Management review procedure

The management review shall include consideration of the status of actions from previous management reviews; changes in external and internal issues that are relevant to the PIMS; changes in the needs and expectations of interested parties relevant to the PIMS; information on the PIMS performance including trends in nonconformities and corrective actions, monitoring and measurement results, and audit results; and opportunities for continual improvement. The Robere correspondence table records that the first edition's ISMS-derived inputs on fulfilment of objectives, interested party feedback and results of risk assessment are not carried as separate items.

The review must consider the status of actions from previous reviews, changes in external and internal issues relevant to the BCMS, BCMS performance information including trends in nonconformities and corrective actions, monitoring and measurement results and audit results, feedback from interested parties, the need for changes including to policy and objectives, procedures and resources that could improve performance and effectiveness, information from the business impact analysis and risk assessment, the output of the evaluation of continuity documentation and capabilities, risks or issues not adequately addressed in any previous risk assessment, lessons learned and actions arising from near misses and disruptions, and opportunities for continual improvement.