Management review under ISO 13485: inputs, outputs and an agenda
How to run a management review that meets ISO 13485 clause 5.6: the twelve required inputs, the four outputs, frequency, attendees, minutes, and how EU GMP Chapter 1 and ICH Q10 compare.
The management review is usually the one quality meeting the managing director attends, and too often it runs as a slide deck. Forty charts go past, the minutes record that the quality system was "reviewed and found effective", and a year later the notified body auditor asks what was decided and how each decision was followed up. This article sets out what ISO 13485:2016 clause 5.6 requires, a meeting agenda built on the required inputs, how often to meet and who should attend, how to turn data into decisions, what the record must show, and how EU GMP Chapter 1 and ICH Q10 compare if you also make medicines.
What ISO 13485 clause 5.6 requires
Clause 5.6.1 asks for a documented procedure. Top management reviews the quality management system at documented planned intervals to make sure it remains suitable, adequate and effective, assesses opportunities for improvement and the need for changes, including to the quality policy and quality objectives, and keeps records under clause 4.2.5. The full text is available from ISO's page for ISO 13485:2016.
Three phrases decide most audit findings. "Top management" means the people who direct and control the organisation, so a review chaired by the quality manager with nobody from the board present is hard to defend. "Documented planned intervals" means the frequency is written in your procedure, and a review that slips by four months is a nonconformity against it. "Including the quality policy and quality objectives" means asking whether the objectives still make sense, as well as whether you hit them.
Management review inputs under clause 5.6.2
Clause 5.6.2 lists twelve inputs and says the review "shall include, but is not limited to" them. Every one has to appear, even if the honest entry is "no new regulatory requirements this period". The table shows where the data usually comes from in a small manufacturer.
| Input (5.6.2) | Typical source |
|---|---|
| a) Feedback | Post-market surveillance data, customer and distributor feedback |
| b) Complaint handling | Complaint log, trend by failure mode, time to assess reportability |
| c) Reporting to regulatory authorities | Vigilance reports, field safety corrective actions |
| d) Audits | Internal, notified body, customer and supplier audits |
| e) Monitoring and measurement of processes | Process KPIs, quality objectives, deviation data |
| f) Monitoring and measurement of product | Inspection results, nonconforming product, release data |
| g) Corrective action | CAPA status, overdue actions, effectiveness outcomes |
| h) Preventive action | Trend-driven actions, fixes extended to other lines |
| i) Follow-up actions from previous management reviews | Last review's action log |
| j) Changes that could affect the QMS | New products, sites, key suppliers, organisational changes |
| k) Recommendations for improvement | Process owners, audit observations, staff suggestions |
| l) Applicable new or revised regulatory requirements | Standards updates, MDR and IVDR guidance, MHRA guidance |
Two inputs cause most of the trouble. Input i is where auditors start, because it shows whether the review drives anything. Input l is the one that gets a single line saying "none" in a period when a harmonised standard was revised. If your regulatory intelligence process keeps a log, bring the log. For inputs g and h, the review is a good moment to ask whether CAPAs are opened for the right reasons; our guide to CAPA under ISO 13485 clauses 8.5.2 and 8.5.3 covers what those records should show.
Management review outputs under clause 5.6.3
Clause 5.6.3 says the output shall be recorded and include the input reviewed and any decisions and actions related to four things: improvement needed to maintain the suitability, adequacy and effectiveness of the system and its processes; improvement of product related to customer requirements; changes needed to respond to new or revised regulatory requirements; and resource needs.
That list is a useful test for your minutes. If there is no entry under resource needs, either the business has exactly the people, equipment and budget it needs, which is rare, or the review avoided the subject. A decision not to act is still a decision and should carry its reason: "complaint rate for the catheter range is stable and within objective; no action" is a legitimate output. Each action needs an owner, a due date and, where it applies, a link to the CAPA, change control or supplier audit that will carry it. Actions that live only in the minutes tend to be rediscovered at the next review.
How often to hold a management review
The standard leaves the interval to you, provided it is documented. Many organisations hold a full review at least once a year. A small manufacturer with a fast-moving portfolio may get more from a quarterly review of the operational inputs (complaints, CAPA, deviations, audits) plus an annual review that also covers policy, objectives, resources and regulatory change. A rolling approach is acceptable if the procedure describes it and a simple matrix shows which meeting covered which input.
Build in a trigger for an unscheduled review. A recall, a field safety corrective action, the loss of a critical supplier or a major nonconformity from your notified body are events where waiting for the next planned meeting is hard to justify.
