Management Review and Year End: closing the QM year in two hours

15 modules · about 82 minutes · final test with 35 questions, 28 correct to pass · certificate of participation as PDF

What this course is about

Once a year ISO 9001 requires top management to review its QMS (9.3): with defined inputs – status of actions, context, customer satisfaction, objectives, process performance, nonconformities, KPIs, audits, suppliers, resources, risks, improvements – and defined outputs: decisions on improvements, changes and resources.

No registration needed. We only ask for your name and e-mail address before the final test – just for your certificate. Your progress is saved in this browser. You can stop at any time and continue later.

Module 1 of 15

What management reviews — and why 9.3 is not a meeting

The management review is the moment when the standard puts top management personally under obligation: it must review the QMS — not the quality manager, not the consultant. Four questions stand behind it (9.3.1): is the system still suitable (does it fit the company)? Adequate (not too much, not too little)? Effective (does it bring the results)? And aligned with what the company intends?

The standard prescribes the inputs and the outputs — that is why the review can be checked as a checklist, and that is why an incomplete one stands out immediately:

Report instead of meeting. The standard requires review and evidence — no meeting, no minutes with attendance list. In a small company MD and quality manager write the report in two hours; the MD signs. Anyone who adds a meeting with the team (20 minutes: results and new objectives) has demonstrated 7.3 and 6.2.1 f at the same time.

Time: after the internal audit, before the certification audit — in a small company January or February for the previous year. All lists are closed; the objectives of the new year are decided here.

The two typical errors: the internet template — ten chapters of running text (“Customer satisfaction is at a high level”), no number, no table, no decision; the auditor sees in one minute that nobody reviewed. And the two-day project — the quality manager collects data he did not keep all year. This course prevents both with one rule: the management review is the report on the lists of the year. Anyone who has the lists (from the previous courses of the series) writes it in two hours.

📄 Checklist 9.3.2 / 9.3.3: all inputs and outputs with source in a small company and the auditor's question (German – English version to follow)

Module 2 of 15

The ten chapters — a structure that covers all inputs

A structure that has proven itself in audits for many years, because every auditor finds the inputs a) to f) in it — and because every chapter is fed from a list of the year:

Rule: every chapter has a table. Running text explains, the table demonstrates. A chapter without a table is a chapter without input — and that is the nonconformity auditors find in copied reviews.

Header block: company, period of the review (year), date, participants (MD, quality manager), date of the internal audit, date of the external audit / certificate valid until, next review. End: signature of the MD with date — that is the evidence under 9.3.3.

Length: eight to twelve pages for 15 to 50 employees, five to eight for smaller companies. Shorter gets thin, longer nobody reads.

📄 Management review — template with ten chapters, table frames and decision table (Word) (German – English version to follow)

Chapter 1 with an existing certification begins with the sentence that names the alignment: “After the confirmed maintenance of the certificate, the optimisation of the processes is in the foreground. Significant influencing factors are: results of customer satisfaction, evaluation of the company and quality objectives, training results, supplier evaluation, changes to standards and laws, context of the organisation and requirements of interested parties.” In the first year the starting position before certification stands there instead.

Module 3 of 15

Collecting the numbers: the eight sources in one hour

Two hours for the management review apply only if the first hour belongs to collecting — with a list that says per chapter which number comes from which document. Eight sources, all from the previous courses:

The collection list (download) has the fields with source per chapter — printed out, filled in in one hour, then written. Anyone who cannot find a number does not write it from gut feeling: the field stays red with “[please complete — reason]” (e.g. “number of complaints: defect tally sheet kept only from July”). Red fields are not a nonconformity in the audit if a deadline for completion is given; invented numbers are one.

Source priority in case of contradictions: current list before previous year's document, previous year's document before memory. If the KPI sheet says 94 % and the head says “about 90 %”, the sheet applies.

Sensitive numbers (turnover, salaries, sick leave) do not belong in the review unless they are an input. Number of employees and investments yes; turnover only as an objective (“+5 % achieved”), not as an amount, if the review is shown in the audit.

📄 Collection list: all fields of the ten chapters with source — to fill in before writing (German – English version to follow)

Collection folder: folder “05 Management / management review year” with copies of the eight sources as at the status of the review — the auditor asks “Where does the 94 % come from?”, and the answer lies next to it.

