ISO 45001 Management Review: How to Run a Meaningful Process (Not a Tick-Box)

You’ve scheduled your annual management review. Safety Manager has prepared the slides — incident statistics, audit findings, objectives status. The meeting happens. Everyone nods. Nothing changes.

This is not management review. This is compliance theatre.

Real management review under ISO 45001 Clause 9.3 is strategic decision-making. It’s where top management faces reality: What’s the actual state of OH&S in this organisation? What are we doing about it? What resources do we need to commit? What changes do we need to make to our system?

The difference between tick-box and genuine review is stark. One produces minutes. The other produces decisions and resources. One leaves everything unchanged. The other drives the organisation forward.

This article walks you through how to build a management review that auditors recognise as credible and that actually improves your OH&S system.

What Management Review Actually Is

Management review is the formal mechanism through which top management evaluates the adequacy, suitability, and effectiveness of your OH&S management system. It’s not a briefing. It’s not a presentation. It’s a deliberative process where strategic decisions are made.

The requirement is explicit: “Top management shall review your organisation’s OH&S management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness” (Clause 9.3.1).

Notice: top management. Not the Safety Manager. Not a committee. Top management — the CEO, the board, the executives accountable for business performance. The people who control resource allocation.

Why? Because OH&S is not a safety department function. It’s a business imperative. When the CEO isn’t actively reviewing OH&S performance and making resource decisions about it, the organisation implicitly signals that safety is delegated, not strategic. Workers notice. Auditors notice. Performance suffers.

The Required Inputs: What You Must Consider

Clause 9.3.2 specifies what must be considered in management review. This isn’t optional or flexible. Auditors will verify that you’ve included each of these inputs.

1. Status of Previous Management Review Actions

Have you done what you committed to do? This is accountability. If your last management review approved budget for new guarding on three machines, are those guards installed? If you committed to revising your hazard identification process, has that been done?

Organisations that don’t track previous actions are doomed to repeat themselves. Management review becomes a silo — each meeting makes commitments that nobody remembers by the next meeting.

Your minutes should track each action with an owner and a target date. When the next review happens, you review completion status first. Actions not completed get escalated — either resources are added to complete them, or you honestly acknowledge why they’ve been deprioritised.

2. Changes in External and Internal Context

What’s changed since the last review that affects OH&S?

External changes: New regulations? A competitor had a major incident in your industry? Customer requirements? Insurance premium changes? Supply chain disruptions affecting your hazard controls?

Internal changes: New facility? New product line? Significant staffing changes? Restructure? New equipment? Change in production volumes?

Changes create vulnerability. A new facility means new hazards. A product change means processes change, which means hazard controls might not be appropriate anymore. Staffing turnover means training needs. Without systematically reviewing context, you miss these inflection points.

3. OH&S Performance Information

This is where data matters. Present:

• Trends: Is your LTIFR improving? Worsening? Stable but at an unacceptable level? What about near-miss rates? Inspection compliance? How do you compare to industry benchmarks?
• Incidents and nonconformities: What happened? Were they one-offs or part of a pattern? What did investigation reveal?
• Audit findings: What did your internal auditors find? Any nonconformities? What patterns are emerging?
• Objectives progress: Are you on track to meet your OH&S objectives? What’s working? What’s not?

Present data honestly. If performance is deteriorating, say so. If you’re trending toward a missed objective, acknowledge it. The purpose of management review is not to make yourself look good; it’s to inform strategic decisions.

4. Adequacy of Resources and Competence

Can you effectively deliver OH&S with current resources? Is the Safety Manager adequate in experience, time allocation, and authority? Do your operational managers have the competence to manage hazards in their areas? Is training investment sufficient?

Organisations often discover at this point that they’re chronically under-resourced. If your Safety Manager spends 30% of time on OH&S and 70% on other duties, management review is where you acknowledge that formally and decide to either hire additional capacity or reduce other responsibilities.

5. Relevant Interested Party Feedback

This means worker consultation. What are your workers saying about safety? Are they engaged? Do they feel listened to? Have improvement suggestions emerged? Are there areas where they feel unheard?

Worker feedback is gold. They see hazards you miss. They understand barriers to safe work. They know whether your controls actually work in practice or whether they’re being bypassed. If you’re not systematically collecting and presenting worker feedback to management review, you’re flying blind.

Formal mechanisms: safety committee minutes, worker safety suggestions, results from workforce engagement surveys, feedback from safety representatives, anecdotal comments from managers about what they’re hearing on the floor.

6. Opportunities for Continual Improvement

Beyond responding to nonconformities, where could you improve? This might come from benchmarking (other organisations in your industry are doing this better), from regulatory changes (a new standard now exists), from technology (new incident reporting systems, AI-powered near-miss analysis), or from worker suggestions.

