Management Review: Running the Meeting That Proves the Quality System Works

Management review is the meeting where senior leadership looks at the whole pharmaceutical quality system, decides whether it is working, and commits resources to fix what is not. Done well, it is the single best piece of evidence you can show an inspector that quality is governed from the top and not just enforced from the QA cubicles. Done badly, it is a slide deck nobody reads, a record of attendance with no decisions, and a finding waiting to happen.

This article covers what ICH Q10 actually requires, what goes into the meeting, how to run it step by step, what good looks like, and how to present the whole thing under inspection without flinching. The worked examples are generic and use no real company or product information.

What management review is and why it is required

Management review is a structured, periodic evaluation of the pharmaceutical quality system (PQS) performed by senior management, with documented inputs, decisions, and follow-up actions. It is the mechanism by which leadership takes ownership of quality rather than delegating it entirely.

The primary basis is ICH Q10, Pharmaceutical Quality System (2008). Q10 names management review as one of the four PQS elements (alongside the process performance and product quality monitoring system, CAPA system, and change management system) and it dedicates a section to management responsibilities. Q10 expects senior management to review the performance of the PQS on a periodic basis and to ensure continual improvement. Two specific Q10 ideas drive the meeting:

The first, drawn from ICH Q10 Section 3.2.4 (Management Review of Process Performance and Product Quality), is that the review exists to give leadership confidence that performance and quality stay in control across the product lifecycle. The second, also from Section 3.2.4, is that the review has to carry forward the open items from earlier reviews, from periodic quality reviews, and from the CAPA system, so nothing falls through the gaps between meetings.

ICH Q10 is guidance, not law on its own. It becomes enforceable through the GMP regulations that the agencies do enforce:

• In the US, 21 CFR Part 211 does not use the words “management review,” but the FDA guidance “Quality Systems Approach to Pharmaceutical CGMP Regulations” (2006) describes management responsibility and review of the quality system, and inspectors evaluate whether senior management is engaged.
• In the EU, EudraLex Volume 4, Chapter 1 (Pharmaceutical Quality System) explicitly requires periodic management review with the involvement of senior management, including review of process performance, product quality, and the effectiveness of the PQS.
• For medical devices, the requirement is harder edged. ISO 13485:2016 Section 5.6 mandates management review at planned intervals and lists the required inputs and outputs. The US device QMS regulation (21 CFR Part 820, and the amended Quality Management System Regulation, QMSR, which incorporates ISO 13485 with an effective date of February 2, 2026) carries an explicit management review requirement.

The risk rationale is straightforward. A quality system generates thousands of signals a year: deviations, complaints, out of specification results, audit findings, change controls, training gaps, supplier problems. Any one of them can be closed in isolation while the underlying system quietly degrades. Management review is the altitude check. It is where leadership sees the aggregate, spots the trend that no single CAPA owner could see, and reallocates people and money before a recurring problem becomes a recall or a warning letter. Inspectors love this topic precisely because a weak management review almost always sits on top of weak metrics, slow CAPAs, and a quality culture that tolerates drift.

Who owns it and who does what

Management review is a leadership activity, not a QA chore, even though QA usually runs the logistics. Confusing the two is the most common structural mistake.

A clean way to think about it: QA assembles and curates the data and runs the meeting, but management decides and owns the outcome. If your minutes show QA assigning all the actions to QA, you have a governance problem. The whole point is that manufacturing fixes manufacturing problems and engineering fixes engineering problems, with quality oversight.

Cadence: how often and at what level

ICH Q10 says “periodic” and does not fix an interval, which leaves it to your procedure to justify. The defensible industry norm is a tiered cadence:

• Monthly or quarterly operational quality reviews at the site or function level (sometimes called a quality council, quality operations review, or tier meeting). These look at fresh metrics and manage the day to day signals.
• Quarterly or at minimum annual executive management review that rolls up the operational reviews, looks at trends over a longer window, and engages the most senior site or corporate leadership.

ISO 13485 and the QMSR require management review “at planned intervals” and at “defined intervals.” The phrase “planned” and “defined” is doing real work: the inspector wants to see the interval written in your SOP and then evidence you met it. An annual review is acceptable for many small organizations; for a complex multi product site, annual only is usually too thin to catch trends in time.

