Management Reviews

A Management Review in Sertiq is the formal, top-management-level review of your quality management system carried out at planned intervals. Each review has a scheduled date, a defined period under review, a chair drawn from top management, a list of attendees, the twelve 9.3.2 inputs, the three 9.3.3 outputs, attached evidence files, and a single audit-ready PDF that becomes the documented information for the review.

Management reviews are how you satisfy ISO 9001:2015 clause 9.3 — Management review: top management reviews the QMS at planned intervals, considers a defined list of inputs, and produces a defined list of outputs (decisions on improvement, on changes to the QMS, and on resource needs). The matching reference page is ISO 9001 §9.3.

The module is chaired by a member of top management (typically the CEO, MD, or General Manager). Attendees should cover the process owners whose data is being reviewed — Quality Manager, Operations, Sales, Finance, HR — anyone whose function is referenced in an input.

Plan tier gating

Management Reviews sit on Pro and Enterprise plans. Below Pro, the section renders as a locked card with an upgrade link.

Plan	Management reviews
Free / Starter	Locked. Card visible, “Upgrade to Pro” link.
Pro	Unlimited.
Enterprise	Unlimited.

The gate is enforced server-side inside the create_management_review RPC against the organisation’s current plan.

Schedule a review

1. Open Management Reviews → New. Sertiq pre-fills the next available number in the MR-YYYY-NNN series for your organisation.

2. Enter a short title for the review (e.g. “Q2 2026 Management Review”).

3. Set the review date — when the review meeting is held.

4. Set the review period with a start and end date. Inputs (KPIs, NCRs, audits, etc.) are interpreted relative to this window.

5. Pick the chair from the Employees typeahead. The chair is expected to be a member of top management. The list is org-scoped; the RPC re-checks the chair belongs to your organisation.

6. Pick the attendees from the multi-checkbox list of employees. At least one attendee in addition to the chair is recommended.

7. Click Create review. Sertiq inserts the row in draft state, returns MR-YYYY-NNN, and routes you to the review detail page where the 9.3.2 inputs and 9.3.3 outputs can be captured.

Note

The number and the chair are both validated in the atomic create_management_review RPC (SECURITY DEFINER). The RPC blocks any chair whose organization_id does not match the calling organisation, so cross-org leakage is impossible by construction.

Review lifecycle

draft ─► scheduled ─► in_progress ─► completed
   │
   └──────────────► cancelled

• draft — review record exists; agenda being prepared.
• scheduled — published; attendees notified; the review appears on the dashboard.
• in_progress — review meeting is being held; inputs and outputs can be edited.
• completed — review finished. closed_at is stamped automatically. All inputs and outputs become readonly and the PDF report becomes the artefact.
• cancelled — review was abandoned. Reason should be in the activity log.

Only draft, scheduled, and in_progress reviews accept edits. Completing the review freezes the record.

9.3.2 Inputs

Sertiq captures all twelve inputs the standard names, each as its own free-text field with a clause label. Empty fields are allowed during planning; the PDF will render “Not captured” in their place so omissions are visible to an external auditor.

Clause	Input
a)	Status of actions from previous management reviews
b)	Changes in external and internal issues relevant to the QMS
c.1)	Customer satisfaction and feedback from interested parties
c.2)	Extent to which quality objectives have been met
c.3)	Process performance and conformity of products and services
c.4)	Nonconformities and corrective actions
c.5)	Monitoring and measurement results
c.6)	Audit results (internal and external)
c.7)	Performance of external providers
d)	Adequacy of resources
e)	Effectiveness of actions taken to address risks and opportunities
f)	Opportunities for improvement

9.3.3 Outputs

The three outputs the clause requires, each as a free-text field.

Clause	Output
a)	Decisions and actions related to opportunities for improvement
b)	Decisions and actions related to any need for changes to the QMS
c)	Resource needs

Tip

Each output should reference the input clause it responds to (e.g. “Per c.4, raise CAPA-2026-0042 against repeat solder defect”). External auditors look for that traceability.

Attendees

Attendees are stored in a junction table linking the review to one or more employees. Top management presence is expected — at minimum the chair, ideally a second top-management witness. The PDF lists every attendee by name and role.

Attendees can be edited until the review is completed. Adding or removing an attendee is recorded in the activity log.

Attachments

Each review supports evidence attachments — exported KPI dashboards, customer-survey results, audit reports, board minutes. Files are stored in Cloudflare R2.

• Cap: 25 MB per file.
• Allowed: PDF, common image formats (PNG, JPG, WebP), and Office documents (.docx, .xlsx, .pptx).
• The whitelist is enforced both client-side and in the upload Route Handler.

Attachments persist for the life of the review and appear as a list on the detail page. They are referenced (by filename) on the PDF but not embedded.

PDF export

Click Download PDF on the review detail page. The request hits a Route Handler at /api/reports/management-review/[id] which builds the document with pdfkit on the server and streams it back. Layout:

• Header — Sertiq logo, organisation name, review number, status badge.
• Meta block — organisation, status, review date, review period (start–end), chair, attendee count.
• Attendees — full list with name and role.
• 9.3.2 Inputs — every clause from a) to f), rendered in order, with the clause label and the captured text. Blank fields print “Not captured” so omissions are obvious.
• 9.3.3 Outputs — clauses a), b), c) in order, same rule for blank fields.
• Summary — short close-out paragraph plus closed_at timestamp once completed.

This document is the retained documented information that ISO 9.3 expects. Save it to your management-review folder.

Numbering

• Reviews: MR-YYYY-NNN, sequential per organisation per calendar year. Assigned in create_management_review (SECURITY DEFINER).

The RPC validates that the actor belongs to the review’s organisation and that the chair employee also belongs to it. Two users creating reviews at the same instant cannot collide on the same number.

Related

• Internal Audits — audit results are one of the named 9.3.2 inputs (clause c.6).
• ISO 9001 §9.3 — the clause this module implements.