A 45-minute quarterly review that records "continue monitoring" four times
Brightline Analytics is a 90-person SaaS company providing route-optimisation software to freight operators. Its QMS covers development, hosting, customer support and onboarding. Management review is a 45-minute item on the leadership team's quarterly agenda, and the retained record is three slides: revenue, churn and headcount. Over the last 12 months Brightline shipped two major releases, saw P1 incidents rise from 4 to 11 per quarter, churn rise from 4% to 9%, two minor nonconformities at the certification body's surveillance audit, and a cloud hosting SLA review that was prepared but never tabled. One planned internal audit was skipped because "the team was busy with the launch". The CEO attends, the quality manager presents, and the only decision recorded across four quarters is "continue monitoring". One of the external minor nonconformities cited management review inputs; another cited slow corrective action on an earlier audit finding.
1. Against 9.3, what is missing at Brightline? Structure your answer around required inputs, required outputs, and the format question.
Read the worked answer
Format first, because it is where people argue. 9.3.1 requires top management to review the QMS at planned intervals to ensure continuing suitability, adequacy, effectiveness and alignment with strategic direction. It does not require a standalone meeting, a slide template, or a two-hour slot. A 45-minute agenda item is compliant in principle. What is not compliant is the scope of what is reviewed and the absence of outputs.
Required inputs (9.3.2), checked against Brightline:
| Input | Status |
|---|---|
| Status of actions from previous reviews | Not visible |
| Changes in external and internal issues (4.1) | Not addressed - two releases changed the service materially |
| Customer satisfaction and feedback from interested parties | Churn is shown; no customer feedback is reviewed |
| Extent to which quality objectives have been met | Absent |
| Process performance and conformity of products and services | Absent - P1 incident rise is not tabled |
| Nonconformities and corrective actions | Absent - and this is the subject of an external NC |
| Monitoring and measurement results | Absent |
| Audit results | Absent - including the skipped audit |
| Performance of external providers | Absent - cloud hosting SLA not tabled |
| Adequacy of resources | Absent |
| Effectiveness of actions taken to address risks and opportunities | Absent |
| Opportunities for improvement | Absent |
Required outputs (9.3.3): opportunities for improvement, any need for changes to the QMS, and resource needs. "Continue monitoring" is none of the three, and documented information of results is required.
Diagnosis: Brightline is reviewing its business, not its QMS. The two are not interchangeable, and revenue alone cannot tell leadership whether the management system is effective.
2. Would you raise a nonconformity? Write the statement you would use, and explain why each element is there.
Read the worked answer
Yes - this is not a style preference, it is a missing input set and missing outputs.
Suggested statement:
Clause 9.3.2: management reviews held in the four quarters to 30 September did not consider audit results, nonconformities and corrective actions, performance of external providers, process performance, or the extent to which quality objectives were met. The retained record for each review consists of revenue, churn and headcount figures only. Clause 9.3.3: the only recorded output over the same period is "continue monitoring"; no opportunities for improvement, need for changes to the QMS, or resource needs are recorded.
Why each element is present:
- The requirement is cited by sub-clause, so the finding is auditable and the corrective action can be scoped. "Management review is ineffective" would be an opinion.
- The evidence is the retained record, which is the only defensible basis - an auditor cannot know what was discussed off-record, and the organization is obliged to retain documented information of results.
- A date range and a sample make the finding verifiable and bounded, and let the organization check whether earlier reviews were compliant.
- Inputs and outputs are separated, because they typically have different causes: inputs fail when the quality manager prepares the pack alone; outputs fail when leadership has no decision authority in the room or no expectation to decide.
Link to the external findings: one surveillance NC already cited management review inputs and another cited slow corrective action. Recurrence of the same clause across two audits is a signal that the earlier corrective action addressed the record and not the process - which is itself a 10.2 issue and should be raised or cross-referenced.
3. How does this connect to the leadership principle and to evidence-based decision making? And what do you do about the skipped internal audit?
Read the worked answer
Leadership (5.1.1). Top management must demonstrate leadership and commitment by taking accountability for the effectiveness of the QMS, ensuring the quality policy and objectives are compatible with strategic direction, ensuring integration of QMS requirements into the organization's business processes, promoting the process approach and risk-based thinking, ensuring resources, communicating importance, and engaging people. At Brightline, releases, incidents and churn are the QMS, but they are discussed in the business review and never connected to it. The result is a management system run by the quality manager for the certification body. That is a 5.1.1 failure more than a 9.3 paperwork failure, and fixing 9.3 by preparing a bigger slide pack will not touch it. The fix is an agenda that starts from the operational data leadership already trusts.
Evidence-based decision making. The principle requires decisions to be based on the analysis and evaluation of data and information. Four quarters produced one decision, and the rise in P1 incidents from 4 to 11 - a leading indicator of the churn rise - was never put in front of the people with authority to act. Decisions were not wrong; they were not made.
The skipped audit. 9.2.2 requires the programme to be planned considering process importance, changes and previous audit results. Re-planning for a launch is legitimate if it is done deliberately, risk-assessed and documented. Silently dropping an audit is not. Ask for the revised programme and its rationale: if none exists, raise it; if a documented reprioritisation exists, evaluate whether the justification holds.