9.3.3 — Management review results
A review that produces no decisions is not a review — it is a status meeting. This sub-clause requires an actual output.
In plain language
In plain language: 9.3.3 requires the management review to end with something concrete: documented decisions about opportunities for continual improvement and about any changes the ISMS needs, kept as evidence that the review was more than a conversation.
Position in the standard
Why this requirement exists
A discussion that produces no decision changes nothing. This sub-clause exists to force management review from a passive status update into an active governance act — leadership does not just hear about problems, it decides what happens next, and that decision is written down so it can be tracked and, at the next review, checked against 9.3.2\u2019s "status of previous actions" input.
Scenario: a management review discusses that phishing test click rates have crept up for two quarters running, everyone agrees it is concerning, and the meeting moves on to the next topic with no decision recorded. Six months later, nothing has changed, because there was never an actual output — just an agreement that something was a problem.
What the standard expects
The standard expects the results of the management review to include decisions related to continual improvement opportunities and any needs for changes to the ISMS. Documented information must be available as evidence of the results of management reviews — not just that a meeting occurred, but what was decided.
In practice
- End every review with a written decisions log: what was decided, who owns it, and by when — not a summary of what was discussed.
- Route every decision that implies a change into the change planning process required by clause 6.3.
- Carry open decisions forward explicitly into the next review\u2019s 9.3.2 input rather than letting them quietly drop off the agenda.
Evidence the auditor will ask for
- A documented decisions log for each management review, with owners and deadlines.
- Evidence that prior decisions were followed up on and closed, or explicitly carried forward with a reason.
Common pitfalls
- Minutes that summarize discussion but record no actual decision.
- Decisions with no owner or deadline, which quietly never happen.
Related requirements
9.3.2 Management review inputs
What feeds into the decisions this sub-clause requires.
6.3 Planning of changes
Where decisions about ISMS changes get carried out in a planned way.
Clause 10 Improvement
Continual improvement decisions from management review connect directly to clause 10.
Parent link: 9.3 Management review
Frequently asked questions
What if a review concludes no changes are needed?
Turn every management review into a tracked decision, not just a meeting.
Sentrix keeps a running log of management review decisions and tracks them to closure across every cycle.