The management review is one of the most important — and most frequently cited — elements of ISO 14001. It is the mechanism by which top management takes ownership of the EMS, reviews its performance, and commits resources to continual improvement. When the management review is done well, it is a genuine strategic session that improves environmental performance. When it is done badly, it becomes a paper exercise that produces a list of actions nobody owns.
Auditors know the difference. This guide sets out exactly what ISO 14001:2015 clause 9.3 requires, how to structure a management review that satisfies both the standard and genuine business need, and the nonconformities that most commonly arise.
1. What is the ISO 14001 management review?
The management review is a planned review by top management of the organisation's environmental management system. Its purpose, as stated in clause 9.3, is to ensure the EMS' continuing suitability (does it still fit the organisation's context and objectives?), adequacy (does it have enough resources and processes to achieve its purpose?), and effectiveness (is it actually working to improve environmental performance?).
The management review is not the same as an internal audit. The internal audit (clause 9.2) checks whether the EMS conforms to the standard's requirements. The management review assesses whether the EMS is achieving the right outcomes and whether top management is satisfied with its strategic direction.
2. Frequency and timing
ISO 14001 requires the management review to be conducted at "planned intervals." The standard does not specify a minimum frequency. Most certifying bodies and organisations interpret this as at least annually. Some organisations with high regulatory exposure or significant environmental aspects conduct management reviews twice yearly or quarterly.
The planned intervals must be defined in your documented procedures. If your procedure says annually and you conduct the review every 18 months, that is a nonconformity — not because the standard requires annual reviews, but because you are not following your own planned intervals.
Timing the management review to follow the close of the annual internal audit cycle is logical: the audit results are a required input, and having fresh audit data makes the management review more substantive.
3. Who must attend
Clause 9.3 specifies that the management review is conducted by top management. The standard defines top management as the person or group of people who direct and control the organisation at the highest level. For a manufacturing site, this typically means the site director, plant manager, or equivalent — not the EHS manager.
This distinction matters to auditors. A management review conducted by the EHS team and attended by middle management, with findings later reported to the director, does not satisfy the intent of the clause. Top management must be present and must be the ones making the decisions that are outputs of the review.
Supporting attendees typically include: EHS manager (who presents data), production/operations manager (who can commit to operational changes), HR representative (for workforce-related aspects), and finance/procurement (for resource discussions).
4. Required inputs (clause 9.3)
ISO 14001 clause 9.3 specifies a mandatory list of inputs that the management review must consider. Each must be addressed in the meeting — gaps in coverage are the most common nonconformity auditors raise.
| Required input | Typical evidence / data |
|---|---|
| (a) Status of actions from previous management reviews | Action log with completion status, responsible owner, and evidence of closure |
| (b) Changes in external and internal issues relevant to the EMS | Regulatory changes, new legislation, changes in context of the organisation, updated stakeholder map |
| (c) Environmental performance — nonconformities and corrective actions | NCR log with trends; root cause analysis completion rate |
| (c) Environmental performance — monitoring and measurement results | KPI dashboard: energy, water, waste, emissions — actuals vs. targets with trend |
| (c) Environmental performance — audit results | Internal audit summary report; any certification body surveillance audit findings |
| (c) Environmental performance — fulfilment of compliance obligations | Legal register update — any new obligations, compliance status, any enforcement actions |
| (d) Adequacy of resources | Assessment of EHS team capacity, training status, equipment maintenance budgets |
| (e) Relevant communications from interested parties | Complaints received, regulatory correspondence, customer enquiries, community feedback |
| (f) Opportunities for continual improvement | Proposed new objectives, suggestions from employees, benchmarking data |
5. Required outputs (clause 9.3)
The outputs of the management review must include decisions and actions related to:
- Conclusions about the continuing suitability, adequacy, and effectiveness of the EMS — the three words are all in the standard; all three should be addressed in the conclusions
- Decisions related to continual improvement opportunities — what specific improvements have been agreed, not just that improvement is desirable
- Any need for changes to the EMS — including resource needs, process changes, scope changes, and policy updates
- Actions needed when environmental objectives have not been achieved — if a target was missed, the management review must address why and what changes are being made
- Implications for the organisation's strategic direction — particularly relevant when the context has changed or when new environmental risks/opportunities have emerged
Critically: outputs must include specific actions with owners, resources, and timelines. An output that says "the EMS is suitable and effective" with no actions is technically compliant only if there are genuinely no issues and no opportunities identified — which is implausible for any real EMS.