Improvement opportunities keep management review from becoming purely defensive. It shifts the conversation from “What did we do wrong?” to “How do we get better?” This is where strategic thinking happens.

Structuring the Meeting: Making It Work

Here’s a practical template for a management review meeting that works:

Pre-Meeting (2 weeks before)

Send an agenda to attendees. The agenda should list each input that will be discussed and how long each section will take. Circulate the data package — performance dashboards, audit findings summary, incident log. Give people time to digest before the meeting.

This prevents the meeting becoming a presentation where people see information for the first time and can’t think critically about it.

Opening (10 minutes)

CEO states the purpose: We’re here to evaluate whether our OH&S system is fit for purpose, and to make decisions about what needs to change. This isn’t a briefing; this is decision-making. We’re going to challenge ourselves.

Previous Actions (15 minutes)

Go through the list from the last management review. What’s completed? What’s not? For incomplete actions, what’s the barrier? Is it a resourcing problem? A priority problem? An execution problem? Make decisions: Do we complete this action? Do we reschedule it? Do we kill it (sometimes you commit to something that later doesn’t make sense)?

Context Changes (15 minutes)

Safety Manager presents external and internal changes that have occurred. For each material change, the group asks: Does this change our risk profile? Do our hazard controls still apply? Do we need to reassess anything?

Performance Data (25 minutes)

Present the dashboard. Walk through trends. Here’s where discussion happens: “Our LTIFR improved this quarter. Why? What drove that? Is it sustainable?” Or: “Our near-miss reporting dropped. Is that a good thing (fewer hazards) or a bad thing (people not reporting)?”

Don’t just present data. Interpret it. Ask questions. Engage in genuine analysis, not just description.

Audit and Incident Findings (15 minutes)

Summarise internal audit findings. Highlight themes. “Three audits found procedures not being followed. Is this a competence gap? A procedure that’s unrealistic? A leadership gap?” Summarise significant incidents. What did investigation find? What systemic issues emerged?

Objectives Progress (10 minutes)

Are you on track? Any objectives at risk? Any early wins? If an objective is failing, do we need to intervene, or is it still achievable?

Opportunities and Continual Improvement (10 minutes)

What could you do better? Pick one or two concrete improvements to pursue in the next period. Assign ownership. Get commitment.

Decisions and Actions (15 minutes)

Synthesise. What will we do differently? What resources do we need? What system changes are required? Who owns each action? When will it be done?

Document in the minutes as you go. Don’t wait until later to write up action items. While decisions are fresh, capture who owns what and when.

Closing (5 minutes)

CEO reiterates what was decided. Confirms that these actions have board/executive support. Sets expectation for follow-up at next review.

Total time: 2 hours. That’s enough to be thorough without becoming exhausting. Meetings longer than 2.5 hours lose momentum.

Required Outputs: What Must Come From Review

Clause 9.3.3 specifies what must come out of management review:

1. Decisions and Actions Related to Continual Improvement

You can’t leave the meeting saying “We’ll think about continual improvement.” You must decide on something specific. It might be: “Implement a worker safety suggestion scheme,” or “Revise our near-miss investigation process,” or “Benchmark our LTIFR against industry standards.”

2. Decisions and Actions to Address System Changes

Do you need to update your OH&S policy? Change your objectives? Revise how you structure your system? Make explicit decisions.

3. Resource Needs

If you’ve committed to new initiatives, you probably need resources. Approve them now. Don’t commit to an action and then struggle to fund it later. CFO is in the room — budget can be approved or deferred in the moment.

4. Changes to Your System

Will any changes be made to your processes, procedures, governance, or structure? Decide and document.

All outputs must be documented and communicated downward. Minutes alone aren’t enough. Management needs to tell the organisation: Here’s what we’ve decided. Here’s what’s changing. Here’s what we’re prioritising.

Frequency: How Often Should You Meet?

ISO 45001 doesn’t mandate frequency — it says “planned intervals.” But minimum annual is clearly implied, and that’s often insufficient.

For most organisations: quarterly is ideal. A quarterly cycle gives you four opportunities per year to review performance, make course corrections, and drive improvement. It keeps OH&S visible at board level. It allows you to act on emerging trends rather than waiting a year.

Minimum: annual. If you review only annually, you’re missing nine months of performance data before you can react. Trends are more pronounced. Problems compound.

Consider more frequent for high-hazard or crisis situations. If you’ve had a serious incident or if you’re undergoing major change, monthly or bimonthly reviews might be warranted temporarily.

The key: Whatever frequency you choose, be consistent. Monthly reviews that skip months are useless. Annual reviews that sometimes happen in October and sometimes in April lack consistency. Choose a schedule and keep it.

Common Failures in Management Review

Auditors see these failures repeatedly. Here’s how to avoid them:

Failure 1: No Minutes or Vague Minutes

Problem: “Management reviewed OH&S performance and agreed to continue improving.” This isn’t a minute. It’s vapour.

