Management review: turning data into decisions

A management review should help management derive sound decisions from observations. If the meeting merely reads out figures, this purpose is not met. What helps is a clear link between starting situation, assessment, decision and later feedback on the effect. This guide describes an editorial practical aid for Swiss SMEs. The preparation and structure suggested are not a complete reproduction of ISO requirements and set no binding meeting rhythm.

What the standard requires

The management review is a requirement of ISO 9001; this guide deals with no legal obligations. Whether the standard is relevant for you follows, for example, from a planned certification or from customer requirements. The 6th edition, ISO 9001:2026, has applied since 16 September 2026 and replaces the 2015 edition. Certified companies switch within the transition period set by their certification body.

In substance, the standard requires top management to review the quality management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness. According to the Auditing Practices Group of ISO and IAF (paper of 13 January 2016) this need not take place in a meeting of its own. It is also possible to review a report or to build the review into regular management meetings in which, for example, budgets and objectives are discussed.

In the 2015 edition, clause 9.3.2 governed the inputs: in substance the status of earlier decisions, changes in the environment, information on the performance of the system such as customer feedback, achievement of objectives, audit results and the performance of external providers, the adequacy of resources, the effectiveness of actions on risks and opportunities, and opportunities for improvement. According to the Auditing Practices Group, the inputs named are not the only permissible topics. As outputs (clause 9.3.3 of the 2015 edition), the Auditing Practices Group says there should be evidence of decisions, for example on policy and objectives, improvements, resources, business plans and budgets. Documented information on the review is required; the format is not specified, and minutes are usual.

This guide does not reproduce the text of the standard. The clause numbers 9.3, 9.3.2 and 9.3.3 come from the 2015 edition and have not been checked against the text of the 2026 edition; check numbers and requirements for certification in the original 2026 edition. The list of inputs above reflects the 2015 edition and may be incomplete for the 2026 edition; do not use it as your only checklist.

Defining purpose and period under review

First clarify which decisions are pending. Is it about the development of service quality, recurring delivery problems or the competences available? A clear question helps to focus preparation on relevant information. Individual operational cases can serve as evidence but should not determine the whole meeting.

Determine the period under review and the data reference date. A look back at a completed quarter is different from a current snapshot. If metrics use different periods, that must remain visible. Otherwise apparent correlations arise that stem only from offset data bases. An annual rhythm is common, but it is practice and not normative: the standard speaks of planned intervals.

Choose participants according to the need for decisions. Management needs enough professional information to place the results in context, and the authority to change resources or priorities. Purely administrative minute-taking cannot take over this role. Also name who supplies missing information.

As business preparation you can formulate a short decision question for each topic: “What safeguard do we need for this supplier?” or “Which task must be redistributed?” This lets participants see before the meeting what assessment is expected of them.

Preparing data with their limits

For every metric, provide the source, period, delimitation and known gaps. A complaint figure, for example, needs a definition of what is counted as a case. A changed reporting route can affect the number of cases even though the performance itself has not changed.

Compare the same basis wherever possible. A month with many orders cannot easily be compared with a quiet month on the absolute number of complaints. A ratio can help but needs a suitable reference quantity. Explain whether you count orders, deliveries or individual items.

Missing data receive a visible note. An empty assessment is not a good result. If qualification evidence is maintained incompletely, a rate describes the documented state at first. It demonstrates neither missing abilities of all the people concerned nor the full readiness of the rest of the team.

Include earlier decisions in the preparation. Check separately whether they were implemented and whether their intended effects were observed. This turns the meeting into a continuing decision process. Otherwise new tasks pile up each time while old commitments drop out of sight.

Resources also include money and time. Whether liquidity is sufficient for planned projects is shown by ongoing cash flow planning; whether the team permanently works above capacity is shown, among other things, by overtime, whose rules are explained in the guide to overtime and excess hours.

The assessment by management

For each essential topic, management should record how it classifies the situation and what that classification rests on. An assessment can declare a development sufficient, ask for further clarification or decide on a change. A decision to change nothing for now also needs a traceable reason.

Separate observation, explanation and decision. “The complaint rate has risen” is an observation. “The new packaging may be involved” is initially a hypothesis. “We will examine affected and unaffected deliveries” is a decision. This separation prevents a conjecture from appearing in the minutes as an established cause.