Who attends the management review
Top management has to be present and take part in the decisions. In a company of forty people that usually means the managing director and the heads of operations, engineering, commercial and quality. The management representative appointed under clause 5.5.2 normally prepares the pack. If you place devices on the EU market, your person responsible for regulatory compliance under MDR Article 15 should attend, since regulatory change and vigilance reporting are their territory. Process owners can present their own data, which tends to produce better answers to questions.
A management review meeting agenda that works
Circulate the pack a week ahead and use the meeting for decisions. An agenda that covers the clause in a sensible order:
- Actions from the previous review: status and evidence they worked (input i).
- Quality objectives: performance, and whether each objective still fits the business.
- Customer and market: feedback, complaints and regulatory reporting (inputs a, b, c).
- Product and process performance, nonconforming product and deviations (inputs e, f).
- Internal, external and supplier audit results (input d).
- CAPA status, overdue actions, effectiveness and preventive actions (inputs g, h).
- Changes and new or revised regulatory requirements (inputs j, l).
- Recommendations for improvement (input k).
- Decisions under the four output headings, each with an owner and date.
- Conclusion on suitability, adequacy and effectiveness, and any change to the quality policy.
Putting previous actions first signals that the review is accountable for what it decided last time. Giving decisions their own slot stops them getting lost in discussion.
Turning management review data into decisions
Every page of the pack should end with a short statement: what the data shows, how it compares with the objective or the previous period, and what the presenter proposes.
Take a realistic example. Complaints about a luer connector loosening have risen over three quarters. Incoming inspection rejected two lots from the same moulding supplier, and an internal audit noted that the supplier's change notification clause is missing from the quality agreement. Shown as three charts in three sections, nobody connects them. Shown together, the decision writes itself: open a CAPA on the connector, schedule a supplier audit, revise the quality agreement, and approve the inspector time to tighten incoming checks while the CAPA runs. That one item covers three of the four required outputs.
Report by exception. A metric that is stable and inside its target needs one line; meeting time belongs to what is moving, overdue or surprising. When a previous action has been closed, ask what evidence shows it worked; the approach in our article on checking CAPA effectiveness applies equally to review actions. Treat audit results the same way: one finding is information, the same finding in three areas across a year is a system problem. If your internal audit programme tracks findings by clause or process, bring that view.
Recording the management review
Write the minutes for an auditor who was not in the room. They should contain the date, attendees and roles, a reference to the version of the input pack, the conclusion drawn on each input, every decision and action under the four output headings with owner and due date, the conclusion on suitability, adequacy and effectiveness, and any change to the policy or objectives. Top management approves them and they are controlled as a quality record. Keep the action log live between reviews: auditors often pick one action from two reviews ago and trace it to closure.
How EU GMP Chapter 1 and ICH Q10 management review compare
Medicines manufacturers work from EU GMP Chapter 1, Pharmaceutical Quality System, revised to align with ICH Q10 and in operation since 31 January 2013. Paragraph 1.5 gives senior management ultimate responsibility for an effective quality system, and paragraph 1.6 asks for periodic management review, with senior management involved, of the operation of the pharmaceutical quality system to identify opportunities for continual improvement of products, processes and the system itself. Chapter 1 lists no inputs; for those it relies on ICH Q10.
ICH Q10 describes review at two levels. Section 3.2.4 covers process performance and product quality: inspection results, audits and commitments to regulators; periodic quality reviews such as complaints, recalls, process and product monitoring, and the effectiveness of changes including those from CAPA; and follow-up on previous reviews. Its outputs include process and product improvements, resources and training, and capture and dissemination of knowledge. Section 4.1 reviews the system itself, including quality objectives and performance indicators for the complaint, deviation, CAPA and change management processes, outsourced activities, self-assessment and external assessments. Section 4.2 adds external factors such as emerging regulations, and section 4.3 lists outcomes including revised policy and objectives and escalation to senior management.
The differences are small but useful. ISO 13485 gives a mandatory list every review must cover. ICH Q10 accepts that management review "can be a series of reviews at various levels of management" provided issues escalate, which suits a site with several product lines, and it names knowledge management and outsourced activities explicitly. The annual product quality review under Chapter 1 paragraph 1.10 is a separate product-level exercise whose conclusions feed the system review. A company holding both a manufacturing authorisation and ISO 13485 certification can run one review if the agenda covers both lists.
The takeaway
Build the agenda from the twelve inputs, open with last year's actions, and end every section with a proposed decision. When the minutes show decisions under all four output headings, each with an owner and date, and the next review starts by checking them, the clause is met and the meeting earns its place in the managing director's diary.
Assembling the pack is easier when deviations, CAPA, audit findings, training and controlled documents sit in one system instead of five spreadsheets, which is the job the InnoQualis eQMS platform is built for.
