Internal Audit Management Review: Purpose, Agenda, Checklist, and Template

Unsplash

Internal audit results often stop at the report. Findings are recorded and recommendations are drafted, but the corrective decisions are never discussed at the leadership level.

The internal audit management review closes that gap. This forum brings audit results in front of top management so every finding turns into a clear decision, resource commitment, and improvement target.

This article covers what an internal audit management review is, the standards behind it, the mandatory inputs, the meeting agenda, a checklist, a minutes template, and the mistakes that come up most often.

What Is an Internal Audit Management Review?

An internal audit management review is a periodic review meeting led by top management to evaluate internal audit results, the follow-up status of findings, and the performance of the management system as a whole.

The forum is the meeting point between the internal audit function and decision makers. Auditors present the evidence, while management decides on improvement priorities, resource allocation, and completion targets.

In practice the term is used in two contexts. First, management's review of internal audit results as part of the quality management system. Second, the review by management or the audit committee of the performance of the internal audit function itself.

The Difference Between a Management Review and an Internal Audit

An internal audit is an examination activity that produces evidence and findings. A management review is a decision-making activity that uses that evidence as one of its inputs.

An internal audit is carried out by auditors who are independent of the area being examined. A management review is chaired directly by top management and attended by process owners with the authority to make decisions.

The two depend on each other. Without an internal audit, the management review lacks objective data. Without a management review, internal audit results never reach a strategic decision.

The Standards Behind It: ISO 9001 Clause 9.3 and ISO 19011

ISO 9001:2015 clause 9.3 requires top management to review the quality management system at planned intervals. Clause 9.3.2 explicitly lists audit results as one of the inputs that must be considered.

Similar requirements apply in other management system standards that use the high-level structure, such as ISO 14001, ISO 45001, ISO 27001, and ISO 37001. Clause 9.3 in each of those standards asks for internal audit results to be placed on the management review agenda.

ISO 19011 completes the picture from the auditor's side. The guideline governs how an audit programme is managed, including how audit results are reported so that management can use them in decision making. A fuller explanation of the audit criteria and checklist is in the article ISO 9001 Audit: Objectives, Criteria, Checklist, and Sample Findings.

Purpose of an Internal Audit Management Review

An internal audit management review serves the following purposes:

• Making sure findings are acted on. Every finding gets an owner, a deadline, and resources approved by leadership.
• Assessing the effectiveness of the management system. A pattern of recurring findings points to a weakness in the system, not just an individual error.
• Aligning the audit with business objectives. Management can steer the next audit's focus toward the areas that carry the most risk.
• Assessing the adequacy of audit resources. The number of auditors, their competence, and their tools are evaluated against the audit coverage required.
• Meeting certification requirements. Management review records are among the documents external auditors examine during certification or surveillance audits.

Inputs That Must Be Covered in a Management Review

Referring to ISO 9001 clause 9.3.2, a management review must consider the following inputs:

• The status of actions from the previous management review.
• Changes in internal and external issues relevant to the management system.
• Internal and external audit results, including the number of findings, their categories, and their closure status.
• Customer satisfaction and feedback from interested parties.
• Achievement of quality objectives and process performance.
• Nonconformities and corrective actions.
• Monitoring and measurement results.
• The performance of external providers.
• The adequacy of resources.
• The effectiveness of actions taken to address risks and opportunities.
• Opportunities for improvement.

Of that list, internal audit results are usually the part discussed most. That makes the quality of the audit report decisive for the quality of the meeting. The standards for preparing one are covered in the article Quality Standards for Internal Audit Reports and Their Key Components.

Internal Audit Management Review Meeting Agenda

The following agenda can serve as the framework for a meeting of roughly two to three hours:

1. Opening and meeting objectives — The chair confirms the scope of the review and the period under discussion.
2. Follow-up from the previous meeting — Each earlier decision is checked for status: completed, in progress, or overdue.
3. Audit programme summary — The head of internal audit presents audits completed against the annual plan.
4. Key findings and trends — Findings are grouped by area, risk level, and root cause.
5. Corrective action status — Findings past their deadline are discussed one by one along with the obstacles.
6. Adequacy of audit resources — Auditor, training, and tooling needs are proposed for the next period.
7. Decisions and assignments — Every decision is recorded with an owner and a deadline.
8. Conclusion — The date of the next management review is set.

Internal Audit Management Review Checklist

This checklist helps make sure the meeting satisfies the standard's requirements while producing decisions that can actually be executed.

