Quick answer: Clause 9.3 of ISO 45001:2018 requires top management to review the occupational health and safety management system at planned intervals to make sure it remains suitable, adequate and effective. The standard sets out the inputs the review must consider and the decisions it must produce, and requires the organisation to keep evidence of the results. It doesn't prescribe a frequency. Holding the review annually is common practice, not a requirement.
What the management review is for
The management review is where the people who run the business look at how the safety management system is performing and decide what to do about it. Internal audits, incident data, worker feedback and legal compliance checks all feed into it. Without a working management review, those activities produce information that nobody acts on.
Top management has to lead it
ISO 45001 defines top management as the person or group of people who direct and control the organisation at the highest level. Clause 9.3 says top management shall review the system, and clause 5.1 requires top management to demonstrate leadership and commitment, including taking overall responsibility and accountability for preventing work-related injury and ill health.
That means the review can't simply be handed to the safety manager. The safety team can gather the data, prepare the inputs and record the outcomes, but the decisions about resources, priorities and changes to the system must be made by the people with the authority to make them. Auditors look for evidence that top management took part and made those decisions.
The inputs clause 9.3 requires
In plain language, the review must consider:
- The status of actions from previous management reviews
- Changes in external and internal issues, the needs and expectations of interested parties, legal and other requirements, and risks and opportunities
- How far the OH&S policy and objectives have been met
- OH&S performance, including incidents, nonconformities and corrective actions, monitoring and measurement results, the results of evaluating legal compliance, audit results, consultation and participation of workers, and risks and opportunities
- Whether resources are adequate to maintain an effective system
- Relevant communications with interested parties
- Opportunities for continual improvement
Two of these are easy to underplay. The first is following up previous actions: if last year's review agreed to do something, this year's review should show whether it was done and whether it worked. The second is worker consultation and participation, which links clause 9.3 back to clause 5.4. In Queensland, this sits alongside the legal duty to consult workers on safety.
The decisions it must produce
Reviewing the inputs is only half the job. The outputs must include decisions on whether the system remains suitable, adequate and effective, opportunities for continual improvement, any changes needed to the system, resources needed, actions needed, opportunities to better integrate the system with other business processes, and any implications for the strategic direction of the business.
Top management must then communicate the relevant outputs to workers and, where they exist, workers' representatives.
What to record
The organisation must keep documented information as evidence of the results of the review. In practice, good records show:
- Who attended, including which members of top management
- That each required input was considered, with the data or report presented
- Each decision made, including any decisions about resources such as staffing, training, equipment or budget
- An owner and a due date for each action
- How and when the relevant outputs were communicated to workers
- Evidence that actions were followed up, closed and checked for effectiveness, carried into the next review
A practical agenda
Here is how the inputs might translate into an agenda, with the evidence to bring for each item:
| Previous actions | Action log from the last review, with status and evidence of completion and effectiveness |
|---|---|
| Context and requirements | Changes in the business, new clients or contracts, changes to WHS laws or codes of practice |
| Policy and objectives | Each OH&S objective with its target and the result achieved |
| Incidents and corrective action | Incident and near miss summary, investigation findings and status of corrective actions |
| Audits and compliance | Internal audit and certification audit results, and the latest evaluation of legal compliance |
| Worker participation | Safety committee or toolbox meeting outcomes and issues raised by workers |
| Resources | Staffing, training, equipment and budget gaps affecting safety, with decisions recorded |
| Decisions and actions | Each decision recorded with an owner, a due date and how effectiveness will be checked |
How often should you hold one?
ISO 45001 requires reviews at planned intervals and leaves the frequency to the organisation. Holding at least one full review a year, often timed before the surveillance audit, is common practice, but it isn't prescribed by the standard. A business going through significant change, or one that has had a serious incident, may need to review more often or bring part of the review forward.
Integrated reviews for ISO 9001, ISO 14001 and ISO 45001
If you hold more than one certification, a single integrated management review can save time and give leaders a fuller picture. Each standard has its own clause 9.3 with its own required inputs. ISO 9001, for example, includes inputs on customer satisfaction and the performance of external providers, and ISO 14001 includes environmental aspects and compliance obligations. An integrated agenda works as long as every standard's inputs and outputs are covered and the record shows that they were.
ISO 9001 and ISO 14001 both have new editions, and certified organisations are moving to them over transition periods. Check the management review requirements in the edition you are certified to. Our post on ISO 9001:2026 covers that update, and our comparison of ISO 9001, ISO 14001 and ISO 45001 explains how the three standards fit together.
Looking ahead to the revised standard
ISO 45001 is under revision. Certification bodies including DNV have reported that a draft of the revised standard was released in 2026, with publication currently expected in 2027, although timing may change. ISO 45001:2018 remains the certifiable edition until a new one is published, and a transition period is expected to follow. The management review is a sensible place to note the revision as a change in external issues and agree who will keep track of it.
Frequently asked questions
How often does an ISO 45001 management review need to happen?
ISO 45001 requires reviews at planned intervals but doesn't set a frequency. Annual reviews are common practice, often timed before the surveillance audit. Businesses going through significant change, or that have had serious incidents, may need to review more often.
Can our safety manager run the management review instead of top management?
The safety manager can prepare the inputs, present the data and record the outcomes, but clause 9.3 requires top management to review the system. If top management doesn't take part and make the decisions, the review is unlikely to meet the requirement.
Can we combine our ISO 45001 review with our ISO 9001 and ISO 14001 reviews?
Yes. An integrated review is common, provided the inputs and outputs required by each standard are covered and the record shows they were. Check the requirements in the edition of each standard you are certified to.
Sources: ISO 45001:2018, clauses 3.12, 5.1, 5.4 and 9.3; ISO 9001 and ISO 14001, clause 9.3; Work Health and Safety Act 2011 (Qld) s47; DNV, Draft version of ISO 45001 released (2026).
This article is general information, not legal advice. Last reviewed 6 November 2026.