Audit Findings to Management Review: Proven Steps That Work

ISO 19011:2026 · Internal Audit · Management Review

By Diana Lynn, President and Principal ISO Consultant, MSI · Updated October 21, 2026

Moving audit findings to management review is the handoff that turns what auditors find into decisions leaders make — and where most systems leak value.

Here is how the leak usually looks. A nonconformity is written up in March. The corrective action is closed in April. In October the same problem shows up again, in a different department, written by a different auditor.

Then the management review meeting comes and goes, the slide says “internal audits: complete,” and nobody in the room connects the two findings. The audit did its job. The loop did not.

After 28 years of ISO consulting and more than 200 audits attended, much of it seeing findings first-hand from the registrar’s side of the table, I can tell you this pattern is far more common than a missing procedure. Organizations audit diligently. They rarely engineer the path from audit findings to management review so that top management actually decides something. This guide shows you how to build that path under ISO 19011:2026, ISO 9001:2026 and ISO 14001:2026.

The Definition

What Does Moving Audit Findings to Management Review Actually Mean?

Find. Conclude. Decide.

Moving audit findings to management review means carrying information through five distinct stages, each with its own owner and its own definition in ISO 19011:2026. Skip a stage and the information arrives at the boardroom table as noise, or does not arrive at all.

ISO 19011:2026 Clause 3.11 defines an audit finding as the result of evaluating collected audit evidence against audit criteria. A finding can show conformity or nonconformity, and Note 2 to that entry adds that findings can identify risks, opportunities for improvement or good practices.

Clause 3.12 defines an audit conclusion as the result of an audit after considering the audit objectives and all audit findings. That difference matters. Findings are individual observations. Conclusions are judgments about the system.

The full chain looks like this:

1. Finding. The auditor evaluates evidence against criteria (ISO 19011:2026 Clause 6.4.8).
2. Conclusion. The audit team weighs all findings against the audit objectives, including trends across areas (Clause 6.4.9.2).
3. Report. The audit team leader records findings, conclusions and the degree to which criteria were fulfilled (Clause 6.5.1).
4. Follow-up. The auditee takes action, and completion and effectiveness are verified (Clause 6.7).
5. Decision. Top management reviews audit results as a required input and documents decisions (ISO 9001:2026 Clauses 9.3.2 and 9.3.3).

Most organizations do stages one, three and four reasonably well. Stage two, the conclusion, is often thin, and stage five, the move from audit findings to management review, is where the chain snaps. Our internal audit follow-up guide covers stage four in depth. This article focuses on the handoff from audit findings to management review and back into the audit program.

What Changed

What Changed in ISO 19011:2026 — and What Didn’t?

Read. Compare. Apply.

ISO published ISO 19011:2026 on May 27, 2026, as the fourth edition of the guidelines for auditing management systems. It cancels and replaces ISO 19011:2018. As of October 2026, there is no transition period, because ISO 19011 is a guidance document rather than a certifiable standard.

The Foreword lists only two main changes: expanded guidance on remote auditing methods drawn from ISO/IEC TS 17012:2024, and an expanded Annex A covering remote auditing methods and virtual locations. Clause 3.4 now defines a remote auditing method, and Annex A.16 explains how to use one. For a clause-by-clause view, see our ISO 19011:2026 changes overview.

What did not change is just as important. The guidance on managing audit program results (Clause 5.5.6), determining audit conclusions (Clause 6.4.9), reporting (Clause 6.5) and follow-up (Clause 6.7) carries forward. So if your loop from audit findings to management review was weak under the 2018 edition, the 2026 edition will not fix it for you. It simply removes the excuse that remote audits produce lower-quality inputs, because remote audits are now expected to meet the same principles.

One more accuracy point. ISO 19011 uses “should” throughout. It is guidance. The obligations live in the management system standards themselves. ISO 9001:2026 Clause 9.2.2 includes a NOTE pointing to ISO 19011 for guidance, and a NOTE creates no obligation.

That is why the table later in this article separates what is required from what is recommended.

Field Experience

Where Does the Loop From Audit Findings to Management Review Break?

Spot. Trace. Repair.

Across 80+ certifications supported, the same five break points show up again and again. None of them is a documentation problem. Each one is a procedure that looks fine on paper and fails in practice.

1. Findings are reported, but conclusions are never drawn

ISO 19011:2026 Clause 6.4.9.2 d) advises that audit conclusions address similar findings made in different areas, or from a previous audit, to identify trends. Many internal audit reports list findings and stop. Without a conclusion, the path from audit findings to management review delivers a count of nonconformities rather than a judgment about whether the system is effective.

