Why Clause 9.3.3 Gets More Scrutiny Than You Expect
Management review is one of those areas where organisations often put in significant effort preparing for the meeting itself, then fall short on what comes out of it. Clause 9.3.3 of ISO 9001:2015 is brief. It takes up only a few lines in the standard. But when an auditor sits down to review your management review records, the outputs section is where the real test begins.
On this page
The inputs are relatively easy to demonstrate. You can show your internal audit results, customer satisfaction data, nonconformity logs, and performance against objectives. Most organisations have that material somewhere. The outputs are harder, because they require evidence that top management actually made decisions, not just that they attended a meeting and acknowledged the information presented to them.
This article walks through exactly what auditors look for when they review Clause 9.3.3, the common gaps that lead to nonconformities, and what good outputs actually look like in practice.
What Clause 9.3.3 Actually Requires
The clause is short and worth reading directly. ISO 9001:2015 Clause 9.3.3 states that the outputs of the management review shall include decisions and actions related to:
- Opportunities for improvement
- Any need for changes to the quality management system
- Resource needs
That is it. Three dot points. But each one carries more weight than it appears, and the word shall makes all three mandatory. An auditor is not looking for a tick next to each item. They are looking for evidence that the organisation genuinely considered these areas and produced real decisions as a result.
The standard also requires that documented information be retained as evidence of the results of management reviews. This is where many organisations stumble. The meeting happened. People discussed things. But the record of what was decided, by whom, and what will happen next is vague, incomplete, or missing entirely.
The Three Output Categories and What Auditors Check
Opportunities for Improvement
This is the output that most organisations attempt to address, but often in a superficial way. An auditor will look at your management review minutes and ask: did top management identify specific opportunities for improvement, or did they just acknowledge that improvement is generally a good thing?
There is a significant difference between a minute that reads the team agreed to continue monitoring customer satisfaction and one that reads the team identified that complaint response times have exceeded target in three of the last four quarters and agreed to review the complaint handling procedure by the end of the next quarter, with the quality manager responsible.
The first statement is a passive acknowledgement. The second is an output. Auditors are trained to distinguish between the two, and most experienced certification auditors will push back on minutes that contain only the former.
Opportunities for improvement do not have to be large-scale projects. They can be targeted, modest, and practical. What matters is that they are specific, they are linked to the data reviewed, and they result in a decision to act.
Any Need for Changes to the Quality Management System
This output is the one most commonly missing from management review records. Organisations often treat this as a box to tick by writing something like no changes required at this time in the minutes. An auditor will not automatically raise a nonconformity for that statement, but they will probe it.
If the inputs to the review included evidence of recurring nonconformities, missed quality objectives, or significant changes to the organisation's context, and the output says no changes are needed, the auditor will want to understand the reasoning. A well-run management review should be able to explain why no changes are needed based on the evidence, not simply assert it.
Changes to the QMS can include updates to procedures, revisions to the scope, changes to documented information, restructuring of responsibilities, or adjustments to monitoring and measurement activities. When those inputs are showing problems, the absence of any decision about the system is itself a finding.
Auditors also look at whether changes agreed in previous reviews were actually implemented. If last year's management review identified a need to update the supplier evaluation process and this year's review makes no mention of whether that happened, the auditor will follow that thread.
Resource Needs
Resource decisions are the most tangible output category and also the one that reveals most clearly whether top management is genuinely engaged in the review. When management reviews identify that a process is under-resourced, that equipment needs upgrading, that training is required, or that external support is needed, there should be a decision recorded about how that will be addressed.
Auditors look for specificity here. A minute that says additional training may be needed is not an output. A minute that says the team agreed that two additional operators require training on the updated work instruction by the end of Q2, with the operations manager responsible for scheduling is an output.
Resource decisions also include cases where management reviews that the current resources are adequate. That is a legitimate conclusion, but it needs to be supported by the data reviewed, not just stated without context.
What Good Management Review Outputs Look Like
The best management review outputs share a few common characteristics regardless of the organisation's size or sector. Auditors notice these qualities immediately.
They Are Specific and Traceable
Each decision or action can be traced back to a specific input. If customer satisfaction data showed a declining trend, the output should reference that trend and explain what the organisation intends to do about it. If internal audit results identified a cluster of nonconformities in a particular process, the output should address that process directly.
This traceability matters because it demonstrates that the review was analytical, not ceremonial. Top management reviewed the evidence and made decisions based on it. That is the intent of Clause 9.3.
They Include Ownership and Timeframes
Every action arising from the management review should have a named owner and a target date. This is not just good practice. It is what makes the output meaningful. Without ownership and a timeframe, a decision is just an intention.
Auditors will follow up on these actions, particularly during surveillance audits. If the management review from twelve months ago listed five actions and none of them have been completed or formally reviewed, that is a problem. It suggests that the management review is not driving improvement, which is its primary purpose.
They Are Documented Properly
Clause 9.3.3 requires retained documented information as evidence of results. That means the outputs need to be recorded in a format that can be retrieved and reviewed. Meeting minutes are the most common format. Action registers linked to the minutes are also useful.
The documentation does not need to be elaborate. A clear set of minutes with a summary of decisions, an action register with owners and due dates, and a record of who attended is sufficient. What it cannot be is a set of brief notes that simply confirm the meeting occurred without recording what was decided.
For more on how auditors approach the full management review process, including how inputs feed into outputs, see our article on Auditing Management Review: Inputs, Outputs and Evidence.
Common Nonconformities Raised Against Clause 9.3.3
Having conducted hundreds of external ISO certification audits across Australia and internationally, certain patterns appear repeatedly when organisations fall short of Clause 9.3.3 requirements.
