What if a review concludes no changes are needed?

That is a valid outcome. Document it explicitly as a decision ("no ISMS changes required this cycle") rather than leaving the absence of a decision to be inferred. The auditor is looking for evidence of what was decided, not just that a meeting occurred; minutes that summarize discussion but record no actual decision are a common pitfall.

What does a good output look like?

A written decisions log: what was decided, who owns it, and by when—not a summary of what was discussed. A decision with no owner or deadline quietly never happens. Every decision that implies a change is routed into the change planning process of clause 6.3, and continual improvement decisions connect directly to clause 10.

What happens to the decisions at the next review?

They are carried forward explicitly into 9.3.2’s "status of previous actions" input, rather than quietly dropping off the agenda. The auditor will ask for evidence that prior decisions were followed up on and closed, or explicitly carried forward with a reason. That is what turns the review into a governance act instead of a passive status update.

ISO 27001 guide · Clause 9

9.3.3 — Management review results

Clause 9.3.3 requires the management review to produce documented decisions about continual improvement opportunities and any changes the ISMS needs.

By Sentrix · Published 2026-07-16

A review that produces no decisions is not a review—it is a status meeting. This sub-clause requires an actual output.

Mandatory requirement · Documented information required: yes

In plain language

9.3.3 requires the management review to end with something concrete: documented decisions about opportunities for continual improvement and about any changes the ISMS needs, kept as evidence that the review was more than a conversation.

Why this requirement exists

A discussion that produces no decision changes nothing. This sub-clause exists to force management review from a passive status update into an active governance act—leadership does not just hear about problems, it decides what happens next, and that decision is written down so it can be tracked and, at the next review, checked against 9.3.2’s "status of previous actions" input.

Scenario: a management review discusses that phishing test click rates have crept up for two quarters running, everyone agrees it is concerning, and the meeting moves on to the next topic with no decision recorded. Six months later, nothing has changed, because there was never an actual output—just an agreement that something was a problem.

What the standard expects

The standard expects the results of the management review to include decisions related to continual improvement opportunities and any needs for changes to the ISMS. Documented information must be available as evidence of the results of management reviews—not just that a meeting occurred, but what was decided.

In practice

End every review with a written decisions log: what was decided, who owns it, and by when—not a summary of what was discussed.
Route every decision that implies a change into the change planning process required by clause 6.3.
Carry open decisions forward explicitly into the next review’s 9.3.2 input rather than letting them quietly drop off the agenda.

Evidence the auditor will ask for

A documented decisions log for each management review, with owners and deadlines.
Evidence that prior decisions were followed up on and closed, or explicitly carried forward with a reason.

Common pitfalls

Minutes that summarize discussion but record no actual decision.
Decisions with no owner or deadline, which quietly never happen.

Related requirements

9.3.2 Management review inputs—what feeds into the decisions this sub-clause requires.
6.3 Planning of changes—where decisions about ISMS changes get carried out in a planned way.
Clause 10 Improvement—continual improvement decisions from management review connect directly to clause 10.
Parent clause: 9.3 Management review.

Sources

ISO/IEC 27001:2022

Frequently asked questions

What if a review concludes no changes are needed?: That is a valid outcome. Document it explicitly as a decision ("no ISMS changes required this cycle") rather than leaving the absence of a decision to be inferred. The auditor is looking for evidence of what was decided, not just that a meeting occurred; minutes that summarize discussion but record no actual decision are a common pitfall.
What does a good output look like?: A written decisions log: what was decided, who owns it, and by when—not a summary of what was discussed. A decision with no owner or deadline quietly never happens. Every decision that implies a change is routed into the change planning process of clause 6.3, and continual improvement decisions connect directly to clause 10.
What happens to the decisions at the next review?: They are carried forward explicitly into 9.3.2’s "status of previous actions" input, rather than quietly dropping off the agenda. The auditor will ask for evidence that prior decisions were followed up on and closed, or explicitly carried forward with a reason. That is what turns the review into a governance act instead of a passive status update.

Related pages

Let's talk about your compliance program.

Contact us