ISO 13485:2016 Section 5.6 sets out what a management review must cover. This guide walks through each requirement, explains what auditors look for, and gives you a practical framework for running reviews that are both compliant and genuinely useful.

What ISO 13485 Section 5.6 requires

Section 5.6 requires top management to review the quality management system at planned intervals. The purpose is to ensure the QMS remains suitable, adequate, and effective. The standard specifies three sub-clauses:

• 5.6.1 General: Top management must conduct the review. Records must be maintained. The interval must be planned (meaning predefined, not ad hoc).
• 5.6.2 Review inputs: A defined list of topics must be addressed at each review.
• 5.6.3 Review outputs: The review must produce decisions and actions related to specific areas.

The standard does not prescribe how often the review must occur, only that the frequency must be planned. Most companies conduct management reviews annually or semi-annually. Some high-risk device manufacturers or companies under regulatory scrutiny hold them quarterly. Whatever frequency you choose, document it in your quality manual or a quality plan, and hold to it.

Who must attend

Section 5.6.1 is explicit: top management conducts the review. In practice, this means the most senior leadership responsible for the quality management system must be present and engaged. In a small medical device company, that might be the CEO, VP of Quality, and VP of Operations. In a larger pharma organization, it could be the site General Manager, Quality Director, and functional department heads.

The most common audit finding related to attendance is that management review records show mid-level managers present but no evidence that top management was involved. If your Quality Manager runs the meeting alone and sends a summary to the VP who signs it later, that does not satisfy the requirement. Top management must participate, not ratify.

Required inputs: what you must cover

Section 5.6.2 lists the minimum inputs that every management review must address. Many companies add additional topics, but no input from this list can be skipped. The required inputs are:

• Feedback from customers, including complaints
• Results of audits, both internal and external (regulatory, customer, certification body)
• Process performance and product conformity
• Status of preventive and corrective actions (CAPA)
• Actions from previous management reviews and their follow-up
• Planned changes that could affect the QMS
• Recommendations for improvement
• New or revised regulatory requirements

The last point, new or revised regulatory requirements, is one that many companies underaddress. FDA QMSR took effect in February 2026 and replaced the prior 21 CFR Part 820. If your management review from 2025 or early 2026 does not show that top management reviewed the regulatory landscape and assessed impact on your QMS, that is an audit gap.

How to structure the inputs in your review package

The most effective management review packages present each required input as a data summary with trend analysis, not just a status update. A complaint count by itself tells management very little. A complaint count with month-over-month trend, breakdown by complaint category, and comparison to previous year gives management something to act on.

For each input category, prepare:

• A summary of data from the review period
• Trend versus the prior review period
• Key observations: what changed, what drove the change, what the risk is
• Any open issues requiring management decision

The quality team typically prepares this package. The department owners validate the data in their area. Top management reviews it in the meeting and responds to it. That flow is documented in the meeting minutes or review record.

Required outputs: what the review must produce

Section 5.6.3 specifies that outputs must include decisions and actions related to:

• Improvement of the effectiveness of the QMS and its processes
• Improvement of product related to customer requirements
• Resource needs

The most important word in that list is “actions.” A management review that produces only observations and no assigned corrective or improvement actions is not satisfying the standard’s intent. Every identified gap or opportunity should map to an action: who owns it, what they will do, and by when.

Many companies treat management review outputs as the starting point for their CAPA pipeline. If management identifies a trend in customer feedback suggesting a product labeling issue, a CAPA or improvement action is opened, assigned, and tracked through to closure before the next management review.

Documenting the management review

Section 5.6.1 requires records of management reviews to be maintained. Those records must demonstrate:

• Who attended (and that top management was present)
• What inputs were reviewed
• What data was presented for each input
• What decisions or actions resulted
• Action ownership and target dates

Meeting minutes are the most common record format. Many companies supplement minutes with a formal management review report that includes the data packages, trend charts, and a consolidated action log. Some use a dedicated management review template built into their eQMS.

Keep the records. Under ISO 13485, quality records must be maintained for at least the lifetime of the device or five years from product release, whichever is longer. Management review records are quality records. The audit trail should show when the record was created, approved, and by whom.

Common audit findings in management review

During ISO 13485 certification and surveillance audits, management review is a standard check. The most frequent nonconformances:

• One or more required inputs were not addressed in the review
• Top management was not present or their attendance is not documented
• Outputs contain no specific actions, only general observations
• Actions from the previous review were not followed up or their status is unknown
• The review was not held at the planned interval
• New regulatory requirements were not included in the review inputs
• Records are incomplete or unsigned

A pattern auditors see often: the management review record documents a full agenda with all required inputs, but the data presented for each topic is a single sentence. “CAPA status was reviewed. No significant issues noted.” That passes the presence test but fails the adequacy test. Auditors will ask to see the actual CAPA data that was reviewed. If the underlying data does not exist or was not discussed in the meeting, the review was not adequate.

