ISO 9001 Management Review: What Auditors Actually Look For in 2026
Management reviews are where auditors separate compliant companies from truly effective ones. Here is what to focus on based on real audit findings.
Why Management Reviews Matter More Than You Think
If you ask most quality managers what auditors focus on during an ISO 9001 surveillance audit, they will mention document control, corrective actions, and internal audits. What many underestimate is the management review — and it is one of the most revealing checkpoints an auditor examines.
As a Lead Auditor who has conducted hundreds of ISO 9001 audits across aerospace, automotive, medical device, and general manufacturing, I can tell you this: the management review is where I learn the most about whether a company truly lives its quality management system or merely documents it.
The Minimum Requirements (Clause 9.3)
ISO 9001:2015 Clause 9.3 specifies required inputs for management review:
- Status of actions from previous management reviews
- Changes in external and internal issues relevant to the QMS
- Customer satisfaction and feedback from relevant interested parties
- Quality objectives and the extent to which they have been met
- Process performance and product/service conformity
- Nonconformities and corrective actions
- Monitoring and measurement results
- Audit results (internal and external)
- Supplier performance
- Adequacy of resources
- Effectiveness of risk and opportunity actions
- Opportunities for improvement
What Auditors Actually Evaluate
Meeting the minimum checklist is table stakes. Here is what experienced auditors really assess:
1. Are Actions from Previous Reviews Actually Closed?
The number one finding I write during management review audits: open action items from the last review that nobody followed up on. If your management review generates 12 action items and 8 are still open six months later, that tells me the process is ceremonial, not functional.
Best Practice: Track management review actions in the same system you use for corrective actions. Assign owners, due dates, and review status monthly — not just at the next management review.
2. Is Data Driving Decisions?
Presenting data is not the same as analyzing it. I have seen management reviews with 40-slide presentations full of charts that nobody discussed. What I want to see is evidence that leadership looked at the data, identified trends, and made decisions.
Best Practice: For every metric presented, document what action was taken or why no action was needed.
3. Does Top Management Actually Participate?
Clause 5.1 requires top management to demonstrate leadership and commitment. If your CEO or plant manager does not attend the management review, that is a red flag. Delegating to a quality manager defeats the purpose of management-level oversight.
4. Customer Feedback Beyond Complaints
Many companies only track complaints. Auditors want to see a broader picture: customer satisfaction surveys, on-time delivery metrics, return rates, warranty data, and proactive feedback mechanisms.
5. Risk and Opportunity Updates
Your risk register should not be a static document created during initial implementation. It should evolve. New suppliers, market changes, regulatory updates, staffing changes — all of these should trigger risk reassessment.
Common Nonconformities We Write
Based on real audit experience, here are the most frequent management review findings:
- Incomplete inputs: Skipping required topics (especially risk/opportunity and supplier performance)
- No evidence of decisions: Minutes that summarize presentations but do not record decisions or action items
- Frequency gaps: Reviews not conducted at planned intervals
- Missing attendees: Top management absent without justification
- Static quality objectives: Same objectives year after year with no evolution
Making Your Management Review Audit-Ready
The best management reviews I have audited share common traits: they are concise, data-driven, action-oriented, and attended by decision-makers. They do not need to be long — a focused 90-minute review quarterly is far more effective than a 4-hour annual marathon.
If you are preparing for an upcoming surveillance audit or want to strengthen your management review process, Exceleor can help. Our consultants bring real auditor perspective to ensure your reviews are not just compliant — they are genuinely useful to your business.
Contact us for a free consultation to discuss your management review process.