Management review
Review the BCMS at planned intervals against the defined inputs, record the decisions and track the actions, with top management present rather than represented.
01What applies
Top management must review the BCMS on a planned basis against a defined set of inputs, and must record and act on the decisions the review produces. The inputs include the status of actions from previous reviews, changes in external and internal issues, information on BCMS performance including trends in nonconformities and corrective actions, monitoring and measurement results, audit results, and the performance of interested parties. The outputs include decisions on improvement opportunities and on any need to change the BCMS. The clause is about a decision forum, not a slide deck.
02Why it matters
The management review is where the BCMS meets the business. If it is delegated, continuity is a technical function with no route to the resources it needs. If it is real, the review is the place where the impact analysis, the exercise findings and the audit results are read together and turned into decisions. The defined inputs exist so the review cannot be run on whatever someone prepared.
03What good looks like
Build the input pack to the clause list, one page per input, with the trend and the decision needed. Put the review in a forum that already has authority. Record the decisions as actions with an owner and a date. Open the next review with the status of those actions.
04Evidence an auditor asks for
Ask what decision the last review made about continuity. If the answer is that the report was noted, the review was not a review.
| Evidence | The record |
|---|---|
| Schedule | Planned reviews with attendance evidencing top management |
| Inputs | The defined inputs presented, with trends |
| Outputs | Decisions and actions recorded with owners and dates |
| Closure | Actions arising tracked to closure |
05Where it commonly fails
- Review delegated to the BCMS manager and merely noted
- Inputs incomplete, so decisions rest on partial information
- Decisions recorded but never converted into tracked actions
06What to do before the estimate
Build the input pack to the clause list. Put one decision on the agenda that needs top management authority.