How to make management reviews useful, not just compliant

The companies that get the most from management reviews treat them as a strategic quality planning session, not a compliance checklist. A few practices that separate effective reviews from perfunctory ones:

Prepare data before the meeting, not during it. Management review meetings that turn into data-retrieval sessions waste leadership time and produce poor decisions. Distribute the review package at least 48 hours before the meeting. Attendees should come prepared to discuss, not to hear numbers for the first time.

Connect quality metrics to business outcomes. Complaint rate by itself is an abstract number for a CEO. Complaint rate tied to warranty costs, customer churn risk, or regulatory action risk is a number that drives decisions. Bridge the gap between quality language and business language.

Track actions from review to review. Open a dedicated management review action log. Every prior action carries forward to the next review with a status update. Close the loop explicitly, with evidence of completion. Auditors love seeing a clean action log. So does top management.

Adjust the agenda based on risk. Some inputs require more time in some years than others. If you had a major CAPA open all year, spend more time on CAPA effectiveness than on customer feedback trends that were stable. Flexible agenda design within the required input structure keeps the review proportionate to actual quality risk.

Management review frequency: annual vs. more frequent

Annual management reviews satisfy the standard for most companies. But consider increasing frequency if:

• You received an FDA warning letter or notified body major nonconformance in the past 12 months
• You are preparing for a 510(k) submission or CE marking application
• Your complaint rate or CAPA backlog is trending upward
• You experienced a product recall or field safety corrective action
• Your business is growing rapidly and your quality system is scaling with it

In high-risk situations, quarterly management reviews let leadership course-correct faster. The additional meetings also generate more frequent management review records, which demonstrates proactive quality oversight to regulators reviewing your quality system.

Using an eQMS for management review

Managing management review inputs across spreadsheets, email chains, and shared drives is workable for small teams but breaks down quickly as organizations grow. An eQMS with integrated management review capabilities gives quality teams several advantages:

• Automated collection of required inputs from live QMS data (CAPA status, complaint metrics, audit findings)
• Structured review templates that enforce coverage of all required Section 5.6 inputs
• Electronic signature on review records for 21 CFR Part 11 compliance
• Action tracking with owner assignment and due date reminders
• Historical record library accessible for audit retrieval

Cloudtheapp’s eQMS includes a Management Review application that pulls data directly from connected quality modules, including CAPA, complaints, audits, and supplier quality. The review record is generated within the system, signed electronically, and stored with a full audit trail. Actions assigned during the review are tracked through the same platform, giving the next review team a clean status picture. Request a demo to see it in action.

Conclusion

ISO 13485 Section 5.6 gives quality teams a mandate for something genuinely valuable: a regular, structured conversation between top management and the quality data that reflects how well the organization is performing against its own standards. Most companies use management review to satisfy an auditor. The ones that use it to actually run their quality program better get both outcomes.

Cover every required input with real data. Produce real actions with real owners and real deadlines. Involve top management who can actually commit resources to quality improvement. Then follow up. The gap between a compliant management review and a useful one is almost entirely discipline, not procedure.

This post created by and appeared first on Cloudtheapp

TLDR

Management review is a formal, documented process in which senior leadership evaluates the performance and effectiveness of the quality management system. Under ISO 13485 Clause 5.6 and the FDA's Quality Management System Regulation (QMSR), which became effective February 2, 2026, management review is a mandatory requirement, not a best practice. The standard specifies exactly what inputs leadership must review, what outputs the meeting must produce, and how the entire process must be documented. As of February 2026, FDA investigators can inspect management review records during routine facility audits, making quality and thoroughness of documentation more critical than ever.

What Is Management Review in a Quality Management System?

Management review is a scheduled, structured meeting in which top management evaluates whether the quality management system is still suitable, adequate, and effective. The review brings together executives, quality directors, department heads, and the management representative to assess the current state of quality performance and make decisions about where the system needs to improve.

The purpose is not to review individual records or investigate specific events. Management review operates at a system level. Leadership looks across all quality data accumulated since the last review, identifies trends, assesses risks, allocates resources, and sets direction for the coming period.

For medical device companies, this process sits in ISO 13485:2016 Clause 5.6 and is fully incorporated into the QMSR under 21 CFR Part 820, effective February 2, 2026. It is one of the clearest expressions of management commitment in the entire standard.

