At a glance
- Ref
- OH-15
- Theme
- Accountability
- Held source
- ISO/IEC 42001:2023
- Citation
- ISO/IEC 42001:2023, 9.3
- Evidence
- 3 items
- Gaps
- 2 common
Evidence to keep
- Management reviewThe management review procedure
- Management reviewMinutes with the required inputs and the decisions
- Management reviewActions with owners and dates
Questions before you sign
- When did the review last see oversight performance?
- What decision did it take?
- Who is chasing the action?
The requirement, in our words
Top management must review the management system at planned intervals, with the required inputs, and record the decisions and actions that follow.
What it means for human oversight
Oversight performance belongs on the review agenda with the incidents, the audit findings and the resource decisions. A review that never sees the override rate cannot resource the control.
How to evidence it
Attach the artefacts above to the Management review row with the system name, the owner and the date. The first one is the anchor: The management review procedure. The OH-15 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.
The reviewer will sample one live decision and ask for Minutes with the required inputs and the decisions. If that artefact for OH-15 cannot be produced, the row is a gap, whatever the policy says.
OH-15 carries 3 evidence items and 2 common gaps. For management review, the auditor looks for a named person with an authority, not a committee title, so the row needs both the name and the sentence that grants the power. The OH-15 statement above is ours, written from ISO/IEC 42001:2023, 9.3, not a reproduction of the licensed text.
Common gaps
- No management review held
- Review receives no oversight performance data
Related units
Source for this page: ISO/IEC 42001:2023, 9.3. Open ISO/IEC 42001:2023, 9.3 and compare it with the OH-15 statement above. Retrieved 2026-10-21.