Management reviews
Last checked on
This is where you hold your management review: a fixed agenda of eight topics, with summaries Trustbird prepares, room for notes and decisions, follow-up tasks and a PDF report.
Why this protects your organisation
Information security only keeps working if leadership looks at it deliberately and regularly, and makes choices: what is going well, what is stuck, where time or money is needed. The management review is that moment, and its report shows customers and auditors that leadership is involved. ISO 27001 asks for it in clause 9.3, with a fixed set of topics to cover.
Steps
- Open Management reviews in the Improve group and click New management review.
- Fill in Held on, choose the participants and click Create. Trustbird immediately prepares the eight agenda topics, each with a summary.
- Work through the agenda. Click Edit on a topic to record notes and decisions.
- Record the meeting's overall decisions under Decisions and save.
- Add actions from the meeting as tasks under Tasks, with Create task or Link existing task.
- Click Establish in the list once the review is complete, and download the report with Download report.
The fixed agenda
Every management review has the same eight topics:
- Actions from the previous review
- Changes in the context
- Nonconformities
- Monitoring and measurement results
- Audit results
- Objectives
- Feedback from interested parties
- Risks and opportunities for improvement
When you open a review, Trustbird fills in a Summary for each topic with figures from your workspace. For example, how many nonconformities are still open, how many internal audits have been performed and how your objectives are doing. For Actions from the previous review, Trustbird counts the tasks linked to the previous review and how many of them are still open. You cannot edit the summary. What leadership makes of it goes into the Notes and Decisions for that topic.
Establishing
While the review is a Draft, you can update everything. Establish records who established the review and when, and gives it the status Established. After that it can no longer be changed.
The report is a PDF with the participants, the establishment, each topic with its summary, notes and decisions, and the overall decisions. Everyone in the workspace can download it, even while the review is still a draft.
If it does not work
I can no longer change a management review
An established management review is final. Its details, agenda topics and decisions can no longer be changed and it can no longer be deleted. You can still download the report. Anything you want to add belongs in the next review.
A topic summary no longer matches the current situation
Trustbird fixes the summaries at the moment you open the review, so it stays clear what the meeting saw. Later changes, for example to nonconformities or objectives, show up in the next review. Put any additions in the notes.
I do not see the Establish or New management review button
Owners and members can create, update and establish reviews, as can advisors with edit rights for the Improvement module. Establish only appears on a review that is still a draft.
Screens this is about
- Management reviews