ISO 9000:2015 Management Review Process

A brief guide to what you may find on your path to ISO 9001 accreditation

An ISO Implementation Guide for Small to Mid-Sized Businesses <Rev 2016>

In a Nutshell

Routinely reviewing the organization’s process and quality management systems to spur continuous improvement is one of four elements in the ISO 9000:2015 pillar of learning from experience. This brief describes the meaning of management review, the attributes of a good management review system, and the steps an organization might take to implement management reviews. It also describes the key principles and essential features of a management system for this element, along with work activities that support these essential features. It presents a range of approaches that might be appropriate for each work activity, depending on perceived risk, resources, and organizational culture. Finally, it includes (1) ideas to improve the effectiveness of management systems and specific programs that support this element, (2) metrics that could be used to monitor this element, and (3) issues that may be appropriate for a management review.

Introduction

Management reviews are the routine evaluation of whether management systems are performing as intended and producing the desired results as efficiently as possible. It is the ongoing “due diligence” review by management that fills the gap between day-to-day work activities and periodic formal audits. A Management Review is similar to a doctor giving a routine physical examination – even when no overt signs of illness are present, life-threatening conditions may be developing that are best addressed proactively.

Management reviews have many of the characteristics of a 1st party audit as described in the latest ISO 9000:2015 standard. They require a similar system for scheduling, staffing, and effectively evaluating all QMS elements, and a system should be in place for implementing any resulting plans for improvement or corrective action and verifying their effectiveness.

Effective performance is a critical aspect of any process safety program; however, a breakdown or inefficiency in a safety management system may not be immediately obvious. For example, if a facility’s training coordinator unexpectedly departed, required training activities might be disrupted. The existing trained workers would undoubtedly continue to operate the process, so there would be no outward appearance of a deficiency. An audit or incident might eventually reveal any incomplete or overdue training, but by then it could be too late.

The management review process provides regular checkups on the health of process safety management systems in order to identify and correct any current or incipient deficiencies before they might be revealed by an audit or incident.

Where/When Is It Done?

Management reviews should be conducted wherever QMS elements are implemented. The depth and frequency of each management review should be governed by factors such as the current life cycle stage of the facility, the maturity or degree of implementation of the ISO 9000:2015 management system, the level of management performing the review, past experience (e.g., incident history, previous reviews, and audit results), and management’s view of the risk posed by the activities to be reviewed. Most of the management review effort will be focused on operating facilities. While they can be scheduled on an as-needed basis, management reviews of a particular element are typically conducted at a predetermined interval (e.g., frequencies ranging from monthly to annually are common), and they may be scheduled in conjunction with other regularly scheduled meetings, such as regular committee meetings.

Who Does It?

Strictly speaking, every level of management – from the process supervisor to the facility manager to the board of directors – should conduct periodic management reviews. Further discussion in my ISO Handbook focuses on program level reviews, which should be conducted by a manager who is one or two levels above the person responsible for the day-to-day execution of a specific element. This is usually the manager ultimately responsible for the proper functioning of the facility’s overall process management system; however, larger facilities may charter a Process Committee to conduct the reviews under the leadership of a senior manager.

What Is the Anticipated Work Product?

The output of a management review is generally an internal memorandum summarizing the review, any deficiencies or inefficiencies noted, and recommendations for improvement or corrective action. The recommendations should be given deadlines and then assigned to specific individuals. All outputs of the management review element are intended to facilitate the performance of other elements. In addition, the management reviews provide input that the audits element can use to focus its efforts.

How Is It Done?

Management reviews are conducted with the same underlying intent as an audit – to evaluate the effectiveness of the implementation of an entire QMS element or a particular element task. However, because the objective of a management review is to spot current or incipient deficiencies, the reviews are more broadly focused and more frequent than audits, and they are typically conducted in a less formal manner.

Nevertheless, like an audit, a management review at least checks the implementation status of one or more QMS elements against established requirements. The management review team meets with the individuals responsible for managing and executing the subject element to (1) present program documentation and implementation records, (2) offer direct observations of conditions and activities, and (3) answer questions about program activities.

The team attempts to answer such questions as:

• What is the quality of our QMS program?
• Are these the results we want?
• Are we working on the right things?

