Auditing Management Reviews Under ISO 22000 Clause 9.3

Management Review Requirements and System Rationale

Under ISO 22000:2018 Clause 9.3.1, top management must review the organization’s food safety management system (FSMS), at planned intervals, to ensure its continuing suitability, adequacy, and effectiveness. Suitability evaluates alignment with strategic direction, adequacy assesses resource provision, and effectiveness confirms achieved results.

This requirement applies to top management across all food chain organizations. Under Clause 3.41, top management represents the person or group directing the organization at the highest level, holding authority to allocate resources and delegate responsibilities.

The rationale behind Clause 9.3 is that operational food safety controls require executive oversight and strategic governance. Management review bridges shop-floor data and executive management. By evaluating performance trends, context changes, and incidents, top management ensures the FSMS adapts to evolving risks.

Management Review Inputs and Data Presentation

Clause 9.3.2 specifies mandatory inputs that top management must evaluate during review. The review must consider action status from previous reviews, changes in external and internal issues under Clause 4.1, and performance information. Performance information includes system updating trends under Clause 4.4 and Clause 10.3, monitoring results, and Clause 8.8.2 verification analysis.

Input evaluations must encompass nonconformities and corrective actions under Clause 8.9.3 and Clause 10.1, audit results under Clause 9.2, customer and regulatory inspections, and external provider performance under Clause 7.1.6. Top management must also review risk assessments under Clause 6.1, progress toward Clause 6.2 objectives, resource adequacy under Clause 7.1, emergency situations under Clause 8.4.2, recalls under Clause 8.9.5, communication under Clause 7.4, and improvement opportunities.

Crucially, Clause 9.3.2 mandates presenting input data so top management can relate information directly to stated food safety objectives. Aggregating raw data into performance summaries highlights systemic trends.

Quality managers and food safety leads must implement structured procedures to manage the review process. Following a five-step procedure ensures operational compliance across all Clause 9.3 inputs:

• Gather operational data, audit results, verification analyses, inspection reports, customer complaints, and recall records.
• Synthesize gathered data into performance reports correlating findings with measurable Clause 6.2 food safety objectives.
• Schedule and convene the review meeting with top management, ensuring attendance by executive decision-makers.
• Review all Clause 9.3.2 input categories systematically, evaluating whether current resources support FSMS effectiveness.
• Record executive decisions and action items in documented minutes, assigning responsibilities, timelines, and resource allocations under Clause 9.3.3.

Example

A dairy facility conducts its annual management review under Clause 9.3. The food safety team leader presents a dashboard comparing environmental monitoring trends, customer complaint rates, and CCP critical limit deviation logs against the objective of zero pathogen detections.

During the meeting, top management reviews a recurring trend of condensation build-up in the chilling hall identified through Clause 8.8.2 verification analysis. Recognizing that this environmental issue poses a potential microbiological risk, top management approves a capital expenditure to upgrade air handling units under Clause 9.3.3. The decision, budget allocation, completion target, and updated food safety objective are recorded as documented information.

Management Review Outputs and Executive Decisions

Under Clause 9.3.3, outputs of the management review must drive tangible organizational action and system enhancement. Management review outputs must include decisions and actions related to continual improvement opportunities and any need for updates and changes to the FSMS.

Required changes encompass resource allocations, revisions to the food safety policy under Clause 5.2, and updated FSMS objectives under Clause 6.2. Management review outputs feed directly into Clause 10.2 continual improvement and Clause 10.3 system updating.

System updating requires the food safety team to evaluate whether to review the hazard analysis under Clause 8.5.2, the hazard control plan under Clause 8.5.4, or PRPs under Clause 8.2 based on management review results. The organization must retain documented information as evidence of management review results under Clause 9.3.3.

Auditor Inspection Criteria and Evidence Matrix

Certification body auditors assessing Clause 9.3 evaluate whether management review serves as an active governance mechanism. They verify top management participation, input completeness, data synthesis, and output implementation.

Before your audit

• Confirm top management actively participated in the most recent management review meeting and signed off on results.
• Verify all inputs specified in Clause 9.3.2 were covered during review, including trend analysis of verification results under Clause 8.8.2.
• Ensure operational performance data was explicitly presented in relation to documented food safety objectives under Clause 6.2.
• Check documented outputs include clear decisions regarding resource allocation, FSMS updates, and continual improvement opportunities.
• Review action items from previous management reviews to demonstrate that assigned tasks were completed or properly tracked.
• Confirm changes to organizational context under Clause 4.1 or interested party requirements under Clause 4.2 were evaluated.
• Verify emergency incidents, mock recalls, and customer complaint trends were reviewed and incorporated into decision-making.

Questions people ask

How frequently must top management conduct management reviews under ISO 22000?

ISO 22000 Clause 9.3.1 requires top management to review the FSMS at planned intervals, but does not prescribe a fixed calendar frequency. Many organizations conduct formal reviews annually, while fast-changing operations or high-risk facilities may conduct quarterly reviews or hold modular reviews.

Can management review be conducted in separate modular meetings throughout the year?

Management reviews may be conducted through a series of planned modular meetings, provided all mandatory inputs under Clause 9.3.2 are evaluated and aggregated outputs under Clause 9.3.3 are documented. Top management must maintain oversight across all modules and relate data to stated FSMS objectives.

What is the difference between management review under Clause 9.3 and system updating under Clause 10.3?

Management review under Clause 9.3 is an executive oversight process where top management evaluates overall FSMS suitability, adequacy, effectiveness, and resource needs. System updating under Clause 10.3 is an operational process executed by the food safety team at planned intervals to re-evaluate hazard analyses, PRPs, and hazard control plans based on management review outputs.

What evidence do certification body auditors expect to demonstrate top management commitment in Clause 9.3?

Auditors look for documented management review outputs showing executive attendance, critical evaluation of performance trends, decisions allocating resources, and formal updates to food safety policies or objectives. Superficial minutes lacking decision details or resource commitments indicate weak leadership engagement.

Reference documents

• DS/EN ISO 22000:2018, Food safety management systems — Requirements for any organization in the food chain
• DS/ISO 22003-1:2022, Food safety — Part 1: Requirements for bodies providing audit and certification of food safety management systems
• DS/ISO 22003-2:2022, Food safety — Part 2: Requirements for bodies providing evaluation and certification of products, processes and services, including an audit of the food safety system