Auditing Management Review Inputs & Outputs in ISO 45001 Clause 9.3

What the Requirement Is, and Why It Exists

ISO 45001 establishes a mandatory governance requirement under Clause 9.3 for top management to review the organisation's occupational health and safety management system at planned intervals. This executive review process ensures the continuing suitability, adequacy, and effectiveness of the management system in achieving intended health and safety outcomes. Rather than treating management review as a passive administrative sign-off, ISO 45001 positions Clause 9.3 as the primary strategic engine driving system alignment, resource allocation, and continual improvement across the organisation.

This governance requirement directly impacts top management, compliance leads, facility managers, internal auditors, safety representatives, and non-managerial workers. Treating management review as a superficial checkbox exercise creates critical system vulnerabilities, leaving emergent risks unaddressed and resource shortfalls unresolved. ISO 45001 requires executive leaders to evaluate detailed operational performance trends, assess internal and external context shifts, and make binding decisions regarding system changes. Quality managers and internal auditors must establish structured management review processes that convert operational performance data into strategic executive action while maintaining audit-ready evidence.

Technical Nuances: Mandatory Inputs and Strategic Outputs

Understanding the technical nuances of Clause 9.3 requires examining the seven mandatory review input categories defined under Clauses 9.3 a) through 9.3 g) alongside mandatory review output decisions. Under Clause 9.3 a), top management must review the status of actions from previous management reviews. Under Clause 9.3 b), the review must address changes in external and internal issues, including interested party needs under Clause 4.2, legal requirements under Clause 6.1.3, and risks and opportunities under Clause 6.1.2.3. Under Clause 9.3 c), top management must evaluate the extent to which the health and safety policy and objectives under Clause 6.2 have been met.

Under Clause 9.3 d), the review must evaluate detailed health and safety performance trends across six specific areas. These include incident and nonconformity trends under Clause 10.2, monitoring and measurement results under Clause 9.1.1, legal compliance evaluation results under Clause 9.1.2, internal audit findings under Clause 9.2.2, worker consultation and participation results under Clause 5.4, and risk assessments. Furthermore, under Clauses 9.3 e) through 9.3 g), top management must evaluate resource adequacy, relevant stakeholder communications, and continual improvement opportunities.

Management review outputs must include formal executive decisions regarding seven strategic outcomes. Top management must record decisions on continuing system suitability, adequacy, and effectiveness, continual improvement opportunities under Clause 10.3, system modification needs, resource allocations, required operational actions, integration opportunities with core business processes, and implications for strategic direction. Top management must communicate relevant review outputs to workers and worker representatives in accordance with Clause 7.4, and the organisation must retain documented information as evidence of review results.

Example

A heavy machinery manufacturing plant prepares for its annual management review. Under Clause 9.3 d) 1), the compliance lead compiles performance trends showing increased near-miss incidents involving forklift operations. During the review meeting, top management evaluates the data alongside resource adequacy under Clause 9.3 e) and worker feedback under Clause 5.4, recording a Clause 9.3 output decision allocating twenty thousand pounds for automated vehicle sensors. During a subsequent internal audit, the auditor inspects meeting records, budget approvals, and worker briefing logs to confirm full compliance with Clause 9.3.

Audit Verification Procedure and Requirement Matrix

Auditing Clause 9.3 requires a structured, multi-step verification procedure that tests whether management review functions as an active governance process. Internal auditors must execute the following four-step procedure during internal audits to verify whether executive leaders drive continual system improvement.

1. Review management review schedules and documented procedure rules to confirm that executive reviews occur at planned intervals.
2. Inspect review input packs to verify that all mandatory inputs under Clauses 9.3 a) through 9.3 g) were compiled and submitted to top management.
3. Evaluate management review minutes and action logs to confirm that executive decisions cover all mandatory output categories.
4. Verify that relevant review outputs were communicated to workers under Clause 7.4 and cross-reference resource allocations with budget approvals.

Before your audit

• Verify that management reviews are conducted at planned intervals under Clause 9.3.
• Confirm that review input packages contain all mandatory data specified in Clauses 9.3 a) through 9.3 g).
• Check that management review minutes record explicit executive decisions on system suitability, adequacy, and effectiveness.
• Inspect evidence proving that top management allocated required resources for system improvement decisions.
• Verify that relevant management review outputs were communicated to workers and worker representatives under Clause 7.4.
• Confirm that documented information of management review results is systematically retained under Clause 9.3.
• Cross-reference management review action logs with Clause 6.2 objectives and Clause 10.2 corrective action registers.

Questions people ask

How often must top management conduct a management review under ISO 45001?

ISO 45001 does not dictate a fixed calendar frequency for management reviews. Under Clause 9.3, top management must review the management system at planned intervals determined by the organisation. Many organisations conduct comprehensive annual reviews supplemented by quarterly executive performance updates.

What documented information must be retained for ISO 45001 management reviews?

Under Clause 9.3, organisations must retain documented information as evidence of the results of management reviews. This includes detailed meeting minutes, input presentation packages, executive decision logs, resource allocation records, and action tracking registers.

Must management review outputs be communicated to non-managerial workers?

Under Clause 9.3, top management must communicate relevant outputs of management reviews to workers, and where they exist, worker representatives in accordance with Clause 7.4. Communicating review outputs ensures workers understand executive decisions and strategic safety directions.

Who must attend the management review meeting in ISO 45001?

Clause 9.3 explicitly requires top management to review the health and safety management system. Executive leaders who direct and control the organisation at the highest level must actively participate. While compliance leads and department heads present data, top management retains non-delegable accountability for review decisions.

Reference documents

• BS ISO 45001:2018 Occupational health and safety management systems — Requirements with guidance for use