Management review process flowchart (ISO 9001 clause 9.3)

What the management review process flowchart (iso 9001 clause 9.3) process is

A management review is top management sitting down with the evidence and deciding what to do about it. The trigger is a date rather than an event: the review falls due at the interval the organisation set for itself, and it has to happen whether or not anything dramatic has occurred since the last one. The chart below follows one cycle end to end. The date is booked and the agenda set, a quorum of top management is confirmed, and the input pack is requested and assembled from process performance against objectives, customer feedback and complaints, audit results, corrective action status and risk. The pack is gated for completeness and circulated as a pre-read, the meeting works through it, and the two questions the review exists to answer get asked: is the system still suitable and effective, and does anything in the trends need formal corrective action rather than another review action. Improvements, changes and resource needs are decided, actions get owners and dates, the minutes are approved, and the actions are tracked through to the next review.

This is the governance meeting, not the work that feeds it. Internal audits are planned, conducted and reported on their own cycle, and this chart takes only their results as an input. The same is true of corrective actions, which are investigated, implemented and verified in the corrective action process and appear here as status and as a destination for a trend the review judges systemic. Policy and document revisions belong to the policy review cycle, which has its own trigger, consultation and approval tiers. The boundary matters because a review that starts re-running audits or debugging individual nonconformities stops being a review: the agenda inflates, the meeting overruns, and the decisions the standard actually asks for never get taken. Treat this chart as a starting point to adapt under your own quality procedures, the standard you are certified to and competent review. It cannot make an organisation compliant or certified, and clause numbering should be checked against the edition of the standard in force for you.

Four decisions carry the process, and where they sit says as much as what they ask. "Quorum of top management available?" is in the top management lane at the very start, because the requirement is written as an obligation on top management and a review held without them is a nonconformity dressed as a meeting. "Input pack complete?" sits with the secretary and deliberately before the pre-read goes out, so an incomplete pack delays a document rather than wasting an hour of directors' time. "QMS still suitable and effective?" belongs to top management alone; nobody else is being asked. And "Resource within the delegated budget?" is drawn in the finance lane on purpose. A resource need agreed in a room with no budget authority is the most common way a management review action dies quietly between one cycle and the next, and giving the escalation its own lane makes the route visible before it is needed.

What this flowchart covers

In this template

• Five swimlanes (Quality manager / secretary, Process owners, Top management, Action owners and Finance / budget holder) across six phases: schedule and scope, gather inputs, pre-read and readiness, review meeting, decisions and resources, and minutes and follow-through
• A quorum test before anything else: "Quorum of top management available?" sends a review that cannot be held back to "Book the date and set the agenda", or, when the interval itself has run out, to "Missed review logged as a nonconformity"
• An input pack assembled in two lanes and then gated: process owners "Compile process performance against objectives" and "Summarise customer feedback and complaints", the secretary adds "Report audit, CAPA and risk status", and "Input pack complete?" holds the pre-read until the gaps are closed
• The two decisions the meeting exists to take: "QMS still suitable and effective?" routes a gap to "Agree the changes the QMS needs", and "Trend needs a formal CAPA?" pushes anything needing root cause work out to "Raise it into the corrective action process"
• Decisions with a route rather than a wish: "Decide improvements and resource needs" is followed by "Resource within the delegated budget?", which escalates to "Put the resource case to the board" before every action gets an owner, a date and an explicit acceptance
• A close-out that keeps the cycle turning: "Draft the minutes and the action list", a "Chair approves the minutes?" amend loop, "Work the actions to the agreed due date", and "Actions on track before the next review?", whose slipping branch carries the overdue action onto the next agenda

When to use this template

• You are writing or rebuilding the management review procedure for ISO 9001, ISO 14001, ISO 45001, ISO 27001 or a comparable management system
• Your review has drifted into a quality department presentation, and you need top management's attendance, questions and decisions built into the route rather than hoped for
• The meeting happens, the discussion is good, and three months later nobody can say what was decided, who owned it or whether it was ever done
• A certification or surveillance audit is coming and you need to show which inputs were considered, what was decided and what record was retained for each review
• Reviews keep agreeing that something needs more people, tooling or budget, and those decisions die between the meeting and the next planning round

How it works

1. Rename the lanes to your roles

   Replace Quality manager / secretary, Process owners, Top management, Action owners and Finance / budget holder with the roles you actually have. Keep the secretary separate from top management even when one person wears both hats: one runs the cycle and holds the record, the other is the body being asked to decide. If nobody in the room holds budget, the finance lane is the most important one on the chart rather than the least.

2. Set the interval and write down the quorum

   Decide how often the review runs and record it, because the standard asks you to review at planned intervals rather than at a frequency it names, and you are then audited against your own decision. Then write down what quorum means: which roles must attend, who may deputise, and what happens when the date cannot be met. Without that second half, a diary clash quietly becomes a missed interval.

