# ISO 45001 Management Review: Inputs, Outputs, Agenda and Report

> What ISO 45001:2018 clause 9.3 requires from a management review: the inputs, the decisions, who attends, how often, a practical agenda and report, and common audit findings.

**Source:** https://www.esgweise.com/insights/iso-45001-management-review/
**Author:** Sumit Agarwal
**Published:** 2026-10-10
**Frameworks:** ISO 45001
**Countries:** UAE, KSA, Oman, Qatar, Global

---

## Key points

- Clause 9.3 of ISO 45001:2018 requires top management to review the OH&S management system at planned intervals for continuing suitability, adequacy and effectiveness.
- The standard lists seven groups of inputs, from the status of previous actions to worker consultation and opportunities for improvement.
- The outputs are decisions, not a summary: on improvement, changes to the system, resources, actions, integration with the business and strategic direction.
- Top management must communicate the relevant outputs to workers and, where they exist, workers' representatives.
- Since Amendment 1:2024, climate change is one of the context issues the review should be able to show it has considered.

---

Management review is the meeting in which the people who run the organisation look at the occupational health and safety management system and decide what to do about it. In ISO 45001:2018 it sits in clause 9.3. Auditors read the record of it closely, because it is the clearest evidence of whether leadership is actually in charge of the system or has handed it to the safety department.

This article sets out what the clause requires, who should be in the room, how often to hold it, an agenda you can use, and the findings auditors raise most often.

## What clause 9.3 requires

Top management has to review the OH&S management system **at planned intervals** to make sure it remains **suitable, adequate and effective**. Annex A.9.3 explains the three words:

- **Suitable:** the system fits the organisation, its operations, culture and business systems.
- **Adequate:** the system is implemented properly.
- **Effective:** the system is achieving what it is meant to achieve, which for ISO 45001 means preventing work-related injury and ill health and providing safe and healthy workplaces.

The clause then lists what the review must consider and what it must produce, requires the relevant outputs to be communicated to workers, and requires a record.

## The required inputs

ISO 45001:2018 lists seven groups. In plain terms, and with what to bring for each:

| Clause 9.3 input | What to bring to the meeting |
|---|---|
| a) Status of actions from previous reviews | The action log from last time, with what is closed, what is late and why |
| b) Changes in internal and external issues, including interested parties' needs, legal and other requirements, and risks and opportunities | Changes to the business, new or amended laws, client or regulator requirements, an updated risk and opportunity register. Since 2024, include climate change (see below) |
| c) How far the OH&S policy and objectives have been met | Each objective with its target, actual result and a short explanation |
| d) OH&S performance trends: incidents, nonconformities and corrective actions; monitoring and measurement results; compliance evaluation results; audit results; consultation and participation of workers; risks and opportunities | Trend charts rather than single figures, leading as well as lagging indicators, the latest compliance evaluation, internal and external audit findings, and what the safety committee or worker consultation raised |
| e) Adequacy of resources | Staffing, budget, competence gaps, equipment and time for the system to work |
| f) Relevant communications with interested parties | Regulator correspondence, client complaints or audits, community concerns, contractor feedback |
| g) Opportunities for continual improvement | Proposals with an estimate of effort and benefit |

The word in clause 9.3 d) is **trends**. A slide showing this quarter's lost-time injuries does not meet it. Twelve or twenty-four months of data, with near misses, inspections and corrective action closure rates alongside, does.

Amendment 1, published on 23 February 2024, added to clause 4.1 a requirement for the organisation to determine whether climate change is a relevant issue, and to clause 4.2 a note that interested parties can have climate-related requirements. Clause 9.3 b) already requires the review to consider changes in internal and external issues, so the amendment reaches the management review through that input. The International Accreditation Forum treated it as a clarification that needed no full transition programme, and asked certification bodies to include it in their audits from publication. For an OH&S system the obvious questions are heat stress, extreme weather and the safety of new work created by climate action. ISO/PAS 45007:2026, published in January 2026, gives guidance on these risks.

