Every certified ISMS holds a management review — leadership convening to examine the programme's performance and decide what changes. In many organizations it is scheduled, minuted and closed inside thirty minutes, because the meeting was never expected to produce a decision in the first place.How the Meeting Loses Its PurposeThe standard's own agenda items — audit results, nonconformities, risk treatment status, resourcing — are genuinely the right things to review. What goes wrong is usually the inputs: a status deck prepared to confirm the programme is on track, presented to an audience with no independent view of whether that is true, discussed for exactly as long as it takes to read the slides.What Turns Status Into GovernanceAt least one item leadership did not already know: if every review confirms what everyone expected, the review is not surfacing anything the rest of the programme would benefit from catching earlier.A resourcing question actually on the table: not just a report that resourcing is 'adequate,' but an honest look at whether the current level explains a recurring gap.Risk acceptance decisions made in the room, not rubber-stamped beforehand: a risk sitting above appetite should produce a visible decision, not a quiet continuation of the status quo.An action from the last review checked against what actually happened: a management review with no memory of its own previous decisions is not accumulating oversight, it is repeating a ritual.“A management review that never changes a decision is not evidence of a well-run programme. It is evidence that nobody expects the meeting to matter.”Making It Worth Leadership's TimeThe fix is rarely a longer meeting — it is a sharper one, built around the handful of questions leadership is uniquely positioned to answer: is this risk still acceptable, is this function resourced enough to do what we are asking of it, and what changed since we last looked. A review built around those questions produces a decision. A review built around a status update produces minutes.Share this articleX (Twitter)LinkedInFacebookCopy Link
ISMSJul 31, 2026An ISMS Is a System, Not a BinderISO 27001 certifies an information security management system — an operating system for decisions, not the folder of policies produced to pass the audit that certifies it.
ComplianceJun 19, 2026Why Framework Mapping Beats Framework ChasingTreating each new regulatory framework as its own project produces duplicated evidence, duplicated policies and a compliance team that never catches up.
TPRMAug 14, 2026The Vendor Questionnaire Nobody Reads TwiceA security questionnaire completed once at onboarding and never revisited tells you what a vendor's environment looked like on one day — usually not the day that matters.