Organizational changes, staff changes, new projects or standards, efficiency improvements, and any other anticipated challenges to the subject element are also discussed so that management can proactively address those issues. Recommendations for addressing any existing or anticipated performance gaps or inefficiencies are proposed, and responsibilities and schedules for addressing the recommendations are assigned. Typically, the same system used to track corrective actions from audit findings is used to track management review recommendations to their resolution. The meeting minutes and documentation of each recommendation’s resolution are maintained as required to meet programmatic needs. Management review results should be monitored over time, and more frequent reviews should be scheduled if persistent problems are evident.

Protocols for ISO 9000:2015 Management Reviews

1. You need to ensure that the provisions of the management system and its effectiveness are reviewed. The meetings need to review current management & operational performance data and ensure that improvement opportunities have been addressed.
2. The standard says that review meetings should be held at “planned intervals”. This can be monthly, quarterly or annually. We strongly recommend that they should be “scheduled events” in your organizations calendar and publicized well ahead of the actual meeting date.
3. These meetings should be chaired by your nominated Management Representative. Senior managers, line supervisors, compliance officers are a given. Maybe you should also extend an invitation to other “interested parties” from time to time, say, a representative from key suppliers?
4. The meeting agenda needs to focus on quality related activities including the on-going development of the management system.
5. The meetings could include a review of the following, as applicable:
   • The minutes of the previous management meetings & a review of outstanding actions from the last management meetings
   • Current organizational structure and resources
   • R & D initiatives and development projects
   • Operational performance indicators
   • Results of audits
   • Customer feedback
   • Product, process and system non-conformances
   • Status of Corrective / Preventive Actions
   • Recommendations for improvement
   • Planning for training
   • Changes that could affect the system i.e. regulations or legislation
6. Where applicable the management meetings should review summaries of data generated such as: – graphs, bar charts, tabular summaries, etc: for any indication of a trend that may indicate deterioration or improvement of the system.
7. Targets for performance improvement need to be reviewed at each meeting.
8. Management Review Meeting Minutes need to include details of attendees, brief notes of the discussions/review activities, including action officers and proposed action completion dates.
9. Output from the management meetings shall include decisions and actions related to:
   • Improvement of the business / operations
   • Improvement of the effectiveness of the overall management system – Quality + WPHS+ Environmental
   • Improvement of product related to customer requirements
   • Raising of appropriate corrective / preventive actions, as required
   • Resource needs
10. Minutes should be posted on company notice-boards or raised at Toolbox Meetings.

Summary

Management Review meetings are an important opportunity to bring together an overview of the management system, to assess its performance, and to identify any opportunities where it can be improved. Held at least once per year, it’s also a time to review the company’s quality policy and set new objectives for the coming year. ¹

It’s essential that “top management” be involved.

The agenda should include a review of:

• internal and external audit findings and reports
• customer feedback – look closely at the negative feedback, but don’t leave out the positive feedback – it’s valuable data too (and nice to hear!)
• supplier performance
• all issues raised or resolved since the last review to make sure problems are being resolved properly, and to look for trends in the data
• process performance – is the process reaching/maintaining performance targets?
• any changes to standards, regulations, technology, competition, staffing, and other business activities that could affect the quality system
• improvement requests

To be effective, attendees need to come to the meeting prepared with data, and be ready with some conclusions drawn from the data. It looks like a long list (!) but there’s no reason you can’t break it into smaller chunks, and if you review some aspects in other meetings there’s no need to repeat it. In fact, ‘Management Review’ does not even have to happen in a ‘Management Review Meeting’. You will need to make sure you have records that show you have covered everything, however you do it. ²

At the end of the management review process you will need to record any decisions and actions to be taken to improve the management system, product, and/or processes, and what resource needs have been identified.

¹ http://www.qualitysystems.com/support/pages/management-review

² The Strategy Associates’ Core Technology Quality Systems Toolbox includes a meeting module you can use to schedule and plan your meetings. During the meeting you can take minutes and create and assign action items or tasks, directly into QST. If that’s not feasible for your meeting, you can print out the agenda as a form for written notes, and upload the scanned notes later. To keep track of any action items identified in the meeting you’ll need to create them as tasks in QST. With the meeting and tasks in Quality Systems Toolbox it’s easy to review what happened last time and if you missed the meeting it’s easy to catch up. How often do your meeting minutes get lost or buried and never written up and sent to attendees? It’s a key recommendation for effective meetings, but once it’s all over, the motivation for writing up the minutes dissipates very quickly.