ISO 13485:2016 Section 5.6 sets out what a management review must cover. This guide walks through each requirement, explains what auditors look for, and gives you a practical framework for running reviews that are both compliant and genuinely useful.

What ISO 13485 Section 5.6 requires

Section 5.6 requires top management to review the quality management system at planned intervals. The purpose is to ensure the QMS remains suitable, adequate, and effective. The standard specifies three sub-clauses:

• 5.6.1 General: Top management must conduct the review. Records must be maintained. The interval must be planned (meaning predefined, not ad hoc).
• 5.6.2 Review inputs: A defined list of topics must be addressed at each review.
• 5.6.3 Review outputs: The review must produce decisions and actions related to specific areas.

The standard does not prescribe how often the review must occur, only that the frequency must be planned. Most companies conduct management reviews annually or semi-annually. Some high-risk device manufacturers or companies under regulatory scrutiny hold them quarterly. Whatever frequency you choose, document it in your quality manual or a quality plan, and hold to it.

Who must attend

Section 5.6.1 is explicit: top management conducts the review. In practice, this means the most senior leadership responsible for the quality management system must be present and engaged. In a small medical device company, that might be the CEO, VP of Quality, and VP of Operations. In a larger pharma organization, it could be the site General Manager, Quality Director, and functional department heads.

The most common audit finding related to attendance is that management review records show mid-level managers present but no evidence that top management was involved. If your Quality Manager runs the meeting alone and sends a summary to the VP who signs it later, that does not satisfy the requirement. Top management must participate, not ratify.

Required inputs: what you must cover

Section 5.6.2 lists the minimum inputs that every management review must address. Many companies add additional topics, but no input from this list can be skipped. The required inputs are:

• Feedback from customers, including complaints
• Results of audits, both internal and external (regulatory, customer, certification body)
• Process performance and product conformity
• Status of preventive and corrective actions (CAPA)
• Actions from previous management reviews and their follow-up
• Planned changes that could affect the QMS
• Recommendations for improvement
• New or revised regulatory requirements

The last point, new or revised regulatory requirements, is one that many companies underaddress. FDA QMSR took effect in February 2026 and replaced the prior 21 CFR Part 820. If your management review from 2025 or early 2026 does not show that top management reviewed the regulatory landscape and assessed impact on your QMS, that is an audit gap.

How to structure the inputs in your review package

The most effective management review packages present each required input as a data summary with trend analysis, not just a status update. A complaint count by itself tells management very little. A complaint count with month-over-month trend, breakdown by complaint category, and comparison to previous year gives management something to act on.

For each input category, prepare:

• A summary of data from the review period
• Trend versus the prior review period
• Key observations: what changed, what drove the change, what the risk is
• Any open issues requiring management decision

The quality team typically prepares this package. The department owners validate the data in their area. Top management reviews it in the meeting and responds to it. That flow is documented in the meeting minutes or review record.

Required outputs: what the review must produce

Section 5.6.3 specifies that outputs must include decisions and actions related to:

• Improvement of the effectiveness of the QMS and its processes
• Improvement of product related to customer requirements
• Resource needs

The most important word in that list is “actions.” A management review that produces only observations and no assigned corrective or improvement actions is not satisfying the standard’s intent. Every identified gap or opportunity should map to an action: who owns it, what they will do, and by when.

Many companies treat management review outputs as the starting point for their CAPA pipeline. If management identifies a trend in customer feedback suggesting a product labeling issue, a CAPA or improvement action is opened, assigned, and tracked through to closure before the next management review.

Documenting the management review

Section 5.6.1 requires records of management reviews to be maintained. Those records must demonstrate:

• Who attended (and that top management was present)
• What inputs were reviewed
• What data was presented for each input
• What decisions or actions resulted
• Action ownership and target dates

Meeting minutes are the most common record format. Many companies supplement minutes with a formal management review report that includes the data packages, trend charts, and a consolidated action log. Some use a dedicated management review template built into their eQMS.

