In the management review, top management checks at planned intervals whether the ISMS is suitable, adequate and effective. Varmo compiles the inputs from your current data, so that management can see at a glance where action is needed. This guide is aimed at ISMS managers who prepare the review and at top management.

Before you start

  • People with the permission to manage management reviews may plan and prepare them; by default, these are the ISMS managers. By default, top management and “Internal audit & review (read only)” may also read them.
  • According to ISO/IEC 27001 (9.3), a member of top management takes the Chair. Varmo offers all members for selection and does not check whether the person belongs to top management, so choose deliberately. The chair sees their review even without any further permission.
  • The more completely risks, measures, audits, findings, objectives, internal controls and incidents are maintained, the more meaningful the inputs are.
  1. PlannersPlan

    Title, date, chair and distribution list.

  2. PlannersCompile inputs

    Varmo freezes the current state.

  3. Distribution list with “provides input”Give feedback

    Each person for themselves.

  4. Record decisions

    In the meeting, with a measure if required.

  5. ChairComplete

    Date of the meeting, conclusion and assessment of resources.

Completing blocked

As long as the inputs have not been compiled, feedback is missing, or the date, conclusion or assessment of resources is missing.

Decisions as measures

With “Create measure”, a decision becomes a measure, even after completion.

The path of a management review

Five steps: the planners plan the review with date, chair and distribution list and compile the inputs; Varmo freezes the current state. People on the distribution list who provide input give their feedback. Decisions are recorded in the meeting. The chair completes the review with the date of the meeting, conclusion and assessment of resources. Completing is blocked as long as any of these is missing. Measures arise from decisions, even after completion.

Planning a management review

  1. Open Management review and click Plan management review.
  2. Enter a title and date and choose the Chair (top management). The chair is not yet required when planning; if it is missing, the planners receive the task “Assign chair and prepare”.
  3. Define the Distribution list: people from your members. Anyone who should give feedback gets the provides input tick; the other people on the distribution list only read along. Under Other participants (without an account), you name people without access, e.g. an external consultant.
  4. Save. You can adjust the planning later with Change planning.

Preparing

  1. 30 days before the date, the planners receive a task for the preparation.
  2. Click Compile inputs. Varmo freezes the current state: decisions of the last review with the status of their measures, findings, audits, internal controls, objectives, risks per level, measures, incidents, exceptions, scope, Statement of Applicability, training and acknowledgements. The period runs from the last meeting, otherwise over the last 12 months. With Compile again, you fetch the current state later.
  3. Fill in the Additional inputs as text, for example changes in issues and interested parties, feedback and opportunities for improvement.
  4. People on the distribution list who provide input give their view with Give feedback. They can adjust it until completion.

Reading the review

The review page shows management:

  • At a glance: a traffic light per topic (OK, Monitor, Action needed) with one sentence on it.
  • What management should pay attention to: what needs to be done, why, who is responsible and by when, for example open nonconformities with their cause.
  • Detailed report: all metrics and details expanded. With Print / PDF, you get a version for the meeting.

Conducting and completing

  1. In the meeting, record the decisions with Record decision. With Create measure, a decision becomes a measure with a task for the responsible person; this is also possible after completion.
  2. The chair chooses Complete management review and enters the date of the meeting, the Conclusion and the Assessment of resources: are people, time, budget and tools sufficient for the ISMS?
  3. After that, the conclusion and decisions can no longer be changed.

If a planned review does not take place, cancel it with a justification.

What happens next

  • Once the review has been prepared, the chair receives a task in My tasks to complete it. People on the distribution list who provide input receive the task “Give feedback on the management review”.
  • The next review shows, under the inputs, the status of the decisions and of the measures that arose from them.
  • If no new review has been planned ten months after a review, the planners receive the task to plan the next one. At least one review per year is customary.

Frequently asked questions

Why doesn't the review show the latest figures?

The inputs are frozen when they are compiled, so that management decides on a fixed state. Choose Compile again as long as the review has not been completed.

Who can give feedback?

Only people on the distribution list with the provides input tick, and each only for themselves.

How are incidents and audits connected to the review?

Closed incidents, reports to authorities, audits and findings are included automatically. See Reporting and handling incidents and Handling internal audits and findings.