5Evaluate

ISO 27001Management Review

ISO 42001Management Review

Management Review

Purpose

A recorded review of the management system by top management: inputs, decisions and resulting actions.

Role

ISO/IEC 27001 and 42001 Clause 9.3 require top management to review the management system at planned intervals. Together with CAPA, this is the largest management-system structural hole against Ten Factor. Audit logs review programme conformance; they are not a management-review minute.

This page is a stub: fields, examples and schema are still to be specified.

Links upstream

• Management Objective
• Risk Assessment
• Impact Assessment
• Audit Programme
• Audit Log
• Communication Requirement
• Applicability Profile

Links downstream

• Corrective Action
• Organisation Context

Related factors

• Evidence by Default
• Continuous Governance
• Governance Has Owners

References

• ISO/IEC 27001 Analysis — Clause 9.3
• ISO/IEC 42001 Analysis — Clause 9.3
• ISO/IEC 27001 Guidance Catalog (iso27001-9.3)