Management review

I will be conducting audit checks on all three management systems on a monthly basis across the whole year with a view to recertifying every Jan/Feb/Mar.

As the audit effectively takes place over the course of the whole year, when would you recommend the management review is scheduled? Is it sensible to conduct it only when the internal audit is complete? My concern with this approach is that with 2/3 management systems., the review meetings will stack-up at the end of the year when there is probably less chance of them taking place.

Answer: ISO management standards give organizations freedom to define how they can approach the management review (the standards only require the reviews to be performed at planned intervals and the inputs and outputs to be covered).

Considering your situation, you should consider to perform quarterly or semi-annual meetings, covering in each meeting all topics regarding data after the last meeting, or specific topics considering data from the last meeting where such topics where covered. The main point to consider is that between external audits you must ensure all topics required by the standards are covered.

This approach will make easier for you to schedule the management reviews to dates where they will have more chance to be performed.

This article will provide you further explanation about management review:
- Why is management review important for ISO 27001 and ISO 22301? https://advisera.com/27001academy/blog/2014/03/03/why-is-management-review-important-for-iso-27001-and-iso-22301/