Before the Meeting

• The meeting date is set and invitations go out at least two weeks in advance.
• The audit reports for the current period are final and approved.
• A findings summary is compiled by category, risk level, and status.
• The status of every decision from the previous management review is updated.
• The materials are shared with participants before the meeting.

During the Meeting

• Top management attends and chairs the meeting.
• Every input under clause 9.3.2 is discussed, not just the audit results.
• Every high-risk finding gets a clear decision.
• Every decision has an owner and a deadline.
• Resource requests are explicitly approved or rejected.

After the Meeting

• Minutes are distributed no later than five working days after the meeting.
• Decisions are entered into the follow-up tracking system.
• Changes to the audit plan are updated in the annual audit programme.
• Meeting records are archived for external audit purposes.

Management Review Outputs and Their Follow-Up

ISO 9001 clause 9.3.3 states that management review outputs must include decisions on opportunities for improvement, any need for changes to the management system, and resource needs.

A good output is written as an action, not a general statement. “Improve warehouse compliance” is not an executable output. “Draft a new goods receipt SOP, owner: warehouse manager, due in 30 days” is an output that can be tracked.

Each output then enters the same follow-up mechanism as audit findings. Its completion status becomes an input to the next management review, which closes the loop.

Internal Audit Management Review Minutes Template

The template below can be copied and adapted to the organization's needs:

Section	What to Record
Meeting identity	Date, venue, review period, chair, attendance list.
Follow-up from the previous meeting	List of earlier decisions with their status: completed, in progress, overdue.
Audit programme delivery	Number of audits planned, completed, and postponed, with reasons.
Findings summary	Number of findings per category, high-risk findings, and recurring findings.
Corrective action status	Number completed, in progress, and overdue, with the main obstacles.
Other clause 9.3.2 inputs	Customer satisfaction, quality objectives, supplier performance, risks and opportunities.
Decisions	Description of the action, owner, deadline, and approved resources.
Changes to the audit plan	New areas to be audited or changes in audit frequency.
Next meeting	Date of the next management review.

Decision numbering should be consistent with audit finding numbering. That way a single decision can be traced back to the finding that triggered it.

Common Mistakes

• The meeting is a certification formality. The management review is held once a year just before the external audit, so its decisions are never tracked.
• Top management sends a delegate. Without the decision makers in the room, the meeting produces notes, not actions.
• Only audit results are discussed. Other inputs such as customer satisfaction, supplier performance, and risks are missed, so clause 9.3.2 is not met.
• Decisions without an owner. The minutes contain general conclusions with no names or clear deadlines.
• Findings data compiled by hand. Summaries pulled from various spreadsheets take time and are often inconsistent with the original audit reports.

The Role of Internal Audit Software in a Management Review

Most of the preparation time for a management review goes into compiling findings and follow-up status. Internal audit software cuts that work because all audit data already lives in one system.

A findings dashboard shows the number of findings per category, overdue findings, and trends between periods. That data can be used as meeting material directly, without re-compiling.

Management review decisions can also be recorded as tracked actions in the same system. That way the status of each decision is automatically available as an input for the next meeting. An overview of how an audit runs from planning through follow-up is covered in the article Audit Process: Definition, Stages, and Success Tips.

FAQ About the Internal Audit Management Review

What is an internal audit management review?

An internal audit management review is a periodic review meeting led by top management to evaluate internal audit results, the follow-up status of findings, and management system performance, and then decide on corrective actions and resource needs.

How often should a management review be held?

ISO 9001 only requires planned intervals. Common practice is once or twice a year, but organizations with many high-risk findings usually hold one every quarter.

Who must attend a management review?

Top management as chair, the head of internal audit or the quality management representative as presenter, and the process owners with the authority to make decisions about the audited areas.

What is the difference between a management review and an internal audit?

An internal audit produces evidence and findings through an independent examination. A management review uses that evidence as an input for decisions at the leadership level.

What outputs must a management review produce?

Under clause 9.3.3, the outputs cover decisions on opportunities for improvement, any need for changes to the management system, and resource needs, each with an owner and a deadline.

How does internal audit software help with a management review?

Internal audit software provides a findings summary, follow-up status, and trends between periods in one dashboard, so the meeting material is ready without manual compilation and the meeting's decisions can be tracked in the same system.

Conclusion

The internal audit management review is where audit results turn into decisions. An effective meeting needs tidy findings data, the presence of decision makers, and a tracking mechanism that closes the improvement loop.

With Audithink, audit findings, follow-up status, and management review decisions are managed on one platform, so meeting material is always ready and every decision can be tracked to completion.

See how Audithink prepares your management review data through the demo Audithink.