ISO 22000 management review: the inputs, an agenda and minutes that pass the audit

The management review is the meeting most food safety teams put off until the week before the audit, and it is the record auditors read most closely. If your ISO 22000 management review inputs are a list of headings with “discussed” written next to each one, the meeting has not done its job. Here is how to bring the right data into the room, run the meeting in two hours and write minutes that stand up.

What clause 9.3 requires and why auditors read it closely

Clause 9.3 of ISO 22000:2018 requires top management to review the food safety management system at planned intervals, to make sure it remains suitable, adequate and effective. Clause 9.3.2 lists the inputs the review must consider and clause 9.3.3 sets out the outputs. The organisation must keep documented information as evidence of the results.

Auditors read the management review closely for a simple reason: it is the one record that shows whether top management actually knows how the system is performing. A site can have perfect CCP records and still fall short here if the general manager has never seen a trend, approved a resource or made a decision about food safety. On audits we often find that the review was “held” by the QA manager alone, with top management signing the minutes afterwards. That is not a review.

The standard does not set a frequency. Most certified sites hold a full review at least once a year, and many run a shorter one every six months. Whatever you choose, write it into your procedure and keep to it. If something big happens, such as a recall, a new production line or a change of ownership, hold an extra review rather than waiting for the planned date.

The ISO 22000 management review inputs, one by one

The inputs are not a checklist to tick. Each one should arrive at the meeting as data, prepared in advance by the person who owns it. Here is the list in plain language and where the information normally comes from on a food site.

Input	Where the data comes from
Status of actions from previous reviews	The action log from the last minutes
Changes in external and internal issues, including changes in the organisation and its context	Your context analysis, new legislation, customer requirements, new products, staff changes
Results of system updating activities	Food safety team meeting minutes, HACCP plan reviews
Monitoring and measurement results	CCP and OPRP records, environmental monitoring, product testing trends
Analysis of verification results for PRPs and the hazard control plan	Verification schedule, inspection reports, laboratory results
Nonconformities and corrective actions	Nonconformance register, corrective action log
Audit results, internal and external	Internal audit reports, certification and customer audit reports
Inspections	Environmental health visits, customer inspections
Performance of external providers	Supplier performance data, receiving rejections, supplier audits
Risks and opportunities, and how effective the actions on them were	Risk and opportunity register
Extent to which food safety objectives were met	Objectives tracker
Adequacy of resources	Headcount, training gaps, equipment and budget requests
Emergencies, incidents, withdrawals or recalls	Incident register, mock recall reports
Relevant external and internal communication, including complaints	Complaints register, customer feedback, staff suggestions
Opportunities for continual improvement	Everything above, plus ideas from the team

Clause 9.3.2 asks for performance information including trends, presented so that top management can relate it to the objectives of the system. One month of complaint numbers tells management very little. Twelve months, split by category, shows whether foreign matter complaints are going up or down and whether last year’s action worked.

A practical agenda for a two-hour review

Send the agenda and the input pack at least a week before the meeting. Ask each owner to bring one page per input: the data, the trend, and what they want management to decide. Then run the meeting in this order.

1. Opening and attendance (5 minutes). Record who is present. Top management must be there, because clause 9.3 makes the review their job. The standard does not list the other attendees, but we recommend the food safety team leader and the heads of production, engineering, procurement and HR, or their delegates.
2. Previous actions (15 minutes). Go through the action log: closed, open or overdue, with evidence.
3. Context and changes (10 minutes). New products, customers, legislation, equipment and people.
4. Performance data (35 minutes). Verification results, CCP and OPRP trends, nonconformities, complaints and objectives.
5. Audits and inspections (15 minutes). Findings, root causes and whether the corrective actions worked.
6. Suppliers (10 minutes). Performance, rejections, approvals and removals.
7. Incidents, withdrawals and recalls (10 minutes). Include the result of the last mock recall.
8. Risks, opportunities and resources (10 minutes). What is needed for next year and what it will cost.
9. Decisions and actions (10 minutes). Read back every decision with its owner and date.

If the meeting keeps running over, the cause is usually owners presenting raw data in the room. Ask for the one-page summary instead and keep the detail in the pack.

Outputs: decisions, resources and changes with owners and dates

Clause 9.3.3 expects the review to produce decisions and actions on opportunities for continual improvement and on any need to update or change the system, including resources and revisions to the food safety policy and objectives. In practice every output in your minutes should answer four questions:

• What exactly was decided?
• Who owns it, by name or position?
• By when?
• How will we know it worked?

Record the decisions that confirm things too. “The food safety policy was reviewed and remains suitable, no change” is a valid output. So is “Objectives for 2027 approved as attached”. The auditor wants to see that management looked and decided, not only that they spent money.

A worked example

A dairy processor in KwaZulu-Natal brought twelve months of complaint data to its review. Foreign matter complaints had dropped, but complaints about short shelf life had doubled in the second half of the year. The QA manager linked this to a new carton supplier and to two weeks of filler breakdowns. The output was not “monitor complaints”. It was: engineering manager to present a costed proposal for filler maintenance by 30 November 2026; procurement to arrange an audit of the carton supplier by 15 December 2026; QA to report the shelf life complaint trend to the general manager every month until three consecutive months are on target. Three owners, three dates and one measure.

Writing minutes that are evidence, not a story

Good minutes are short. They record the data that was looked at, the conclusion and the decision. They do not record who said what. Use a table with one row per input and four columns: input, summary of the data presented (with a reference to the attached report), conclusion, and action with owner and date.

Attach or reference the input pack so the auditor can trace each conclusion back to the data. Number the actions so they can be carried into the first agenda item of the next review. Have the most senior person present sign and date the minutes, and issue them within a week while the decisions are still fresh.

If you would rather not build every form from scratch, the ISO 22000:2018 document templates toolkit gives you a full set of system documents to adapt to your site.

Common findings in management review records

These are the gaps we see most often when we audit ISO 22000 and FSSC 22000 sites:

• Inputs missing entirely, most often supplier performance, risks and opportunities, or adequacy of resources.
• Inputs listed with “discussed” or “satisfactory” and no data behind them.
• Outputs with no owner, no due date, or neither.
• Actions from the previous review never followed up.
• Top management absent, or signing minutes for a meeting they did not attend.
• Objectives reviewed but not measurable, so nobody can say whether they were met.
• The review held months after the planned date, with no explanation.
• No visible link between audit findings and the decisions taken.

Most of these come from treating the review as a document to produce rather than a meeting to run. An internal audit a month before the review will catch missing data while there is still time to collect it.

What to do this week

• Open your last management review minutes and check every action for an owner, a date and a status.
• Book the next review in top management’s diaries now.
• Assign each input to a named owner and ask for a one-page summary with twelve months of data.
• Rebuild your minutes template as a table: input, data, conclusion, action.
• Check that your objectives are measurable before they reach the meeting.

If you are implementing the standard or bringing on a new food safety team leader, our Implementation of ISO 22000:2018 course works through each clause, management review included, with practical examples. For hands-on help at your site, see our ISO 22000 implementation consulting.