Keep the records. Under ISO 13485, quality records must be maintained for at least the lifetime of the device or five years from product release, whichever is longer. Management review records are quality records. The audit trail should show when the record was created, approved, and by whom.

Common audit findings in management review

During ISO 13485 certification and surveillance audits, management review is a standard check. The most frequent nonconformances:

• One or more required inputs were not addressed in the review
• Top management was not present or their attendance is not documented
• Outputs contain no specific actions, only general observations
• Actions from the previous review were not followed up or their status is unknown
• The review was not held at the planned interval
• New regulatory requirements were not included in the review inputs
• Records are incomplete or unsigned

A pattern auditors see often: the management review record documents a full agenda with all required inputs, but the data presented for each topic is a single sentence. “CAPA status was reviewed. No significant issues noted.” That passes the presence test but fails the adequacy test. Auditors will ask to see the actual CAPA data that was reviewed. If the underlying data does not exist or was not discussed in the meeting, the review was not adequate.

How to make management reviews useful, not just compliant

The companies that get the most from management reviews treat them as a strategic quality planning session, not a compliance checklist. A few practices that separate effective reviews from perfunctory ones:

Prepare data before the meeting, not during it. Management review meetings that turn into data-retrieval sessions waste leadership time and produce poor decisions. Distribute the review package at least 48 hours before the meeting. Attendees should come prepared to discuss, not to hear numbers for the first time.

Connect quality metrics to business outcomes. Complaint rate by itself is an abstract number for a CEO. Complaint rate tied to warranty costs, customer churn risk, or regulatory action risk is a number that drives decisions. Bridge the gap between quality language and business language.

Track actions from review to review. Open a dedicated management review action log. Every prior action carries forward to the next review with a status update. Close the loop explicitly, with evidence of completion. Auditors love seeing a clean action log. So does top management.

Adjust the agenda based on risk. Some inputs require more time in some years than others. If you had a major CAPA open all year, spend more time on CAPA effectiveness than on customer feedback trends that were stable. Flexible agenda design within the required input structure keeps the review proportionate to actual quality risk.

Management review frequency: annual vs. more frequent

Annual management reviews satisfy the standard for most companies. But consider increasing frequency if:

• You received an FDA warning letter or notified body major nonconformance in the past 12 months
• You are preparing for a 510(k) submission or CE marking application
• Your complaint rate or CAPA backlog is trending upward
• You experienced a product recall or field safety corrective action
• Your business is growing rapidly and your quality system is scaling with it

In high-risk situations, quarterly management reviews let leadership course-correct faster. The additional meetings also generate more frequent management review records, which demonstrates proactive quality oversight to regulators reviewing your quality system.

Using an eQMS for management review

Managing management review inputs across spreadsheets, email chains, and shared drives is workable for small teams but breaks down quickly as organizations grow. An eQMS with integrated management review capabilities gives quality teams several advantages:

• Automated collection of required inputs from live QMS data (CAPA status, complaint metrics, audit findings)
• Structured review templates that enforce coverage of all required Section 5.6 inputs
• Electronic signature on review records for 21 CFR Part 11 compliance
• Action tracking with owner assignment and due date reminders
• Historical record library accessible for audit retrieval

Cloudtheapp’s eQMS includes a Management Review application that pulls data directly from connected quality modules, including CAPA, complaints, audits, and supplier quality. The review record is generated within the system, signed electronically, and stored with a full audit trail. Actions assigned during the review are tracked through the same platform, giving the next review team a clean status picture. Request a demo to see it in action.

Conclusion

ISO 13485 Section 5.6 gives quality teams a mandate for something genuinely valuable: a regular, structured conversation between top management and the quality data that reflects how well the organization is performing against its own standards. Most companies use management review to satisfy an auditor. The ones that use it to actually run their quality program better get both outcomes.

Cover every required input with real data. Produce real actions with real owners and real deadlines. Involve top management who can actually commit resources to quality improvement. Then follow up. The gap between a compliant management review and a useful one is almost entirely discipline, not procedure.

This post created by and appeared first on Cloudtheapp