Fix: Minutes must capture: What was discussed. What data was presented. What was decided. Who is accountable for each action. What’s the target date? What resources are needed? Be specific enough that someone reading the minutes a year later understands what was decided and can verify whether it was done.

Failure 2: No Attendees with Decision-Making Authority

Problem: The Safety Manager conducts a management review with middle managers. They discuss concerns and make suggestions, but nobody in the room can approve budgets or override business decisions.

Fix: Top management attendance is not optional. The CEO, board members, CFO — the people who control resource allocation — must attend. If they don’t, the meeting isn’t a management review; it’s a stakeholder consultation.

Failure 3: No Previous Actions Tracking

Problem: Last year you committed to revising hazard identification. It was never done. At this year’s review, nobody remembers the commitment, so it’s not on the agenda.

Fix: Maintain a rolling list of management review actions. At each meeting, status every action from the previous meeting. Some will be completed. Some will be deferred (fine, but decide that deliberately). Some will be in progress (track completion). This creates accountability.

Failure 4: No Genuine Challenge or Discussion

Problem: Safety Manager presents. Everyone listens politely. No questions. No debate. Same conclusions as always.

Fix: Management review is supposed to be a thinking meeting, not a reporting meeting. The CEO should ask questions: “Why is our near-miss rate down? Is that good or bad?” Finance director: “If we’re spending less on training, is that affecting competence?” Board member: “That incident exposed a gap in our procedure. What are we doing about it system-wide?”

Failure 5: Actions Without Follow-Up

Problem: You approve an action at management review. Nothing happens. At the next review, nobody mentions it, so it’s silently forgotten.

Fix: Safety Manager sends action tracking to the executive team monthly — brief update on progress. If something is stalling, escalate. Between management reviews, some actions should be at 25%, 50%, 75% completion. At the next review, you review completion and decide on any obstacles.

Failure 6: No Communication Downward

Problem: Management review happens. Decisions are made. Wider organisation hears nothing. Workers don’t know what was decided.

Fix: After management review, communicate decisions and actions to the organisation. In a toolbox talk, email, or team meeting, say: “Here’s what we’ve decided to focus on this quarter. Here’s what’s changing. Here’s how it affects you.” This builds buy-in and shows that worker feedback was heard.

Documentation and Evidence

What auditors will look for:

• Minutes: Properly documented, specific, showing inputs discussed, decisions made, and actions with owners and dates.
• Attendance: Sign-in sheet showing top management present at each review.
• Data package: Evidence of the inputs considered — dashboards, audit reports, incident summary, worker feedback, context analysis.
• Action tracking: Proof that previous actions are being tracked and completed.
• Proof of impact: Can you show how management review decisions have led to actual system changes? A revised procedure? New training? Resource allocation?

Auditors will ask: “Walk me through how a management review finding led to a system change.” If you can’t show that path, your management review lacks credibility.

How Management Review Connects to the Larger System

Management review synthesises intelligence from multiple sources — monitoring (Clause 9.1), audit (Clause 9.2), worker consultation (Clause 4.3), incident investigation (Clause 10.2) — and converts that intelligence into strategic decisions.

Those decisions flow down into corrective action, continual improvement initiatives, policy and objective changes, and resource allocation.

Without effective management review, these sources of intelligence remain isolated. Audit findings don’t shape strategy. Worker feedback gets filed away. Performance data doesn’t drive action. Performance plateaus.

With effective management review, the system becomes coherent. Each data source informs decisions. Resources flow toward identified problems. The organisation learns and adapts.

Practical Checklist: Building Better Management Review

• Schedule management review meetings in advance (quarterly or annually, consistently)
• Send agenda and data package 2 weeks before the meeting
• Ensure top management (CEO, board, CFO) will attend
• Prepare all required inputs: previous actions status, context changes, performance data, audit findings, worker feedback, improvement opportunities
• Allocate adequate time (minimum 2 hours)
• During the meeting, prioritise discussion and decision-making over presentation
• Document minutes in real-time with specific actions, owners, and due dates
• Communicate outcomes to the organisation
• Track action completion between reviews
• At the next review, verify that all previous actions have been addressed

The Strategic Value of Better Management Review

Beyond audit compliance, better management review creates business value. When your CEO is genuinely engaged with OH&S data, strategic trade-offs are made consciously, not by accident. When resource decisions are driven by OH&S intelligence rather than squeaky-wheel politics, your system gets better funded. When actions are tracked and verified, things actually get done.

Organisations with strong management review practices have better OH&S outcomes, lower incident rates, better worker engagement, and lower insurance costs. It’s not magic. It’s just discipline applied to decision-making.

FAQ: Management Review in Practice