Management review

Current external reference: ISO/IEC 27001:2022

This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.

Top management must review the organization's ISMS at planned intervals to make sure it remains suitable, adequate and effective. Management review has to take into account: the status of actions from earlier reviews; changes in internal and external issues relevant to the ISMS; changes in what relevant interested parties need and expect; feedback on how information security is performing, including trends in nonconformities and corrective actions, in monitoring and measurement results, in audit results and in how far objectives are being met; feedback received from interested parties; what the risk assessment found and how far the risk treatment plan has progressed; and where continual improvement is possible. The outputs of management review must include decisions on opportunities for continual improvement and on any need to change the ISMS, and documented information must be available as evidence of the review results.

How the 2020 guidance taught the audit

Auditors confirm that top management carries out management reviews to the planned schedule, reviews the information they should cover and achieves the expected outputs. They assess whether top management personally takes part, using the review to set changes to the ISMS and priorities for continual improvement, particularly where the organization's context is changing, results deviate from those planned, or favourable conditions offer an advantage. They check that the review considered every input listed as audit evidence: the status of actions from earlier reviews, changes in external and internal issues, feedback on information security performance (nonconformity and corrective action trends, monitoring and measurement results, audit results, achievement of objectives), interested party feedback, risk assessment results and the status of the treatment plan, and opportunities for improvement; and that its outputs include decisions on improvement opportunities and on any needed changes to the ISMS.

The DIS layer: the 2022 alignment

The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.

The 2022 clause keeps the inputs and outputs and adds the status of actions from previous reviews, changes in external and internal issues, information security performance, risk assessment results, the status of the risk treatment plan and opportunities for continual improvement.

Evidence an auditor asks for

• Management reviewManagement review schedule and minutes with attendance
• Management reviewInput pack covering each required input
• Management reviewRecorded decisions on improvement opportunities and ISMS changes
• Management reviewAction tracking from review outputs

The questions an auditor will ask

Ask for the last review and check each 2022 input against the minutes. A review with no risk treatment status is the common gap.

Common gaps

• Review delegated below top management
• Inputs such as interested party feedback or risk treatment status omitted
• Minutes record discussion but no decisions
• Reviews skipped despite a planned schedule

Prepare before the next audit

Rebuild the management review agenda from the 2022 clause and test one input against its source.

Cross-references