Why Management Review Matters More Than Ever Under QMSR 2026

When the FDA's QMSR replaced the legacy Quality System Regulation on February 2, 2026, it brought one change that significantly raised the stakes for management review: FDA investigators can now access and inspect management review records during facility inspections.

Under the previous QSR, FDA policy historically shielded internal audit and management review records from routine inspection. That discretion ended with QMSR. The FDA's revised compliance program (7382.850) now allows investigators to review these records directly. A management review that is thin, vague, undated, or missing required inputs is no longer just an internal quality gap. It can now produce an FDA Form 483 observation or a warning letter finding.

Quality leaders who treated management review as a formality need to reassess that approach. The record your team produces in that room is now a primary inspection artifact.

ISO 13485 Clause 5.6: The Structure of Management Review

ISO 13485:2016 breaks management review into three sub-clauses, each covering a distinct aspect of the requirement.

Clause 5.6.1: General Requirements

Top management must review the quality management system at planned intervals. The standard requires management to evaluate whether the QMS is suitable, adequate, and effective. The review must also assess opportunities for improvement and the need for changes to the system, quality policy, and quality objectives.

Critically, the standard specifies that records of management reviews must be maintained. This is not optional documentation. The absence of management review records is itself a nonconformance.

The standard does not mandate a single annual meeting format. Many organizations hold quarterly reviews of key metrics and one comprehensive annual review that covers all required inputs. Both approaches satisfy the requirement provided the review cycle is planned, consistent, and documented.

Clause 5.6.2: Review Inputs

ISO 13485 specifies ten categories of information that must be included as inputs to the management review. These are not suggestions. Auditors look for evidence that each input was addressed.

The required inputs are:

1. Results of audits, including internal audits and external certification or regulatory audits
2. Customer feedback, including complaints and complaint handling results
3. Process performance and product conformity data
4. Status of preventive and corrective actions, including Deviation CAPA outcomes
5. Follow-up actions from previous management reviews and their current status
6. Changes that could affect the quality management system, including regulatory updates, organizational changes, or new product lines
7. Recommendations for improvement from any source within the organization
8. New or revised regulatory requirements applicable to the devices the company produces
9. Applicable new or revised standards
10. Supplier Quality Management (SQM) performance, including supplier audit results and supplier-related quality issues

Each input requires supporting data, not just a verbal acknowledgment. Management review minutes should capture what data was reviewed for each category and what conclusions leadership drew from that data.

Clause 5.6.3: Review Outputs

The outputs of management review are the decisions and actions that result from the review. ISO 13485 requires that outputs address at least three areas:

1. Improvement of the QMS and its processes – specific decisions about where and how the system will be strengthened
2. Improvement of product related to customer requirements – actions related to product quality, safety, or performance
3. Resource needs – decisions about staffing, equipment, infrastructure, or training required to support quality objectives

Outputs must be documented with assigned owners, action items, and deadlines where applicable. A management review that concludes without specific decisions and assigned actions does not satisfy the spirit or the letter of the standard.

Frequency and Documentation Requirements

ISO 13485 requires management review at "planned intervals," with the minimum expectation being at least once per year. Regulatory bodies and certification auditors generally view annual reviews as the floor, not the target. High-volume manufacturers, companies with active CAPA programs, or organizations that have experienced regulatory action in the prior period should consider semi-annual or quarterly reviews.

Every management review must produce a written record. The record typically includes:

• Date and location of the review
• List of attendees, including their titles and roles
• Confirmation that all required inputs were addressed
• Summary of data reviewed for each input category
• Key findings, trends, or concerns identified
• Decisions made and actions assigned
• Owner and target date for each action item
• Statement that the QMS was evaluated for suitability, adequacy, and effectiveness
• Signatures from senior management, including the management representative

The depth and completeness of this record determines whether the review will survive an FDA inspection or a third-party certification audit.

Who Must Attend Management Review

ISO 13485 requires that management with executive responsibility participate in the review. The management representative, who carries responsibility for QMS oversight under Clause 5.5.2, must be present and must report on QMS performance to executive leadership.

In practice, effective management reviews include:

• CEO, President, or General Manager
• VP or Director of Quality
• Management Representative (often the same as VP/Director of Quality)
• VP or Director of Operations
• VP or Director of Regulatory Affairs
• Heads of relevant departments based on input topics (e.g., supply chain for supplier quality inputs)

Management review cannot be delegated entirely to the quality team. The standard is explicit that executive leadership participates. An audit finding commonly cited by certification bodies is management review attendance records that show only quality personnel with no executive representation.

