When I ask about the management review in an audit, I can usually tell the answer from the tone of voice before I see the documents. There are two versions. One sounds like a meeting in which something was decided. The other sounds like minutes that were written two days before the audit.
The difference is almost never down to the insight of the management. It is down to the effort: anyone who first has to gather the figures for a proper review from five different sources arrives at the meeting unprepared. This is exactly where AI genuinely helps — and only here. What it does not take over is just as important.
“The management review is the moment when management takes its system in hand — or leaves it to the auditor. AI makes the former easier, it does not make the latter legitimate.” – Thomas Werner, CCO Eucerta AG and Lead Auditor
What the standard actually requires
It is worth reading this carefully, because many companies document more than necessary and leave out the most important part. The management system standards require top management to review the system at planned intervals in order to ensure its adequacy, suitability and effectiveness.
There is a list of inputs for this. It includes the status of actions from previous reviews, changes in external and internal issues, the performance of the system based on key figures, results of internal and external audits, feedback from customers and interested parties, nonconformities and corrective actions, the adequacy of resources, and the effectiveness of actions taken to address risks and opportunities.
And the standard requires an output: decisions. On opportunities for improvement, on changes to the system, on resources. Not the statement that a meeting took place.
A current point I raise in every audit: the revised ISO 9001:2026 was published on 16 September 2026 and puts greater emphasis on effectiveness, quality culture and the link to strategic direction. ISO 19011:2026, the guideline for conducting audits, also stresses the actual effectiveness of a system more clearly than before, rather than the mere existence of processes. A management review without real decisions is therefore not only weak in substance but also conspicuous from an audit perspective.
The three mistakes I see most often
The first is the missing data basis. A review without key figures is a discussion about impressions. Anyone who does not know how many nonconformities arose during the year, in which processes and with what trend, cannot decide about resources — only talk about them.
The second is the missing thread between two reviews. If actions from the previous year were not systematically tracked anywhere, every review starts from scratch. The auditor then finds half-finished construction sites, and the review loses its function as a control loop.
The third is the wrong group of participants. The standard says top management. If the review is prepared and signed by the quality manager alone, it formally exists and is worthless in substance. That is the finding most discussed in small companies — and the one that is easiest to avoid.
Where AI makes the difference
Put soberly: AI helps with preparation and follow-up, not with the review itself. That is not a limitation, it is precisely the part that fails in practice.
- The data basis comes out of the system, not out of hearsay. Audit results, nonconformities, document status, open tasks and feedback are already in the platform and are consolidated into a template along the normative inputs.
- Patterns become visible. Recurring nonconformities in one process, a supplier that comes up repeatedly, a group of documents that is chronically overdue: such clusters are harder to spot in a list than in an analysis.
- Actions survive the minutes. Decisions are recorded with a responsible person and a deadline and appear in the next review as a status line. This creates the thread that the second mistake is all about.
- The documentation follows the structure of the standard. The report contains the required inputs and the decisions taken, so that no one has to hunt for annexes during the audit.
In an integrated system this applies to all standards at once: one meeting, one data basis, one report. How this is set up is described on the Integrated Management System page.
What management has to do itself
This is where I draw a clear line as an auditor. Reviewing means deciding, and decisions cannot be delegated — not even to a tool. An AI-generated draft text claiming that the system is adequate and effective is not evidence. It is a form of words.
Three things have to come from people. First, the judgement as to whether the figures presented describe the company correctly — key figures can be measured incorrectly, and only someone who knows the business will see that. Second, prioritisation: which two topics will we really work on next year, and which not? A review that decides on fifteen actions has decided nothing. Third, the commitment of resources, because without it every action is a declaration of intent.
What I recommend to managing directors is banal and it works: with proper preparation, the review takes one to two hours. Set a fixed annual date, and do not schedule it immediately before the audit but well in advance. Then the review is a steering meeting with lead time and not the dress rehearsal for the auditor.
Conclusion
The management review is the only point in the management system at which management is obliged to take a close look. If this meeting is well prepared, it delivers more than any other element: an honest picture of the situation, a few clear decisions, comprehensible priorities.
AI shifts exactly what has prevented this meeting from working so far — the collecting work beforehand and the forgetting afterwards. The review itself remains the work of the people who run the company. That is exactly how it should be.
Your next step: Use the cost calculator to work out what a system costs in which review and follow-up run alongside, or check via Express Certification how far your system already is.
Further reading:
