Board members must determine the effectiveness of the management system, establish processes, approve cybersecurity measures, oversee their implementation and have sufficient knowledge themselves. That fits in one sentence, but in practice it is quite a challenge. The management review is the moment to live up to that responsibility, provided you set it up properly.
Start with the strategy, not the controls
In the management review, top management assesses whether the management system is still suitable, adequate and effective. But a management system that complies with a standard or law is not a goal in itself. Under clause 5.1 of ISO 27001, top management must ensure that policy and objectives are compatible with the strategic direction of the organisation.
The review tests that chain:
mission and vision → strategy → risk appetite → objectives and controls → decisions
That way every decision can be traced back to a strategic goal. The link also works the other way round: if a strategic ambition turns out not to be safely achievable with the current resources, the board makes a conscious choice between investing, adjusting course or accepting the risk.
Common mistakes
6 steps to make the management review relevant to the organisation
1. Open with strategy, vision and mission
Do not put the audit findings at the top of the agenda, but the question of what has changed in the organisation's strategy and context since the previous review. New markets, an acquisition, different services or new legislation determine which risks matter. Only then do you discuss whether the management system still fits.
2. Collect the input in advance
ISO 27001 clause 9.3 lists the fixed inputs: the status of actions from the previous review, changes in internal and external issues, the results of monitoring, audits and objectives, nonconformities, feedback from interested parties, the outcome of the risk assessment and opportunities for improvement. Gather these in advance and circulate them a week ahead. The meeting is then about decisions instead of reading out figures.
3. Have the board explicitly accept residual risks
ISO 27001 requires risk owners to approve the risk treatment plan and accept the residual risks. For risks outside the organisation's risk appetite, that decision belongs with the board. Record for each risk: do we accept it, invest or adjust course? Note who made the decision, why and until when it applies.
4. Derive SMART objectives from the strategy
Objectives must be specific, measurable, achievable, realistic and time-bound, and they must be traceable to the strategy. If the organisation is growing in the healthcare sector, for example, "NEN 7510 certificate before the end of Q3" is a logical objective. "We will improve information security" is not.
5. Record decisions with an owner, deadline and strategic link
Minutes without decisions are a snapshot. Record every decision with an owner, a deadline and the strategic goal it serves. At the next review you can then see at a glance what has been done, what is stuck and why it mattered.
6. Review more often and more briefly
One long annual meeting is too slow for a threat landscape that changes every month. Briefly discuss the main risks, incidents and open actions every quarter, and hold one extensive review a year that covers all mandatory topics. That keeps the board demonstrably involved without turning it into a paper exercise.
One review for all standards
ISO 9001, ISO 27001 and ISO 14001 share the same high-level structure, and NEN 7510:2024 builds on ISO 27001. As a result, the requirements for leadership, objectives and the management review are almost identical. Combine them in one integrated review, with the board's Cbw obligations as a fixed item. That saves meetings and gives the board one coherent picture instead of four separate ones.
How uComply helps
In uComply you manage the context analysis, the risk register and the management review once for all standards. You document the review including findings, decisions and assigned actions, and link them to the requirements of ISO 27001, ISO 9001, NEN 7510 and the Cbw, so the evidence is ready whenever the auditor or regulator asks for it. Actions get an owner and a deadline, and with Reminders and scheduled tasks you plan the quarterly and annual reviews as a recurring series. In between, the dashboard gives the board an up-to-date overview of risks, findings and progress per standard.
Frequently Asked Questions
Is a management review mandatory under the Cbw?
The Cbw does not use the term, but it does require the board to approve measures and oversee their implementation. A management review in line with ISO/IEC 27001:2022 clause 9.3 is the most common way to record that demonstrably.
How does the management review connect to the strategy?
You start with the strategic goals, determine which risks belong to them, test residual risks against the risk appetite and derive measurable objectives. Every decision refers to the strategic goal it serves.
How often should you hold a management review?
ISO 27001 requires reviews "at planned intervals", in practice at least once a year. Under the Cbw, a short quarterly review plus one extensive annual review is a workable approach.
In conclusion
A management review that starts with the strategy and ends with recorded decisions turns compliance into a governance instrument. The board can then show not only that it exercises oversight, but also why it makes the choices it does.
Would you like to see how to record and follow up the management review for all your standards in one place? Book a free demo.