Module 4 of 15

Writing chapters 1 to 3: system, objectives, audits

The first three chapters are the ones the auditor reads first — and by which he recognises whether a review took place or a copy was made.

Chapter 1 — Management system (input b): five rows of table: scope (verbatim from the manual) · manual status and changes of the year (from the change register) · certificate (body, valid until, next audit) · changes in context and interested parties (from context table and project list: new key customer, new location, new regulation, climate change considered) · alignment of the next year (the fixed sentence from module 2 or the starting position). Sample text: “In the reporting year the following issues changed: … The manual was brought to status 3 on … (customer property, change approval). The scope remains unchanged.”

Chapter 2 — Objectives and process KPIs (c 2, c 3, c 5): three tables.

1. Objectives review — objective, measure, target, actual, status (green achieved / red not achieved). Below it, for each missed objective two sentences: cause and decision (carry over, adjust, delete) — that is the evaluation the auditor looks for.
2. Objectives outlook — the new objectives with deadline under the deadline rule; they are decided here (9.3.3).
3. KPIs — annual average/sum per KPI, target value, status, trend against the previous year. One sentence per red KPI.

Sample text on a missed objective: “Complaints: target ≤ 6, actual 9. Cause: six of the nine cases concerned the briefing of new cleaning staff (defect tally sheet, cause field qualification). Decision: objective stays at 6; action briefing app and site checks twice a month (action plan A-2027-02).”

Chapter 3 — Audit results (c 6): internal audit: date, auditor, audited processes, number of findings by grading (nonconformity / opportunity for improvement / recommendation), strengths, status of the actions. External audit: date, certification body, nonconformities, status, certificate. Audit programme next year: date, auditor, processes (module 9). Table:

📄 Sample texts and table headings for all ten chapters — production, services, retail (German – English version to follow)

What is not in chapters 1 to 3: praise (“The QMS has proven itself”) without a number. Every statement has a table or a source behind it.

Module 5 of 15

Writing chapters 4 to 6: resources, suppliers, customers

Chapter 4 — Resources (input d): the standard asks whether the resources are adequate — the answer is in four tables and one sentence.

The sentence on adequacy: “The resources were adequate in the reporting year; bottleneck: hotline staffing (objective O2). For the coming year the following are needed: second night site manager, briefing app (decision table ch. 10).”

Chapter 5 — Suppliers (c 7): the supplier evaluation complete as a table (name/area, class, grades, action, previous year) — not as a sentence “The suppliers were evaluated”. Below it: number of suppliers with grade ≥ 4 and status of the actions; outsourced processes and their monitoring (data centre: availability report available); supplier nonconformities from the defect tally sheet.

Chapter 6 — Customers (c 1, c 4): two parts.

1. Complaints: number, rate, top 3 types, repeaters, cost of poor quality, response time kept; corrective actions with effectiveness (reference to chapter 7). Table from the defect tally sheet.
2. Customer satisfaction: rating table of the main customers with grades and actions; average grade of the feedback after delivery; terminations and new customers; online reviews. Evaluation in two sentences: “The satisfaction of the main customers is Ø 2.2 (previous year 2.4). Two customers with grade ≥ 4 have actions (table); one contract was terminated for price reasons.”

The false assumption that threatens here: chapter 6 with “no complaints, customers satisfied” and without a table. The auditor asks for the method (9.1.2) and for the defect tally sheet — and finds the nonconformity in the management review, not in the company.

Sample texts for all three chapters in the download from module 4.

Module 6 of 15

Writing chapters 7 to 9: actions, standards, risks

Chapter 7 — Corrective and improvement actions (inputs a and f): the chapter that links the review with the previous one — and that auditors check first against the action plan.

Evaluation in two sentences: “Of eight decisions of the previous year's review, six are implemented and effective, one is running (location), one was discarded (reason). Of twelve corrective actions eleven are effective, one sharpened.” A decision that stayed “open” for a year needs a reason and a new deadline here — otherwise it is the nonconformity against 9.3.2 a.

Chapter 8 — Standards and laws (input b): a table from the list of standards and laws: standard/law, last review, change in the year, impact. Plus the new requirements: Amendment 2024 (climate change in 4.1/4.2 — considered, see chapter 4) and ISO 9001:2026 (transition planned by …, action in the action plan). Sample text: “The list of standards and laws was reviewed on …. Changes: e-invoicing obligation (implemented), ISO 9001:2026 (transition planned by surveillance audit 2027, Academy course completed). No violations known.”