## The required outputs

The outputs of the review are **decisions**. Clause 9.3 lists decisions on:

- whether the system remains suitable, adequate and effective in achieving its intended outcomes
- continual improvement opportunities
- any need for changes to the OH&S management system
- resources needed
- actions, if needed
- opportunities to integrate the OH&S management system better with other business processes
- any implications for the strategic direction of the organisation

Then two further duties. Top management must **communicate the relevant outputs to workers** and, where they exist, workers' representatives. And the organisation must **keep documented information** as evidence of the results.

A record that lists the inputs and ends with "the system was reviewed and found satisfactory" has not produced outputs. A decision has a subject, a choice and usually an owner: "Contractor induction to move from the HSE team to site supervisors from 1 January, budget approved for one additional HSE officer, objective on near-miss reporting raised for next year."

## Who attends

**Top management has to own it.** ISO 45001 defines top management as the person or group of people who direct and control the organisation at the highest level. The managing director or general manager, or the executive team, has to take part and take the decisions. A review held by the HSE manager alone, however thorough, does not satisfy clause 9.3. The standard lets top management delegate authority but says it keeps ultimate responsibility for the system (the note to the definition in clause 3.12), and clause 5.1 makes it accountable for preventing work-related injury and ill health.

A practical attendance list:

- **Chair:** managing director, general manager or chief executive
- **Presents the inputs:** HSE manager or the person who runs the system day to day
- **Heads of function whose areas carry the risk:** operations, maintenance, projects, facilities
- **HR:** for competence, training, absence and occupational health data
- **Procurement:** where contractors and purchased equipment are significant
- **A worker representative or safety committee member**, where there is one

The standard does not require a worker representative to attend. It does require consultation and participation of non-managerial workers on the system under clause 5.4, and it requires the outputs to be communicated to them. Having someone in the room is the simplest way to show both.

## How often

At **planned intervals**, which you decide. ISO 45001 sets no frequency.

Once a year is the usual minimum. A certification body checks at stage 1 that management reviews are being planned and carried out, so at least one needs to be complete before initial certification, and surveillance auditors routinely ask for the latest record. Many organisations with higher-risk operations hold a short quarterly review instead. Annex A.9.3 allows this: the topics in clause 9.3 a) to g) need not be covered all at once, as long as the organisation decides when and how each is addressed. If you split the review across meetings, keep a simple matrix showing which input was covered at which meeting, so an auditor can see that nothing fell through.

Hold the review early enough to act on it. A review held the week before the surveillance audit, with decisions nobody has started, tells the auditor exactly how the system is run. Our article on [how often ISO audits happen](/insights/how-often-iso-audits-happen/) explains the audit calendar the review needs to fit into.

## A practical agenda

Two hours is usually enough for a single site with one standard. Send the pack a week ahead so the meeting is spent deciding, not reading.

| # | Item | Clause 9.3 | Presented by |
|---|---|---|---|
| 1 | Actions from the last review | a) | HSE lead |
| 2 | What has changed: business, sites, people, contractors, legal and other requirements, climate | b) | HSE lead, legal or compliance |
| 3 | Risks and opportunities register, what has moved | b), d) | HSE lead |
| 4 | Objectives: target against actual | c) | Objective owners |
| 5 | Performance trends: incidents, near misses, inspections, monitoring, corrective actions | d) | HSE lead |
| 6 | Compliance evaluation results | d) | HSE lead or legal |
| 7 | Internal and external audit results | d) | Internal audit lead |
| 8 | Worker consultation: what the safety committee and workers raised, and what was done | d) | Worker representative |
| 9 | Communications from regulators, clients, contractors and neighbours | f) | HSE lead |
| 10 | Resources: people, competence, budget, equipment | e) | Heads of function, HR |
| 11 | Improvement proposals | g) | Any attendee |
| 12 | **Decisions** on each required output, and the action list | Outputs | Chair |
| 13 | How the outputs will be communicated to workers | Outputs | Chair |

## What the report should show

Call it minutes, a report or a record. It needs:

1. **Date, attendees and their roles**, so top management's presence is visible.
2. **Each input**, with the information considered or a reference to the pack.
3. **A decision against each required output.** "No change needed" is a valid decision, if it is stated.
4. **An action list** with owner, due date and how completion will be checked.
5. **How and when the outputs were communicated to workers**: a toolbox talk, a notice, a briefing to the safety committee.