Outputs Are Vague or Generic
The most frequent issue is that the outputs recorded in management review minutes are too general to constitute real decisions. Statements like the team will continue to monitor performance or management will look into resourcing issues do not demonstrate that decisions were made. They demonstrate that topics were discussed.
An auditor will raise this as a nonconformity if there is a consistent pattern of vague outputs across multiple review cycles, particularly if the same issues keep appearing in the inputs without corresponding decisions in the outputs.
No Evidence of Follow Up on Previous Outputs
Management review is a cycle. The outputs from one review should feed into the next. If there is no mechanism for tracking whether previous decisions were implemented, and no agenda item in subsequent reviews to check on progress, auditors will question whether the review process is effective.
This is a common finding in organisations that treat each management review as a standalone event rather than as part of an ongoing improvement cycle.
Resource Decisions Are Missing When They Should Be Present
If the inputs to the review included evidence of problems that clearly have a resourcing dimension, and the outputs contain no reference to resources, auditors will probe this gap. It does not necessarily mean a nonconformity, but it does require an explanation. If management genuinely considered resourcing and concluded that current resources are adequate, that conclusion should appear in the record.
The Three Output Categories Are Not All Addressed
Some organisations address improvement opportunities in their outputs but make no reference to QMS changes or resource needs. Because all three categories are mandatory under Clause 9.3.3, an auditor will raise a nonconformity if any of them are absent from the outputs without explanation.
This does not mean every review must produce a list of QMS changes and resource decisions. It means the review must demonstrate that each category was considered, and that where no action is required, the reasoning is documented.
How Auditors Verify Clause 9.3.3 in Practice
When an auditor sits down to assess management review outputs, they typically follow a consistent approach. Understanding this approach helps organisations prepare more effectively.
Document Review First
The auditor will request the management review records, usually covering at least the current cycle and ideally the previous one as well. They will read through the outputs and note whether each of the three mandatory categories is addressed, whether decisions are specific and traceable, and whether actions have owners and timeframes.
They will also look at whether the documented information is retained in a way that meets Clause 7.5 requirements. Management review minutes that exist only in someone's email inbox or on a personal drive, without any controlled version, can attract findings under document control as well as Clause 9.3.3.
Interviews With Top Management
Auditors will typically interview at least one member of top management, often the CEO, Managing Director, or Quality Manager. They will ask about the management review process, what decisions were made, and how those decisions are being implemented.
This is where organisations that run genuine management reviews have a clear advantage. If top management can speak fluently about what the review found, what was decided, and what has changed as a result, the auditor gains confidence that the process is real. If top management cannot recall what was discussed or refers entirely to the quality manager for answers, that is a signal that the review may be more administrative than substantive.
For practical guidance on how to conduct an effective management review under ISO 9001, we have a dedicated article that covers the full process from agenda setting through to output documentation.
Tracing Actions to Completion
Auditors will select one or two actions from the management review outputs and trace them through to completion. They will look at whether the action was implemented, whether it achieved the intended result, and whether the outcome was reviewed at a subsequent management review.
This tracing activity connects Clause 9.3.3 to Clause 10.2 (nonconformity and corrective action) and Clause 10.3 (continual improvement). Organisations that have strong corrective action processes tend to have stronger management review outputs, because the same discipline of ownership, timeframes, and follow up applies to both.
Practical Advice for Quality Managers
If you are preparing for a certification audit or surveillance audit and want to make sure your management review outputs will hold up to scrutiny, here is what to focus on.
Review Your Last Set of Minutes Before the Audit
Read your most recent management review minutes as if you were the auditor. Ask yourself: can I see a clear decision against each of the three output categories? Is each decision specific enough to be actionable? Does each action have an owner and a date? If the answers are no, address those gaps before the audit.
Build an Action Register
A simple action register linked to your management review minutes is one of the most effective tools for demonstrating Clause 9.3.3 compliance. It shows what was decided, who is responsible, when it is due, and what the current status is. Update it before each review and include a summary of completed actions as an agenda item.
Make Sure All Three Categories Are Addressed
Before finalising your management review minutes, check that the outputs explicitly address opportunities for improvement, any need for QMS changes, and resource needs. Even if the conclusion for one category is that no action is required, document that conclusion and the reasoning behind it.
Connect Outputs to Inputs
For each output, make sure a reader can identify which input it responds to. This does not need to be a formal cross-reference table. It can be as simple as structuring the outputs section of your minutes to follow the same order as the inputs, so the connection is clear.
If you are building or refining your internal audit programme and want to understand how management review fits within the broader performance evaluation requirements, our article on Management Review Under ISO 9001: Clause 9.3 Explained covers the full clause structure in detail.
The Bigger Picture: Why Outputs Matter More Than the Meeting
Management review is not about the meeting. It is about the decisions. The meeting is just the mechanism. What the standard cares about is whether top management is using the information available to them to make informed decisions about the quality management system, and whether those decisions are driving real improvement.
Clause 9.3.3 is the evidence that this is happening. An organisation can have a well-structured management review agenda, thorough inputs, and engaged participants, but if the outputs are vague, undocumented, or never followed up, the review has not fulfilled its purpose under the standard.
Auditors understand this. They are not looking for a perfect document. They are looking for evidence that the process is real, that decisions were made based on evidence, and that the organisation is using management review as a genuine tool for improvement rather than a compliance exercise.
If you want to develop the skills to audit management review effectively, or to understand what certification auditors look for across all clauses of ISO 9001, ISO 14001, and ISO 45001, the ISO 9001 Internal Audit: A Step by Step Guide is a useful starting point. Audit Workshop also offers Internal Auditor and Lead Auditor training across all three standards, delivered by practitioners with real certification audit experience. If you are preparing for a certification audit or looking to sharpen your audit skills, that practical grounding makes a measurable difference.