Consider interactions. Higher utilisation can affect delivery times, training schedules and control performance at the same time. The solution may then be a priority decision rather than an additional individual task for each problem. Name conflicting objectives explicitly so that implementation does not fail on contradictory expectations.

Also record what professional examination is still needed before a final decision. Management need not resolve every uncertainty in the meeting. It must, however, determine responsibility, expected result and the route to the later decision.

Practical example: Muster Technik AG

Muster Technik AG is a fictitious company. It looks at two equally delimited periods, each with one hundred completed service orders.

Management recognises that the absolute number of cases is small and allows no conclusive cause to be identified. In four of the six current cases, the file lacks clear handover information. Whether this gap caused the complaint is not yet proven. Management decides on a targeted investigation of the handover.

It also looks at internal qualification evidence. For eight required deputies, six current pieces of evidence are documented. Six divided by eight gives seventy-five per cent. The company expressly calls this documented coverage. The two missing pieces of evidence are clarified individually before a training need or a deployment decision is derived from them.

Management decides to examine the handover process and to clarify the two evidence gaps. Both decisions receive responsible persons and business deadlines. For the handover, an observation of comparable orders is agreed; for the evidence, a professional review of existing records and, where appropriate, a practical check.

At the next review, what actually happened is reported first. An adjusted form counts as implementation. Whether the handover became more complete and understandable is judged from the orders observed. Management declares the decision sufficiently effective only afterwards, or decides on further steps.

Formulating decisions that can be carried out

A good decision names action, responsibility, target date and expected evidence. “Improve quality” is too general. “The service manager checks the handover information against an agreed selection of completed orders and presents a reasoned proposal” is workable.

Check the available resources before setting deadlines. If the same person is given several urgent tasks, management must decide the order. The minutes should make this decision visible. A long task list without priority merely passes unresolved conflicting objectives on to those carrying out the work.

For overdue decisions, ask for the reason. A missing piece of information calls for a different response from an investment that has not been approved. New deadlines should not replace the old ones without comment. Record what led to the change and whether temporary protection is needed.

For improvements with root cause analysis, a structured process for corrective actions can help; for competence-related decisions, a qualification matrix. Both instruments serve implementation; the management decision remains justified within the context of the review.

Handling confidential information

A management review can contain personal complaint details, training status or internal assessments. Under Art. 6 DSG, paras. 2 and 3, the processing of personal data must be proportionate and bound to a specific, recognisable purpose. Use summarised information, therefore, where individual names are not needed for the decision.

Art. 8 DSG, para. 1 requires data security appropriate to the risk. Review the circle of recipients of minutes, presentation and annexes together. A cautiously worded main text helps little if a widely distributed annex contains every detail of the cases. Personal data no longer needed are destroyed or anonymised under Art. 6 DSG, para. 4.

These legal bases say nothing about which complete inputs a particular ISO edition requires for the management review. For certification you must check the requirements actually in force separately. The practice described here can structure preparation, but cannot replace this comparison.

Checklist

• Decision questions and period are clarified in advance.
• Metrics state source, delimitation and gaps.
• Snapshot and later changes remain distinguishable.
• Management assesses instead of merely confirming figures.
• Earlier decisions are checked for implementation and effect.
• New decisions have responsibility, deadline and evidence.
• Priorities match the resources available.
• Minutes and annexes have an appropriate circle of recipients.
• The documentation of the review is retained as evidence.

Sources

• ISO/IAF Auditing Practices Group, Guidance on Policy, Objectives and Management Review, document of 13 January 2016, accessed on 27.10.2026. The paper refers to ISO 9001:2015, reflects the view of the working group and is not endorsed by ISO as a standard.
• ISO: ISO 9001:2026 (Edition 6), published on 16 September 2026; accessed on 27.10.2026. The text of the standard is protected by copyright and is not reproduced here.
• SNV: SN EN ISO 9001:2026, valid since 16 September 2026, replaces the 2015 edition (in German); accessed on 27.10.2026. The clause references (9.3.1 to 9.3.3) come from the 2015 edition and have not been checked against the 2026 text.
• Federal Act on Data Protection (DSG, SR 235.1), Art. 6, paras. 2 to 4, Art. 8, para. 1, as at 7 July 2025: fedlex.admin.ch (German original), accessed on 27.10.2026.

The organisational procedures and examples are editorial practical aids. They do not demonstrate conformity for certification.

This guide does not replace legal or tax advice. Information as at 27 October 2026.