2. Corrective actions close on completion, not effectiveness

ISO 19011:2026 Clause 6.7 advises that both completion and effectiveness of actions be verified. ISO 9001:2026 Clause 10.2.1 d) requires reviewing the effectiveness of any corrective action taken. When the tracker turns green the day the action is done, the trend data carried from audit findings to management review overstates system health. Our corrective action procedure guide shows how to separate the two.

3. The audit summary is one slide at the end of the agenda

MSI client experience suggests that when the handoff of audit findings to management review is squeezed into the last ten minutes of the meeting, results get acknowledged rather than discussed. ISO 9001:2026 Clause 9.3.2 d) 3) requires trends in audit results as an input. A single “audits complete” bullet is not a trend.

4. Management review records minutes, not decisions

ISO 9001:2026 Clause 9.3.3 requires that management review results include decisions related to continual improvement opportunities, any need for changes to the quality management system, and resource needs. Minutes that say “audit results were reviewed” document attendance. They do not document a decision, and moving audit findings to management review is only worth doing if leaders decide something.

5. Decisions never reach the next audit program

ISO 9001:2026 Clause 9.2.2 requires the organization to consider the results of previous audits when establishing the audit program. If last year’s management review decided that supplier control was a weak area, the next audit program should show more time, a stronger auditor or a different method there. When the schedule looks identical year after year, the loop from audit findings to management review is open in the return direction. The systemic failure article explores how small open loops become large problems.

“Having systems, acting on what the records are reporting, and never letting anyone deny the facts is what prevents good systems from deteriorating.”

— Diana Lynn, President and Principal ISO Consultant, MSI

Requirement Status

What Is Required Versus Recommended When Moving Audit Findings to Management Review?

Shall. Should. Choose.

The table below lists each element of the loop from audit findings to management review, the clause it comes from, and its status. A requirement uses “shall.” ISO 19011 guidance uses “should” and is recommended practice. MSI recommendations are our field experience and carry no clause authority at all.

Notice that ISO 14001:2026 Clause 9.2.2 does not carry the “correction and corrective action without undue delay” item that ISO 9001:2026 adds. Environmental management systems handle that obligation through Clause 10.2 instead. If you run a combined system, your procedure should satisfy both routes.

The Method

How Do You Turn Audit Findings Into Management Review Decisions?

Gather. Grade. Govern.

The seven steps below are the practical path from audit findings to management review decisions. Each step names the clause it rests on so the method stays defensible when a registrar asks why you do it this way.

Step 1: Define the audit objective before the audit starts

ISO 9001:2026 Clause 9.2.2 a) requires audit objectives, criteria and scope for each audit. Write at least one objective that management review cares about, such as “determine whether supplier delivery problems from Q2 have been resolved.” An audit with a decision-relevant objective produces a decision-relevant conclusion. Our internal audit planning guide shows how to build those objectives.

Step 2: Record findings so they can be trended

ISO 19011:2026 Annex A.18.3 advises recording the criteria, the evidence, why the criteria are not fulfilled, related findings and the grade where grading is used. Add a process tag and a clause tag to every finding. Without consistent tags, nobody can see that three “minor” findings in three departments are really one systemic weakness.

Step 3: Grade nonconformities with defined criteria

ISO 19011:2026 Clause 6.4.8 notes that nonconformities can be graded quantitatively or qualitatively, and that grading criteria should be defined and communicated. A defined grading scale lets management review compare this year to last year honestly. The internal audit risk matrix is a useful starting model.

Step 4: Write audit conclusions, not just a findings list

Clause 6.4.9.2 advises conclusions on the extent of conformity, the effectiveness of the system in meeting intended results, the identification of risks, the effectiveness of actions taken on risks, and trends. To strengthen audit findings to management review, ask your audit team to write three sentences for each audit: Is the process effective? What is the trend? What should leadership know? Writing conclusions that leaders can act on is a skill, and it is a core reason MSI’s new ISO 9001:2026 Internal Auditing course requires every learner to complete a real internal audit report.

Step 5: Verify follow-up for effectiveness

Clause 6.7 notes that verification can be part of a subsequent audit. Set an effectiveness check date when the corrective action is opened, typically after enough cycles of the process have run to prove the fix held. Report actions as “verified effective,” “complete, not yet verified” or “open.” Only the first category belongs in the “closed” column when you carry audit findings to management review.

