Management Review Procedure

Introduction

Purpose

The purpose of this document is to define how the periodic management review of the management system should be conducted.

Responsibilities

The appropriate manager chairs regular meetings to review the performance of the management system in delivering effective control.  All risk owners and team members are invited to attend. 

Meeting frequency

Meetings are held every 3 months

Nominal agenda

The standard agenda for meetings is as follows:

• review of actions outstanding from previous management review
• review of effectiveness of the management system
• feedback and changes originating from clients and other interested parties
• audit results and future audit schedule
• review of corrective/preventive actions
• review Risk Assessment, in particular any residual risks whose score is on or above the threshold in order to agree treatment options
• potential changes to ISMS arising from legal, regulatory and business requirements:  this includes the effect of any changes e.g. in the business operation, upcoming external events, technology etc
• resourcing
• other recommendations for improvements to the management system or how it interacts with other systems

Recording of minutes and agreed actions

The chair ensures that the decisions and agreed actions are recorded.

Last updated: 22 September 2026