Management Review Without Risk or Change
A 250-employee company held its management review on 2025-02-10. Attendees were the CEO, operations director, sales director and quality manager. The minutes record customer complaints (12, up from 5), internal audit results (no nonconformities), process performance (on-time delivery 94% against a 95% target), product conformity (2.1% scrap against a 1.5% target), corrective actions (8 open, 3 overdue) and no supplier performance discussion. There is no discussion of changes in external or internal issues, risks and opportunities, resource adequacy or improvement opportunities. The risk register was last updated in 2023 and is not linked to the review. Quality objectives include 'improve customer satisfaction' with no metric, and 'reduce scrap' with a target but no action plan. Top management says the review is adequate because it covered the standard agenda.
1. Evaluate conformity to ISO 9001 clauses 9.3.2 and 6.2.1.
Read the worked answer
Clause 9.3.2 requires the management review to cover the status of actions from previous reviews; changes in external and internal issues; customer satisfaction and feedback; extent to which quality objectives are met; process performance and product conformity; nonconformities and corrective actions; audit results; performance of external providers; adequacy of resources; effectiveness of actions on risks and opportunities; and improvement opportunities. The minutes cover only some of these. There is no discussion of changes in issues, risks and opportunities, resource adequacy, supplier performance, or improvement opportunities. Clause 9.3.3 requires outputs related to improvement opportunities, changes to the QMS, and resource needs; the minutes record only 'continue'.
Clause 6.2.1 requires quality objectives to be measurable, monitored, communicated and updated. 'Improve customer satisfaction' has no metric, and the scrap objective has no action plan.
2. Is the management review effective? Draft a finding and justify minor versus major classification.
Read the worked answer
The review is not effective, even though it followed a familiar agenda. The absence of risk and change discussion is not a clerical omission: the risk register has not been updated since 2023, customer complaints have more than doubled, on-time delivery is below target, and three corrective actions are overdue. These are exactly the inputs that should drive decisions. A nonconformity against 9.3.2 and 9.3.3 is justified. A separate nonconformity against 6.2.1 is also possible for the non-measurable customer satisfaction objective.
Classification: minor for the management review if the organization can show that other forums address these inputs and the omission is limited to this review; major if this is the only review and the same pattern exists in prior years, because top management's review process is systemic and ineffective. The auditor should sample previous minutes before deciding.
3. Recommend improvements and state the audit conclusion.
Read the worked answer
Recommendations: rebuild the management review input agenda around 9.3.2; require a risk and change update, supplier performance, resource adequacy, objective status and improvement opportunities; record decisions with owners and dates; link the risk register to review outputs; define measurable objectives with baselines, targets, monitoring frequency and action plans; and track overdue corrective actions. The auditor should verify the next review, not just the revised procedure.
Audit conclusion: raise at least a minor nonconformity; consider major if the pattern is repeated and the review has not been used to drive improvement. Certification can continue only if the organization demonstrates effective correction and corrective action.