Step 6: Package audit results as decision-ready inputs

This is the step where audit findings to management review stops being a reporting exercise. Present audit results by process, with trends, repeat findings, overdue actions and a recommended decision for each item. Our ISO management review procedure guide shows the full agenda structure, and the free 5 Steps to a Decision-Ready ISO Management Review walks through how to make every review decision-ready.

Step 7: Record decisions, owners and dates, then change the audit program

ISO 9001:2026 Clause 9.3.3 requires documented decisions. For every item that moved from audit findings to management review, record the decision, the owner, the due date and the effect on the next audit program. Then carry those decisions into next cycle’s planning, which satisfies the Clause 9.2.2 requirement to consider previous audit results.

Original MSI Tool

How Do You Score the Handoff From Audit Findings to Management Review?

Score. Rank. Raise.

I created the Audit-to-Decision Handoff Scorecard for this article so you can measure how well you move audit findings to management review in about fifteen minutes. Pull your last two internal audit reports and your last management review record. Score each criterion 0, 1 or 2, then add the total.

How to read your score (out of 16):

• 13–16: Closed loop. Audit findings to management review flows in both directions. Focus on sharpening conclusions.
• 8–12: Leaking loop. Information moves from audit findings to management review but rarely changes what happens next. Start with criteria 5, 7 and 8.
• 0–7: Open loop. Audits and management review run as separate events. Rebuild the handoff of audit findings to management review before the next meeting.

Run the scorecard after every cycle of audit findings to management review and track the total over time. A rising score is a measurable sign that your internal audit process is producing value, not just records. If you want a broader read on audit maturity, take MSI’s free Internal Audit Maturity Check, and pair it with the Nonconformity and Corrective Action Maturity Check.

Quality and Environmental

How Do ISO 9001:2026 and ISO 14001:2026 Treat Audit Findings to Management Review?

Align. Integrate. Improve.

Both standards require moving audit findings to management review as trend data, but they ask for different outputs. If you run a combined quality and environmental system, design one review that satisfies both lists.

The ISO 14001:2026 results list is richer. It asks for conclusions on the continuing suitability, adequacy and effectiveness of the environmental management system, plus any implications for the organization’s strategic direction. That means an environmental audit conclusion such as “compliance obligation tracking is not keeping pace with permit changes” should produce a strategic decision, not just a corrective action. Our ISO 14001:2026 management review article covers the environmental inputs in detail, and evaluation of compliance explains the compliance trend data auditors should feed forward.

ISO 13485 organizations face the same discipline. Clause 5.6.2 lists audits among the required management review inputs, and the regulatory context raises the stakes. FDA’s MDSAP management review procedure is a useful public example of how a regulator structures its own reviews. See our ISO 13485 management review guide for medical device specifics.

Decision Rules

What Decisions Should Management Review Make About Audit Results?

See. Decide. Assign.

Top management often hesitates at the moment audit findings to management review should produce a decision, because nobody has told them what kind of decision is expected. Use the decision table below to translate each audit pattern into a decision type that ISO 9001:2026 Clause 9.3.3 recognizes.

The last row matters more than most people think. ISO 19011:2026 Clause 5.5.6 suggests communicating audit conclusions and good practices to other areas of the organization. Management review is the natural place to decide that a good practice becomes the standard. The continual improvement under ISO 9001 article shows how to turn those decisions into projects.

Leadership behavior is part of this. When top management treats audit results as someone else’s paperwork, the organization learns that findings do not matter. As I tell every client, there is nothing worse than leadership causing the nonconformities. Our article on leadership nonconformities explains how that happens and how to prevent it.

Closing the Loop

How Do Management Review Decisions Feed Back Into the Audit Program?

Review. Revise. Repeat.

A loop has two directions. The first carries audit findings to management review. The second carries management review decisions back into the audit program. Most procedures describe the first direction and forget the second.

ISO 19011:2026 Clause 5.6 lists factors that can indicate a need to modify the audit program, including changes to audit findings, the demonstrated effectiveness and maturity of the management system, and the standards to which the organization is committed. Clause 5.7 then advises that the individual managing the audit program and the audit client review the program, identify opportunities for improvement and report results to relevant interested parties. Lessons learned from that review become inputs for improving the program.

In practice, I recommend a short “audit program impact” column on the management review decision record. For every decision, ask one question: does this change what, where, how or how often we audit? Typical answers include:

• Increase audit frequency for a process with repeat findings.
• Assign an auditor with deeper technical competence to a high-risk area.
• Add a remote auditing method for a virtual location, using ISO 19011:2026 Annex A.16.
• Add a follow-up audit to verify a major corrective action, as Clause 5.5.6 e) suggests considering.
• Reduce time in a stable, mature area to free capacity for a weaker one.