Chapter 9 — Risks and opportunities (input e): the risk and opportunity analysis as two matrices (risks P×E, opportunities R×B) with status — or the tables complete if they are short. Below it: new rows of the year (from complaints, audit, projects), completed actions with effectiveness (“Second supplier added — no shortage since June”), risks with result ≥ 6 and status “in progress” as decision candidates for chapter 10. Evaluation: “The analysis was updated on … (14 risks, 8 opportunities). Three actions effective, two running. New: data loss in projects (level 4, action checklist).”

What chapters 7 to 9 have in common: they show that the system moves — actions closed, standards reviewed, risks re-rated. A company whose chapters 7 to 9 equal the previous year has a document, not a system.

Module 7 of 15

Chapter 10: management's decisions — decision table and three sentences

Chapter 10 is the chapter the nine before it exist for — and that is missing in copied reviews or consists of the sentence “The QMS is effective”. Here the standard requires the outputs: decisions and actions on improvements (a), on the need for changes to the system (b), on resource needs (c).

Three sentences with evidence (9.3.1):

The decision table — the heart, every row a decision of the MD:

Decision candidates come from every chapter: missed objectives (2), open audit findings (3), resource needs (4), suppliers ≥ 4 (5), repeaters (6), ineffective actions (7), new standards (8), risks ≥ 6 (9), improvement suggestions. Five to ten decisions are normal for a small company.

What is not a decision: “Customer satisfaction is to be further improved.” Without responsible person, deadline and action that is a wish. Every row of the table goes into the action plan (source: management review 2026) — and is queried in the next review in chapter 7 (input a). That way the circle closes.

Signature: place, date, management. Plus “Communicated: team meeting on …”. That is the evidence under 9.3.3, last sentence.

📄 Decision table (chapter 10) and action plan with standard columns and source — one plan for everything (Excel) (German – English version to follow)

Module 8 of 15

The action plan as the only plan: columns, sources, status, effectiveness

Five lists in five places — audit actions in the audit report, complaint actions on the sheets, decisions in the management review, risk actions in the analysis, improvements in the minutes — are the most frequent reason why actions count as “not tracked” in the audit. The solution is called one action plan with a column “origin”.

The standard columns:

Update instead of new creation: the plan is never created anew. Previous year's rows stay 1:1, status and effectiveness are updated; new rows are added at the bottom. At the year end: rows “done, effective” older than one year may go into an archive sheet — not deleted.

Avoiding duplicates: a recommendation from the audit that already exists as an open previous year's action is not added as a second row — the existing one gets the note “found again in audit …” and a new deadline. That is at the same time the note for chapter 7 of the management review.

Monthly review: 15 minutes in the team meeting — status per open row, minutes line. KPI: on-time rate of actions (≥ 90 %). An action that stands for three months without status change is called up in the meeting; one that stands for a year needs a reason in the management review.

What auditors check: they take a finding from the last audit report and look for the row in the plan; then a decision from the last management review; then a complaint. If they find all three in the same plan with status and effectiveness, 10.2 and 9.3.2 a are dealt with.

The template is in the download from module 7 (decision table and action plan in one file).

Module 9 of 15

The audit programme over three years: matrix, dates, auditor, exclusions

9.2.2 requires an audit programme — not only an audit plan for the day, but the planning over time: frequency, methods, responsibilities, reporting. In a small company that is a matrix: processes in the rows, years in the columns, in the cells “planned week …” or “carried out on …”. Three years — the certification cycle — on one page.

Rules for the small company:

1. All processes every year — in one morning (course “Internal Audit in a Small Company”). The standard permits risk-based frequency; with twelve processes and one audit day the differentiation does not pay off, and the certification body does not ask.
2. Order in the year: internal audit → management review → certification audit, with four to eight weeks between each. The internal audit delivers chapter 3, the review the decisions, the certification body sees both finished.
3. Auditor: internal if someone is independent of the area (the lead technician audits the MD's areas, the MD the rest); otherwise external. Auditor's qualification in the qualification matrix (row “internal audit”).
4. Exclusions from the manual are kept in the matrix as “not applicable” — otherwise the certification body asks why S7 was never audited.
5. Update at the year end: column of the expired year to “carried out on …”, new year “planned week …”, following year “planned”. The matrix is three-yearly; after the third year a new file with the new cycle.

