ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
An ISO 13485 management review is the formal meeting where top management checks whether the quality management system is suitable, adequate and effective, and decides what changes and resources it needs. Clause 5.6 sets the rules, and it is one of the first records a certification auditor requests.
This guide lists every required input and output, offers a workable agenda and shows what good minutes look like. It also explains how the review connects to internal audits and CAPA.
Free gap assessment
How much of ISO 13485 could you evidence today?
Score clauses 4 to 8, free, with the FDA QMSR and EU MDR duties kept separate so you can see what is the standard and what is the regulator.
Run the free ISO 13485 gap assessment → or View premium report sample
Clause 5.6.1 says the organization must document procedures for management review and hold it at documented planned intervals. The purpose is to confirm the QMS stays suitable, adequate and effective.
The review must assess opportunities for improvement and the need for changes to the system, including the quality policy and quality objectives. Records of the review must be maintained.
Read the exact text in the ISO 13485:2016 page on iso.org and mirror its structure in your procedure so the auditor can map one to the other.
The standard places the duty on top management, meaning the person or group that directs and controls the organization at the highest level. In a startup that is usually the CEO, the head of quality and the heads of engineering and operations.
An auditor will look at who signed the minutes. If a quality assistant ran the meeting alone and top management never appears, expect a finding against clause 5.1 on management commitment.
Invite regulatory affairs, production and the person responsible for complaints so decisions get made in the room.
The standard says documented planned intervals and does not set a number. Most companies hold the review at least once a year, and many choose twice a year while the system is new.
Set the interval in the procedure, then keep to it. A missed review is easy for an auditor to prove from the dates, and it cannot be fixed retroactively.
Before your first certification audit, hold at least one full review that covers every input listed below, using real data from the system. Keep this in mind for every ISO 13485 management review.
Clause 5.6.2 lists the inputs: feedback; complaint handling; reporting to regulatory authorities; audits; monitoring and measurement of processes; monitoring and measurement of product; corrective action; preventive action; follow-up from earlier reviews; changes that could affect the QMS; recommendations for improvement; and new or revised regulatory requirements.
Treat that list as a checklist for your slide deck. Each input gets a short data page, a trend and a comment on what it means for the system.
Where an input has no data, say so. Writing none this period is acceptable; leaving the item out is a gap.
Raw spreadsheets do not make a good management review. Summarize each input into one chart or table with the period, the count, the trend and the top three issues.
For complaints, show volume by device family and the number that led to CAPA or regulatory reports. For audits, show findings by grade and overdue actions.
For process monitoring, show yield, rejects or inspection results against targets. Link each page to the owning procedure so reviewers can ask for detail. This is where a ISO 13485 management review is won or lost.
| Clause 5.6.2 input | Typical data source | What to show |
|---|---|---|
| Feedback and complaints | Complaint log | Volume, trend, top causes |
| Regulatory reporting | Vigilance and MDR records | Reports filed and deadlines met |
| Audits | Internal and external reports | Findings by grade, overdue actions |
| Process and product monitoring | Inspection and yield data | Results against targets |
| CAPA and follow-up | CAPA log, prior minutes | Open items, effectiveness checks |
| Regulatory changes | Regulatory watch | Impact and response |
Clause 5.6.3 requires that the output records include decisions and actions on improvements needed to maintain suitability, adequacy and effectiveness of the QMS and its processes.
It also covers improvement of product related to customer requirements, changes needed to respond to new or revised regulatory requirements, and resource needs.
Write each output as an action with an owner and a due date. A minute that says discussed with no decision is a weak record.
Open with the quality policy and objectives, then walk through the twelve inputs in the order listed in your procedure. Spend the most time on complaints, audit results and regulatory changes.
Close with decisions on each of the four outputs, and read the action list back before the meeting ends. Ninety minutes is realistic for a small company.
Circulate the data pack three days ahead so the meeting is for decisions, not for reading slides aloud. Auditors judge your ISO 13485 management review on exactly this point.
Good minutes show date, attendees with roles, the inputs reviewed, the key observations, decisions and an action table. They are signed or approved electronically by top management.
Attach or reference the data pack, so a future auditor sees what the participants saw. Keep the pack under document control.
Avoid copying last year’s minutes. Auditors notice identical wording and wonder whether the review happened at all.
Management review is where the system closes its loop. Findings from audits feed it, decisions from it create CAPAs and objectives, and objectives feed next year’s audit programme.
Follow up open actions at the next review, which is itself a required input. A tidy action log shows the system working.
For the corrective action side, see our ISO 13485 CAPA guide. Treat it as a standing rule for your ISO 13485 management review.
Typical errors include missing inputs, no data, no actions, and top management absent. Another is holding the review immediately before the audit and filling it with last-minute numbers.
A third mistake is treating the meeting as a status update. A real ISO 13485 management review ends with resource decisions that someone could be held to later.
Do not forget regulatory changes. If a standard or rule changed, the minutes should say how you responded.
The FDA Quality Management System Regulation, effective 2 February 2026, incorporates ISO 13485:2016, so clause 5.6 now underpins US expectations too. See QMSR management review for the regulatory view.
The practical change is documentation discipline. Your minutes may be read by an FDA investigator as well as a certification body.
Our QMSR vs ISO 13485 comparison lists the remaining differences.
New or revised regulatory requirements are an explicit input. Track the EU MDR timeline, FDA guidance and any other market you sell in, then record what each change means for you.
The EU MDR transition deadlines guide is a good source for the European side.
If a change needs a procedure update, create the action in the review and link it to document control.
You do not need a formal boardroom event. A one-page agenda, a data pack of ten slides and a signed minute sheet are enough if the content is complete.
Combine the review with the quarterly leadership meeting only if the inputs and outputs are visibly separate in the record. Auditors should find them without hunting.
The ISO 13485 Toolkit includes a management review procedure, agenda and minutes form aligned to clause 5.6.
A full cycle of audits and a management review are expected before the stage 2 assessment. The certification timeline shows where this fits.
If you are still deciding whether to certify, read is ISO 13485 worth it first.
Document the review properly once, and every later one becomes a short update rather than a project.
Assign one owner per input two weeks before the meeting. The complaints owner pulls the log, the quality lead pulls audit and CAPA status, and operations pulls yield and inspection data.
Use a fixed template with the same headings each cycle. Trends become visible quickly, and preparation shrinks from days to hours once the format is stable.
Review the pack once for consistency. Numbers quoted on the complaints page should match those in the CAPA page, or the first question in the meeting will be about the data.
Track how many actions from each review closed on time and how many were repeated at the next meeting. Repeats mean decisions were vague or nobody owned them.
Look also at whether resource decisions were honored. If you approved a validation engineer in March and nothing happened by September, say so in the next minutes.
Over time, this record is the best proof that leadership is committed to the quality system, which is exactly what clause 5.1 asks you to show.
Quality objectives must be measurable and consistent with the quality policy. The management review is the natural place to set, revise and retire them.
Pick a small number, for example complaint response time, first-pass yield or on-time CAPA closure. Record the target, the baseline and the owner.
At the next review, show the result against each objective. Objectives that never change suggest nobody is steering the system.
The standard requires planned intervals but does not fix them. Annual is the most common minimum, and your procedure must state the interval you choose.
No. The review belongs to top management, so they must attend and approve the outputs, even if quality prepares the data.
The minutes with inputs reviewed, decisions and actions, plus the data pack or a reference to it.
Yes, the standard does not require a physical meeting. Record attendance and decisions the same way.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026