6. Structuring the agenda
A well-structured management review agenda maps directly to the clause 9.3 inputs and outputs. A typical 2-hour agenda might look like:
- Welcome and purpose (5 min) — top management chairs; confirms quorum
- Actions from previous management review (15 min) — EHS manager presents action log status; top management notes any outstanding items
- Changes in context and interested parties (10 min) — any new regulatory requirements, market changes, or stakeholder issues
- Environmental performance review (30 min) — KPI dashboard review: energy/water/waste trends vs. targets; nonconformity log; audit results summary
- Compliance obligations (10 min) — legal register update; any new permits, changes to existing permits, compliance incidents
- Resource adequacy (10 min) — EHS team capacity; training completion; planned expenditure
- Communications from interested parties (10 min) — complaints, regulatory correspondence, customer queries
- Objectives progress and new opportunities (15 min) — progress on current-year targets; proposed targets for coming year
- Conclusions and actions (15 min) — top management states conclusions; actions agreed with owner and deadline
7. Documented information requirements
ISO 14001 requires the organisation to retain documented information as evidence of the management review (clause 9.3). The minimum documented information is:
- The management review minutes — dated, with attendees listed, covering all inputs and recording all outputs
- The action log from the management review — with owner, due date, and evidence of completion when closed
- Supporting documents presented at the review (KPI reports, audit summary, legal register) — ideally referenced in the minutes
Minutes should be circulated to attendees promptly and formally approved (signed or emailed agreement). They should be retained for the duration of the certification cycle and available to auditors at the next surveillance or recertification audit.
8. Common nonconformities auditors find
| Nonconformity | Root cause | Prevention |
|---|---|---|
| Management review conducted by EHS manager, not top management | Misunderstanding of "top management" definition | Ensure site director / plant manager chairs the meeting; show their attendance in minutes |
| Missing required inputs (often: compliance obligations, resources, or interested party communications) | Agenda not mapped to clause 9.3 list | Create a checklist of all 9.3 inputs; confirm each is addressed in minutes |
| Outputs lack specific actions — general observations only | Management review treated as information-sharing, not decision-making | Agenda explicitly requires top management to make decisions; actions recorded with SMART format |
| Actions from previous review not followed up | No action tracking system; responsibility diffuse | Owner-assigned action log; standing agenda item at every management review |
| Review not conducted at planned interval | Meeting scheduling deprioritised | Schedule 12 months ahead; treat as non-negotiable EMS requirement |
| No discussion of objectives that were not achieved | Review avoids difficult conversations | KPI dashboard must flag RAG status; missed targets must be agenda item |
Need ISO 14001 certification support?
Our ISO 14001 Certification service covers EMS design, internal audit, management review facilitation, and certification body coordination — from initial gap assessment to certificate award.
View ISO 14001 Service →FAQs
What does ISO 14001 clause 9.3 require?
Clause 9.3 requires top management to review the EMS at planned intervals to ensure continuing suitability, adequacy, and effectiveness. The review must consider specific mandatory inputs and produce documented outputs including decisions and actions. The standard does not specify a minimum frequency — this is defined by the organisation.
What are the required inputs to the ISO 14001 management review?
Mandatory inputs: (a) status of previous actions; (b) changes in external/internal issues; (c) environmental performance including nonconformities, monitoring results, audit results, and compliance obligations fulfilment; (d) adequacy of resources; (e) communications from interested parties; (f) opportunities for continual improvement.
What must the ISO 14001 management review outputs include?
Outputs must include decisions on: EMS suitability/adequacy/effectiveness conclusions, continual improvement opportunities, changes needed to the EMS including resources, and actions where objectives have not been achieved. All must be retained as documented information with owners and timelines.
What do auditors check in the ISO 14001 management review?
Auditors verify: all required inputs covered in minutes; top management attendance (not just EHS manager); specific actions with owners and timelines in outputs; previous actions closed or escalated; evidence that conclusions influenced EMS decisions. The commonest nonconformity is missing required inputs.