisions, resource commitments, and strategic actions.
• Trap 2: Omitting the Communication of Review Outputs to Workers. Candidates often master the inputs and outputs but forget the final paragraph of Clause 9.3. Top management is normatively required to communicate relevant outputs to workers and worker representatives. Failing to share review results is a direct nonconformity.
• Trap 3: Conflating Adequacy with Effectiveness. Candidates frequently confuse adequacy (having sufficient resources, staffing, and tools) with effectiveness (achieving desired outcomes such as zero injuries and legal compliance). A system can be fully funded (adequate) yet completely ineffective due to poor execution or broken culture.