Management review is the point where top management looks at the whole OH&S management system and decides what happens next. An auditor wants to see more than a signed set of minutes. The question is whether top management looked at real information, made real decisions and made sure they were carried out. This guide is for auditors working to ISO 45001:2018 and for anyone preparing for the CQI (Chartered Quality Institute) and IRCA (International Register of Certificated Auditors) ISO 45001 Lead Auditor course.

What does ISO 45001 require for management review?

It requires top management to review the OH&S management system at planned intervals to confirm it stays suitable, adequate and effective.

Clause 9.3 of ISO 45001:2018 names top management as the reviewer, so the review cannot be delegated away. The organization decides how often to hold it, and the review must consider a set of inputs and produce a set of outputs. Top management must also communicate the relevant outputs to workers, and to workers’ representatives where they exist, and retain documented information as evidence of the results. Always check the exact wording in the current standard. Our guide to the role of top management in ISO 45001 explains the leadership duties that surround it, and our guide to how an ISO 45001 audit works shows where this check sits in an audit.

What inputs should a management review consider?

It should consider the status of earlier actions, changes in context, objectives, performance trends, resources, communication and improvement opportunities.

The table below turns the list of inputs into audit questions. Use it to check whether the review looked at real information.

A management review that looks at no data cannot make a decision.

What outputs and decisions should come out of the review?

The review should produce decisions on suitability, improvement, changes, resources, actions, integration and strategic direction.

Clause 9.3 says the outputs shall include decisions about the continuing suitability, adequacy and effectiveness of the system, and about opportunities for continual improvement. They also cover any need for changes to the system, the resources needed and actions if needed. The standard also names opportunities to improve integration with other business processes and any implications for the strategic direction of the organization. An auditor looks for decisions a person could carry out, with an owner and a date, not a general note that the system is “good”.

How do you plan an audit of management review?

Ask for the latest minutes, the agenda, the attendance list and the data presented, and plan to speak to top management.

Request records from the last one or two reviews and the review schedule. Plan the interview with a member of top management early, because their diary is the hardest to arrange. Also list the actions from the previous review, since you will trace those first. Our ISO 45001 audit plan and checklist guide shows how to build this into your checklist, and our guide to the documents required for an ISO 45001 audit helps you decide what to read first.

What evidence should you collect?

Collect minutes, input data, decision records, action follow-up and proof that workers were told.

Remember that a comment is a lead, and you confirm it with a record or an observation. Our guide to how to interview workers in an ISO 45001 audit shows how to ask the questions.

How do you interview top management and workers about the review?

Ask open questions about what was decided and why, then check what workers heard.

1. Ask top management to walk you through the last review and what they decided.
2. Ask for an example of a decision that changed something, such as resources or a target.
3. Trace one decision from the minutes to an action and to evidence that it was done.
4. Ask workers or their representatives what they were told about the outcomes.
5. Compare the answers with the minutes and note any difference.

Our guide to worker consultation and participation in ISO 45001 explains why workers need to hear the outputs, and our guide to continual improvement in ISO 45001 shows how reviews feed improvement.

What gaps do auditors commonly find in management review?

Common gaps are minutes with no data, no decisions, no follow-up and no message to workers.

• Minutes with no data. The record says performance was reviewed but shows nothing that was looked at.
• No decisions. Items are noted but nobody is given an action or a date.
• Delegated review. Top management does not take part and signs the minutes afterward.
• No follow-up. Earlier actions are never reported on at the next review.
• Workers not told. Nobody can say what came out of the review.

Treat these as prompts, not conclusions, and confirm each one with evidence before you raise a finding. Our guide to verifying corrective action after an ISO 45001 audit covers how to follow actions through. For the ISO 14001 side of the same clause, see our guide to management review in ISO 14001:2026.

Frequently asked questions

Where 3FOLD Training fits

3FOLD Training is a CQI IRCA Approved Training Partner (ATP 6039853), licensed by the Knowledge and Human Development Authority (KHDA) in Dubai. The ISO 45001 Lead Auditor course is delivered as 40 hours of Virtual Instructor Led Training (VILT), with learning management system (LMS) access for class recordings and mock exams, and you can check the next available batch on the course page. We prepare you for the exam; CQI and IRCA examine and certify. Before you book, read what you need in our eligibility guide.