ISO 22301 FAQ Management Review

Treat the review as a top-management decision meeting for the BCMS. The agenda should start with open actions from the previous review, then move through changes in internal and external context, interested-party feedback, BCMS performance, audit results, nonconformities, corrective actions, and monitoring results.

The review should also use business impact analysis and risk-assessment information, evaluation of business continuity documentation and capabilities, lessons from near misses and disruptions, and opportunities for continual improvement. If those inputs are missing, the review record will look complete but will not prove that leadership reviewed the real continuity system.

The strongest output is a short decision log, not a long meeting transcript. Each decision should say what will change, why it matters to continuity, who owns it, when it is due, and which evidence will prove completion.

Typical outputs include changes to the BCMS scope, updates to the BIA or risk assessment, revisions to continuity strategies and solutions, updates to business continuity plans, modifications to procedures and controls, and decisions about how control effectiveness will be measured.

Retain the management-review record with enough detail for a later auditor, customer reviewer, or executive sponsor to reconstruct the decision. At minimum, keep the agenda, attendance or approval record, input pack, decision log, assigned actions, communication record, and follow-up status.

Good evidence links back to live BCMS records: exercise and test reports, post-incident reports, internal audit results, monitoring and measurement data, nonconformity and corrective-action records, BIA and risk-assessment updates, documentation capability reviews, and prior management-review actions.

Run management review at planned intervals and after material changes. A useful cadence is frequent enough that actions from exercises, audits, incidents, supplier changes, business changes, and recovery-target updates do not wait until the certification audit cycle.

Trigger an additional review, or at least a targeted leadership decision, when the BCMS scope changes, a critical activity or dependency changes, a major disruption or near miss occurs, an exercise exposes a serious capability gap, audit findings point to systemic weakness, or resource constraints block continuity objectives.