The audit plan for the day (time, process, interviewee, place) is derived from the matrix and distributed four weeks beforehand; template in the course “Internal Audit in a Small Company”.

📄 Audit programme / audit cycle matrix over three years (Excel) with status colours and exclusion note (German – English version to follow)

Reporting (9.2.2 e): the audit report goes to the MD and is summarised in chapter 3 of the management review — with that “report to relevant management” is met.

Module 10 of 15

Rolling the documents over to the new year: two dates, three rules, eight files

The year-end rollover of the documents is the part that is either forgotten or overdone in small companies — either the previous year's objectives are still in the folder in March, or someone rewrites the manual. The rule: as little as possible, as much as necessary — change only dates, periods and result fields, contents stay.

Two dates steer everything:

Three rules from the reference date:

1. Objectives — always two versions: review (fill empty result cells, never overwrite existing ones) and outlook (result empty, year in the heading, deadlines under the deadline rule: status January–September → 31 December of the current year, October–December → 31 December of the following year).
2. Evaluation periods for suppliers and customers in the heading: status January–June → whole previous year; July–December → first half of the current year.
3. Review dates: list of standards and laws “last review” = audit date; measuring equipment list and maintenance plan only the due dates of the new year, historical data stays.

What stays unchanged: manual and process descriptions — unless the audit or the management review has decided a change (then new status with change register). Risk analysis: updated, not new (course Objectives). Audit report, management review, action plan: created anew or continued.

What is never changed: edition years of standards (9001:2015 stays 2015 until the transition is decided); historical contents in tables (training and calibration dates of previous years, risk scores, year entries in rows).

The eight files of the year end:

File names: Document_Company_Status_YYYY-MM-DD — the previous year's file stays untouched in the archive; never overwrite, suffix on name collision. Gap rule: what cannot be substantiated is marked red bold “[please complete — reason]”, never guessed, never left empty — and stands exactly once in the handover sheet (module 11).

📄 The year end as a run: tick list, order, two dates, three rules, eight files (German – English version to follow)

Order of the run (two to four hours): set the dates → update the lists (1–6) → audit programme (7) → write the management review → action plan (8) → handover sheet → filing with status.

Module 11 of 15

The handover sheet: what is new, what remains open — for everyone involved on one page

After the year end ten changed files lie in the folder — and nobody except the quality manager knows what has changed and what is still missing. The handover sheet solves that: one page that MD, quality manager, consultant and the next auditor read in two minutes. It is at the same time the communication of the management review (9.3.3) and the evidence for 7.4.

The six sections:

The one rule: every point in section 3 stands in the respective document as a red place or as a row in the action plan — and conversely no red place without a row here. Thus the handover sheet is the gap list of the year end: anyone who works through it has no open fields left.

Adding later: if records come later (complaint number, calibration certificate, external audit result), the red places are filled, the point in section 3 gets “☑ done on …”, section 1 is updated. Audit date and status stay; in the audit report one line “records added on …”.

For whom: MD (signs, sees the decisions), quality manager (works through section 3), consultant (handover), certification auditor (reads it first and knows where to look — that has an effect).

📄 Handover sheet — template with six sections (Word) (German – English version to follow)

File name begins with 00_ so that it is at the top of the folder. Filing in the year folder next to the documents.

Module 12 of 15

What the certification body does with the management review — and 20 questions about it

The certification auditor reads the management review before the audit day — for him it is the map of the company. What he does with it can be described in four checks:

Typical questions (from real audits, anonymised):

• “Which decisions did management take in the last management review — and what became of them?” → decision table, action plan with status.
• “Where does the number 94 % on-time delivery come from?” → KPI sheet, cover sheets.
• “Two objectives were not achieved — what did management decide on that?” → chapter 2, cause and decision.
• “How did you evaluate the effectiveness of the actions on risks and opportunities?” → chapter 9 with status.
• “Which resources has management released for the coming year?” → chapters 4 and 10.
• “Who took part in the review, and how were the results communicated?” → header block, signature, minutes line of the team meeting, handover sheet.
• “Did you consider climate change?” → chapter 1 or 4, one sentence.

The five most frequent nonconformities on 9.3: input missing (usually c 7 suppliers or e risks) · no decisions with responsible person and deadline (9.3.3) · previous year's decisions without status (9.3.2 a) · numbers without source or in contradiction to the lists · review after the certification audit instead of before (then input c 6 for the current year is missing).