## Findings auditors commonly raise

The same handful of points come up repeatedly in surveillance and internal audits:

- **Top management absent.** The review was run by the HSE team and the record does not show leadership taking decisions.
- **Inputs missing.** Compliance evaluation and worker consultation are the two most easily forgotten, followed by communications from interested parties.
- **No real outputs.** The record describes performance but takes no decisions on resources, changes or improvement.
- **Previous actions not followed up.** Item a) is skipped, or the same action reappears every year.
- **Outputs not communicated to workers.** The decision was taken but nobody below management heard about it.
- **Stale or single-point data.** One month of figures instead of trends.
- **Context not refreshed.** The issues and interested parties are copied from last year, with no sign that climate change has been considered since the 2024 amendment.

## One review for several standards

If you also hold ISO 14001 or ISO 9001, one review can cover all of them, because they share the same clause 9.3 in the harmonised structure. Keep the ISO 45001 specific inputs visible, especially worker consultation and the duty to communicate outputs to workers. We describe how integration works in [integrated management systems](/insights/integrated-management-systems-iso/).

Management review is also where the results of [management of change](/insights/iso-45001-management-of-change/) should surface: what changed over the period, whether the changes were controlled, and whether anything changed that nobody planned. For the basics of the standard, see [our introduction to ISO 45001](/insights/iso-45001-occupational-health-safety/).

## How ESGweise helps

We prepare management review packs, facilitate the meeting with leadership, and track the actions afterwards as part of [running certified management systems](/services/managed-iso-systems/). Our [internal audits](/services/iso-internal-audit/) test the review against clause 9.3 before a certification body does, and we support organisations through [certification](/services/iso-certification/).

---

## Frequently asked questions

### How often should an ISO 45001 management review be held?

At planned intervals that the organisation sets. ISO 45001:2018 does not fix a frequency. Once a year is the common minimum, and many organisations hold shorter quarterly reviews instead. The guidance in Annex A.9.3 says the topics need not all be covered at once, so a series of meetings is acceptable as long as every input is covered over the planned period and the records show it.

### Who must attend an ISO 45001 management review?

Top management. Clause 9.3 places the review on top management, the person or group who directs and controls the organisation at the highest level, and it cannot be delegated to the HSE manager alone. In practice the HSE lead prepares and presents the inputs, and heads of operations, HR and maintenance usually attend. Inviting a worker representative is good practice and supports the consultation requirements of clause 5.4.

### What are the inputs to an ISO 45001 management review?

Clause 9.3 lists the status of actions from previous reviews; changes in internal and external issues, including interested parties' needs, legal and other requirements, and risks and opportunities; how far the OH&S policy and objectives have been met; OH&S performance trends, including incidents, nonconformities, monitoring results, compliance evaluation, audit results, worker consultation and participation, and risks and opportunities; adequacy of resources; relevant communications with interested parties; and opportunities for continual improvement.

### What should an ISO 45001 management review report contain?

The date, who attended, evidence that each required input was considered, the decisions taken against each required output, and an action list with owners and dates. Clause 9.3 requires the organisation to keep documented information as evidence of the results of management reviews. Minutes are the usual form, but any record that shows the inputs, the decisions and the actions will do.

### Can the ISO 45001 management review be combined with ISO 14001 and ISO 9001?

Yes. The standards share clause 9.3 in the harmonised structure, so an integrated management system can hold one review covering all of them, provided each standard's specific inputs are addressed. For ISO 45001 that means worker consultation and participation, compliance evaluation for OH&S legal requirements, and communicating outputs to workers.


---

Published by ESGweise Global LLC, Dubai. https://www.esgweise.com