Common Management Review Failures That Trigger Audit Findings

Auditors reviewing management review records frequently cite the same categories of deficiency. Understanding these gaps helps quality teams design a review process that holds up under scrutiny.

Incomplete inputs. The most common finding is that one or more of the ten required input categories was missing from the review record. Often, companies address the inputs they have data for and skip categories where nothing noteworthy occurred. The standard requires all inputs to be addressed, even if the conclusion is that performance was satisfactory with no action required.

No evidence of data review. Management review minutes that list input topics but do not summarize the actual data reviewed are difficult to defend in an audit. Effective records reference specific metrics, trend data, root cause investigation summaries, or complaint volumes reviewed at the meeting.

No outputs or vague outputs. A management review that ends with "the QMS is performing well" and no specific actions fails to meet the output requirements. Every review must produce documented decisions, even if some of those decisions are to maintain current practices without change.

Overdue actions from prior reviews. When follow-up items from the previous management review are still open with no explanation, auditors treat this as evidence that the management review process is not driving real improvement.

Missing executive signatures. Records without signatures from executive management, or with only quality staff signatures, do not demonstrate the leadership commitment the standard requires.

Poor frequency. Companies that conduct management reviews less than annually, or that cannot produce records for planned review periods, face nonconformance findings related to Clause 5.6.1 frequency requirements.

How a Process Audit Connects to Management Review

Management review does not operate in isolation. It sits at the top of a continuous quality loop that draws data from process audits, internal audits, CAPA records, complaint data, and supplier performance. The strength of a management review depends directly on the quality of data flowing up from these connected processes.

A company with a fragmented QMS, where CAPA lives in one spreadsheet, complaints in another, and audit findings in a shared drive, cannot produce the consolidated, trend-based data that an effective management review requires. Leaders end up reviewing snapshots rather than patterns, and the decisions they make reflect that limitation.

The shift to an integrated eQMS changes this fundamentally. When all quality processes feed into a single system, management review preparation moves from a weeks-long manual aggregation exercise to an on-demand data review. Trend reports, open action status, CAPA closure rates, complaint metrics, and Risk Register updates are available in real time, not assembled manually before each meeting.

Maintaining the Audit Trail for Management Review Records

Under both ISO 13485 and the QMSR, management review records must be controlled documents. This means they fall under the document control requirements of Clause 4.2 and must be retained for a defined period, typically the life of the device plus a defined retention window specified in the company's document control procedure.

Maintaining a complete audit trail for management review records includes preserving evidence of who created the record, when it was created, when it was approved, and any subsequent revisions. For companies still managing management review records in Word documents or shared drives, demonstrating this audit trail during an FDA inspection is difficult. The QMSR's expanded access to these records makes a defensible, time-stamped document control system a compliance requirement, not a convenience.

How Cloudtheapp Supports Management Review Compliance

Cloudtheapp's AI-powered eQMS includes a dedicated Management Review application designed around the ISO 13485 Clause 5.6 structure. The platform automatically aggregates data from connected quality modules, including CAPA, complaints, Deviation CAPA, audits, and supplier quality, into a consolidated management review input report.

Quality leaders can configure the system to pull live trend data for each of the ten required input categories, assign review participants, track outputs and action items with owner assignments and due dates, and maintain fully validated, time-stamped records that satisfy both FDA and ISO 13485 audit requirements.

Because Cloudtheapp is pre-validated for FDA 21 CFR Part 820 (QMSR) and ISO 13485, the platform itself meets the computer system validation requirements that apply to electronic quality records. Management review records created in the platform carry the audit trail and access controls that make them defensible under QMSR inspection.

Organizations preparing for their first post-QMSR FDA inspection can use Cloudtheapp to structure management review records that directly address the expanded documentation expectations introduced in February 2026.

Book a free demo to see how the Management Review application fits into a complete eQMS built for regulated industry compliance.

Conclusion

Management review is the mechanism through which executive leadership takes ownership of quality system performance. ISO 13485 Clause 5.6 defines the structure precisely: ten required inputs, three required output categories, planned frequency, documented records, and executive participation. Under the QMSR effective February 2, 2026, those records are now inspectable by FDA investigators, which means quality teams need management review processes and documentation that hold up under direct regulatory scrutiny, not just third-party certification audits.

The companies that treat management review as a genuine leadership tool, rather than a compliance checkbox, produce stronger QMS data, identify systemic issues earlier, and enter inspections with a defensible record of continuous improvement. The standard gives you the structure. The execution determines whether that structure actually protects your business.

This post created by and appeared first on Cloudtheapp

This post created by and appeared first on Cloudtheapp