# Clause 9.3.2: Management review input

The review must take into account: where actions from earlier reviews stand; changes in the internal and external issues that matter to the BCMS; information on BCMS performance, including trends in nonconformities and corrective actions, results of monitoring and measurement, and audit results; feedback from interested parties; whether changes are needed, to policy and objectives among others, and which procedures and resources could lift performance and effectiveness; what the impact analysis and the risk assessment show; the result of evaluating continuity documentation and capabilities; risks or issues that no earlier risk assessment dealt with properly; lessons and actions coming out of disruptions and near misses; and chances for continual improvement.

Cloud: Inputs should include the provider's own incident history, the results of your restore tests and any change in the provider's ownership or service catalogue. A provider acquisition can change your continuity position overnight.

Evidence: Review pack demonstrably covering every required input; Trend data rather than point in time figures for nonconformities, measurement and audits; Near miss and disruption lessons presented with the actions arising; Interested party feedback captured and presented; Evidence that previously unaddressed risks were surfaced rather than dropped.

Test: Verify the review inputs include provider ownership and service catalogue changes.

Citation: ISO 22301:2019, clause 9.3.2. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.