How the review shortens the audit: an auditor who receives a complete management review with collection folder has half of his questions answered before he enters the company — and starts the audit day with samples instead of searching. Empirical value: one hour less audit day, and a report with strengths.

📄 Twenty audit questions on the management review and the year end with evidence (German – English version to follow)

Module 13 of 15

Case study: Klarblick Building Services — management review 2026 from the lists

Klarblick Building Services (fictitious) in Regensburg, Germany — 38 employees, routine and glass cleaning, caretaker services, site security, two site managers, night shift — ran the year 2026 with the lists from this course series. Internal audit on 12 November 2026, certification audit stages 1 and 2 planned for March 2027. Management writes the management review 2026 in January 2027 — the first before a certification audit.

What is available (download 10): objectives 2026 review (turnover +7 % achieved; quotation hit rate 34 % instead of 40 %; complaints 9 instead of 6; customer satisfaction 3.8 achieved; supplier evaluation 2.9 achieved; certification postponed to 03/2027) · KPI sheet 2026 · defect tally sheet (9 complaints, 14 internal nonconformities, 3 supplier nonconformities; cost of poor quality 11,400; repeater “briefing of new staff”) · supplier evaluation (8 suppliers, one with grade 5) · customer satisfaction (6 main customers, Ø 2.3; one termination) · internal audit report (0 NC, 3 OFI, 2 R) · risk and opportunity analysis (12 projects, status 15 Dec 2026) · action plan 2026 (14 rows) · staff (38; 6 joiners, 4 leavers; first aider at the branch missing) · project list · context changes (third location decided, minimum wage increase, tender with certificate requirement).

Your task (120 minutes):

1. Fill in the collection list (module 3) — which number in which chapter.
2. Write the ten chapters — each with a table; missed objectives with cause and decision.
3. Chapter 10: three sentences (suitability, adequacy, effectiveness) and the decision table with at least six decisions from the chapters.
4. Update the action plan 2027: previous year's rows with status, decisions as new rows.
5. Handover sheet with all red places (there are three places for which numbers are missing — find them and mark them correctly instead of guessing).

📄 Klarblick: all lists 2026 as the basis of the management review — objectives, KPIs, nonconformities, suppliers, customers, audit, risks, actions, staff, projects (German – English version to follow)

📄 Klarblick: model solution — management review 2026 in ten chapters, decision table, action plan 2027, handover sheet (German – English version to follow)

Where most deviate: the certification is an unachieved objective — chapter 2 needs cause and decision, not only “postponed” · the supplier with grade 5 without action is a decision candidate for chapter 10, not only a row in chapter 5 · the three missing numbers (number of site checks, sick leave is not collected, external audit result not yet available) stay red with reason — anyone who estimates them has violated the gap rule.

Time balance Klarblick: collecting 50 minutes, writing 70 minutes, action plan and handover sheet 30 minutes. In the stage 2 audit clause 9.3 was checked in 20 minutes — with the strength “decisions traceably derived from the inputs”.

Module 14 of 15

Records: the year folder — and the calendar for the next year

At the end of the year end there is a folder that demonstrates the QM year completely — and that the next auditor, the next quality manager or the boss's successor understands without explanation:

The QM annual calendar — the summary of all courses of this series for a company of up to 50 employees:

Together under 40 hours a year for quality manager and MD — that is an adequate system for a small company, and exactly that is what chapter 10 evaluates under “adequacy”.

Retention: audit programme, audit plans and audit reports at least 3 years (one certification cycle), management reviews 10 years; archive the year folder as a whole.

📄 Checklist: rate management review and year end in 16 criteria (German – English version to follow)

Below 20 of 32: go through modules 3 to 11 for your own year; from 26: 9.3 audit-proof.

What follows: “Passing the Certification Audit” — stage 1, stage 2, surveillance, recertification, and what the certification body does with this folder. And “Transition to ISO 9001:2026” — the next decision in chapter 10.

Module 15 of 15

Procedure in our company

Your company completes this module. The general part of the training ends here; what follows, only your company knows:

Companies with a company account of the Academy receive this module with their own details; participants then see the names, dates and filing locations of their company. Without customisation: ask your management or your quality manager where these details are laid down in your company — usually in the quality manual.

Final test

35 questions, one correct answer each. You need 28 correct answers to pass (80 %). Scoring happens on the server — there is no answer key on this page.

Your result