That column is what makes the full cycle of audit findings to management review, and back again, measurable. Our article on internal audit risk mitigation strategies shows how to weight these changes by risk, and the ISO 19011:2026 internal audit procedure guide includes a free audit program checksheet you can use to record them.

Frequency deserves a direct word. Registrars across the industry expect every requirement of the standard to be internally audited each year. Companies that follow their procedures often believe they are compliant, but skipping internal audits breaks the very first link in the chain.

“If you are not doing internal audits on an annual basis, you are not compliant.”

— Diana Lynn, President and Principal ISO Consultant, MSI

Measurement

Which Metrics Prove Audit Findings to Management Review Is Working?

Measure. Show. Sustain.

ISO 9001:2026 Clause 9.1.3 requires the organization to analyze and evaluate data, including the performance and effectiveness of the quality management system. Apply that same discipline to the flow of audit findings to management review itself. These six metrics give top management a concise, measurable view.

Organizations typically report that the repeat finding rate is the single most persuasive number for leadership, because it shows whether corrective actions are actually working. The ISO 9001 quality objectives guide explains how to set a measurable target for any of these metrics. Auditor competence moves every one of them, which is why ISO 19011:2026 Clause 5.7 includes the continual professional development of auditors in the audit program review.

2026 Transitions

Why Is Management Review the Best Place to Start Your 2026 Transition?

Begin. Plan. Transition.

ISO 9001:2026 was published on September 16, 2026. According to Global ACI’s transition requirements, as of October 2026, new and initial certifications can be issued only to the 2026 edition from March 31, 2028, and organizations certified to ISO 9001:2015 must complete their transition by September 30, 2029. ISO 14001:2026 was published on April 15, 2026, with a transition deadline of April 30, 2029, as of October 2026. The ISO 9001:2026 overview from ISO and ANAB’s ISO 14001:2026 guidance summarize the changes.

MSI recommends starting a transition with management review rather than a document rewrite. The quickest version is what I call an “End in Mind” management review. Put the data you already have on the review slides using the 2026 input list, and mark any missing data “TBD” with a date. Your audit results are usually the richest existing data, so the loop from audit findings to management review becomes the backbone of your transition plan. Every TBD becomes a planned action, and every planned action has an owner.

Use the free ISO Transition Risk Scorecard to rank where your system needs the most work, and read ISO transition risk assessment for the reasoning behind it. For a summary of the quality standard’s revisions, see ISO 9001:2026 changes.

Why MSI

How Does ISO Consulting Help Close the Loop Faster?

Experience. Evidence. Results.

Building the loop from audit findings to management review is not complicated, but it is easy to get subtly wrong. Experienced ISO consulting shortens the learning curve because a consultant has seen how dozens of organizations structure the same handoff, and which versions hold up over time.

MSI brings measurable depth to that work: 28 years of experience, 80+ certifications supported, 200+ audits attended and 600+ professionals trained across manufacturing, technology, medical device, government, healthcare and other regulated industries. What makes our perspective unusual is how many of those findings we watched being written from the registrar’s point of view. That vantage point shows exactly which internal audit conclusions survive scrutiny and which management review records fall apart under questioning.

There are three ways we typically help organizations move audit findings to management review:

• Internal audits performed for you. MSI’s internal audit services deliver reports written with conclusions and trends that drop straight into management review.
• Year-round maintenance. The SureResults ISO Maintenance Program keeps audits, follow-up and management review on schedule so the loop never stalls. The top ISO maintenance risks article shows what slips first.
• Training your auditors. MSI’s just-released ISO 9001:2026 and ISO 14001:2026 Internal Auditing courses train the people who start the loop. Many of MSI’s online courses can also be delivered at your site for a full team, and I personally review every learner’s completed internal audit report before a certificate is issued.

“I have always felt that integrity is at the center of all ISO standards.”

— Diana Lynn, President and Principal ISO Consultant, MSI

Integrity is exactly what a closed loop protects. When the path from audit findings to management review is honest, and decisions come back honestly, nobody can deny what the records show.

FAQ

Audit Findings to Management Review: Common Questions Answered

Ask. Answer. Act.

Does ISO 19011:2026 require audit findings to go to management review?

What changed in ISO 19011:2026 compared with the 2018 edition?

Should every individual audit finding be presented at management review?

Who should report audit results to management review?

How often should audit findings be reviewed by top management?

What documented information proves the loop is closed?

Can one management review cover ISO 9001 and ISO 14001 audit results?

Keep Reading

Related Reading on Audit Findings to Management Review

Learn. Link. Lead.