3. Fix the input list and name an owner for each line

   Turn the agenda into a numbered input list with a name against every line: status of previous actions, changes in internal and external issues, performance against objectives, customer feedback and complaints, nonconformities and corrective actions, monitoring and audit results, external provider performance, resource adequacy and the effectiveness of risk actions. An input with no owner is the one that arrives on the morning.

4. Define what suitable, adequate and effective mean

   The suitability decision is inert until you say what would answer it. Write the test for your organisation: which objectives and measures are looked at, over what period, and what a fail looks like. Suitability is fit for the business as it is now, adequacy is whether it is resourced, and effectiveness is whether it produces the results it was built to produce. A slide of green dashboards answers none of the three.

5. Set the escalation route for resource decisions

   Put your real delegated authority limits on the budget decision, and name the body a larger case goes to and when it next meets. Then settle the thing most procedures leave out: what the action does while the funding is being sought. An action parked pending budget, with no revised date and no interim mitigation, is the one that reappears unchanged at the next four reviews.

6. Say what the record must contain and where it lives

   The retained evidence is the result of the review, not a transcript of it. Decide what the minutes must carry: the inputs considered, the decisions on improvement, on changes to the system and on resources, each action with a named owner and a due date, and who approved them. Name the storage location and the retention period. Minutes that record attendance and discussion but no decisions are the classic finding here.

7. Walk it against your last two reviews

   Take the packs, minutes and action lists from the last two reviews and trace them through the chart. Look for inputs that were never supplied, decisions with no owner, actions closed with no evidence, and resource needs that were agreed and never funded. Anything people describe that is not drawn, or drawn but skipped in practice, is the change worth making before you publish it.

Frequently asked questions

What are the steps in a management review process?

The review falls due at the planned interval and the agenda is set against the required input list. A quorum of top management is confirmed; if it cannot be met the review is rescheduled, and if the interval runs out the miss is logged as a nonconformity. Process owners compile performance against objectives and summarise customer feedback and complaints, the secretary reports audit, CAPA and risk status, gaps are chased, and the pre-read goes out. The meeting walks the inputs and answers two questions: whether the system is still suitable and effective, and whether any trend needs formal corrective action. Improvements, changes and resource needs are decided, a resource beyond the delegated budget goes to the board, and each action gets an owner and an accepted due date. The minutes are approved by the chair, the actions worked, and anything slipping is carried onto the next agenda.

What are the required inputs and outputs of a management review?

ISO 9001:2015 sets both out. Clause 9.3.2 lists the inputs: the status of actions from previous reviews; changes in external and internal issues relevant to the QMS; information on the performance and effectiveness of the system, including trends in customer satisfaction and feedback from interested parties, the extent to which quality objectives have been met, process performance and the conformity of products and services, nonconformities and corrective actions, monitoring and measurement results, audit results and the performance of external providers; the adequacy of resources; the effectiveness of actions taken on risks and opportunities; and opportunities for improvement. Clause 9.3.3 requires the outputs to include decisions and actions on opportunities for improvement, on any need for changes to the system, and on resource needs, with documented information retained as evidence.

How often should a management review be held?

The standard requires reviews at planned intervals and does not name a frequency: you set the interval, record it, and are then audited against your own decision. Annual is the common default and is usually defensible for a stable organisation, but it is a weak choice for one with multiple sites, an active corrective action backlog or fast-moving regulatory exposure, where quarterly or half-yearly serves better. Two practical points. A rolling model is legitimate: some organisations take a subset of the inputs each quarter and cover the full set across the year, provided the plan says so and the records show it. And whatever interval you set, treat a missed one as a real nonconformity rather than a diary problem, because that is how a certification auditor will read it.

Who has to attend a management review?

Top management, because the requirement is written as an obligation on them: they review the system to confirm it is still suitable, adequate, effective and aligned with the strategic direction of the organisation. That is what makes the quorum decision the first one on this chart. In practice the room holds the managing director or chief executive, the heads of the functions that own the processes under review, and the quality manager, who convenes the meeting and takes the minutes rather than chairing it. Process owners attend to present their own inputs and should not be represented by a summary somebody else wrote. Decide in advance who may deputise and what happens to a decision that needs someone absent, and record attendance, because an auditor sampling the record looks at who was there before looking at what was decided.

How is a management review different from an internal audit?

They answer different questions on different cycles. An internal audit tests conformity: an independent auditor samples records against a stated requirement, raises nonconformities and observations, and reports them. A management review tests direction: top management looks across audit results, customer feedback, objectives, risks and resources, and decides what to change, improve and fund. Audit results are one input to the review, which is why this chart takes them as status rather than re-running them. Corrective action is a third thing again: it investigates a specific nonconformity to root cause, implements a fix and verifies it worked, and it is where the "Trend needs a formal CAPA?" branch hands work out. Confusing the three produces a familiar failure, where the review spends an hour arguing about one audit finding and never reaches the resource decision.