# Clause 9.3: Management review

Top management must review the BCMS on a planned basis against a defined set of inputs, and must record and act on the decisions the review produces.

Cloud: Management review is where provider risk gets funded or ignored. Put the provider incidents, the failed tests and the expiring contracts in front of the review, not only the internal metrics.

Evidence: Scheduled review with attendance evidencing top management; Inputs presented and outputs recorded; Actions arising tracked to closure.

Test: Confirm the last management review saw provider incidents and test results.

Citation: ISO 22301:2019, clause 9.3. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.