# Management Review
URL: https://docs.autociso.io/console/iso/management-review/
Description: ISO 27001 clause 9.3 requires top management to review the ISMS at planned intervals. This page produces and documents that review, giving you a signed record of leadership engagement.

*This is the help text the console shows in the help panel on this page.*

ISO 27001 clause 9.3 requires top management to review the ISMS at planned intervals. This page produces and documents that review, giving you a signed record of leadership engagement.

### Creating a Review
Click **Generate Annual Review**. AutoCISO builds a review for the period from your current ISMS data. Click a review in the list to open it; **All Reviews** takes you back.

### ISMS Metrics
Populated automatically from your ISMS data:
- [Open Risks](https://docs.autociso.io/console/iso/risk-register/) and Accepted/Transferred Risks
- [Open NCs](https://docs.autociso.io/console/iso/internal-audits/) (nonconformities) and Audit Findings
- [Readiness Score](https://docs.autociso.io/console/iso/readiness/)
- Security Incidents
- [Policy Ack Rate](https://docs.autociso.io/console/iso/policies/) (policy acknowledgment completion)
- [Access Reviews Done](https://docs.autociso.io/console/iso/access-reviews/)

### AI Narrative
The AI drafts a narrative from the metrics. Edit it in the text area to add context, strategic decisions or leadership commentary, then click **Save Narrative**.

### Management Decisions
Click **Add Decision** to record formal decisions from the review meeting, such as new resource allocations, a [change in ISMS scope](https://docs.autociso.io/console/iso/scope/) or an updated risk appetite. Each decision has a topic, the decision itself, an owner and a due date. Click **Save Decisions** when done.

### Signatures
The review needs two signatures: **CTO** and **CEO**. Type the signer's full name and click **Sign**. **Share Link** copies a link to this review for that role; the person opening it must be signed in to AutoCISO as an [Owner or Manager](https://docs.autociso.io/getting-started/roles-and-permissions/). Once signed, use **Download Report PDF**. A signed management review is required for Stage 2 and surveillance audits.

## Fields

### Management Review Narrative

The formal record of the management review discussion. Should cover: current ISMS performance, audit results, risk treatment progress, and decisions made. This document will be reviewed by the ISO 27001 auditor.

### Management Decision

A formal decision or action item arising from the review meeting.

**Examples:** `Increase security training budget by 20%`, `Expand ISMS scope to include the new US entity`, `Conduct additional phishing simulation exercise`.

### Decision Owner

The person accountable for executing the management decision (free text, e.g. a name or role).

### Due Date

The deadline for completing the management decision.