Two cadence traps:

1. Defining a frequency you cannot keep. If your SOP says monthly and you held seven meetings last year, that is a procedural deviation against your own document, and it is an easy finding. Set a cadence you will actually meet, then meet it.
2. No mechanism for an out of cycle review. Your procedure should allow triggering an extraordinary management review when a major event occurs (a critical recall, a serious inspection finding, a significant data integrity signal) rather than waiting for the calendar.

What goes into it: the required inputs

The inputs are where most of the regulatory specificity lives. ISO 13485:2016 Section 5.6.2 spells out a required input list, and ICH Q10 plus EU Chapter 1 imply a similar set for drugs and biologics. A management review that demonstrates control over the PQS should pull from the following categories. Treat this as your standing agenda.

The single most overlooked input is the last but one: status of actions from the previous management review. Both ICH Q10 and ISO 13485 call this out specifically. If you do not open every meeting with the prior actions, the review becomes a series of disconnected snapshots with no accountability loop, and an inspector who pulls two consecutive minutes will see the gap immediately.

A practical principle: bring trends, not single data points. A management review that shows “we had 14 deviations this quarter” tells leadership nothing. “Deviation rate per batch has risen for three consecutive quarters, driven by the filling line, and the top recurring cause is the same human error mode we closed a CAPA on last year” gives leadership something to decide about.

What comes out: the required outputs

Outputs are what separate a real management review from an information session. Under ISO 13485:2016 Section 5.6.3, the review has to produce decisions and actions in four areas: keeping the quality system suitable, adequate, and effective; improving the product against customer and regulatory requirements; meeting resource needs; and responding to new or changed regulations that apply to the organization. The same logic applies under Q10.

Your record should capture, at minimum:

• Decisions on the state of the PQS (is it effective, conditionally effective, or not).
• Actions with a single named owner and a due date for each issue raised.
• Resource commitments (headcount, capital, systems) where the data shows the system is under-resourced.
• Escalations to corporate or to the next tier where the site cannot resolve an issue.
• Conclusion statement on overall PQS effectiveness for the period.

The conclusion statement is the part people skip and inspectors hunt for. Leadership has to actually say, on the record, whether the quality system is working. “The PQS is judged effective for the period, with the following exceptions and actions” is a defensible output. A record that lists data and assigns a couple of actions but never renders a verdict on effectiveness has not done the one thing Q10 asks of senior management.

How to run it: step by step

Here is a concrete procedure for a quarterly executive management review, assuming a tiered system feeds it.

Step 1: Lock the schedule and roles (standing, off-cycle work)

Publish the year’s review dates in advance. Confirm the chair (senior management) and required attendees, and define a quorum in your SOP, for example “the review cannot proceed without the site head and the head of quality present.” Pre-defining quorum protects you from the “the meeting happened but the boss skipped it” finding.

Step 2: Collect and curate the inputs (T minus 3 to 4 weeks)

The coordinator pulls each input from its source system against a fixed data cutoff date. Use the same cutoff and the same definitions every period so trends are comparable. This is where a metrics program earns its keep: if your quality metrics and KPIs are defined and automated, this step is hours not weeks.

Step 3: Analyze and pre-read (T minus 1 to 2 weeks)

Functional leads turn raw metrics into a short narrative: what the number is, whether it is in or out of tolerance, the trend, the why, and what they propose. Distribute a pre-read package so the meeting is for decisions, not for people seeing data for the first time. A meeting where everyone reads slides live is a wasted meeting.

Step 4: Run the meeting (the meeting itself)

A workable agenda and rough time budget for a two hour review:

Discipline matters. The chair drives toward decisions. Every issue raised exits the meeting either as accepted-and-tracked-elsewhere or as a new action with an owner and a date.

Step 5: Record and decide (within days)

Write minutes that capture attendance, the inputs reviewed (with the data cutoff), the discussion of each, the decisions, the new actions, the resource commitments, and the effectiveness conclusion. Get the chair and head of quality to approve and sign. The signed record is your evidence.

Step 6: Track actions to closure (continuous)

Load every new action into a tracker with owner, due date, and status. This tracker is the connective tissue between meetings. Actions that age past due are themselves a management review input next period. An action that has been “in progress” for four quarters tells the inspector your governance loop is open.

Step 7: Cascade and escalate (after)

Push relevant decisions down to the functions and up to corporate where escalated. Confirm resource commitments are actually being actioned (a committed headcount that never gets a requisition is a credibility problem the next time leadership asks for trust).

Acceptance criteria: what good looks like

Use this as a self-check before you call a management review fit for inspection.

• The interval matches what your SOP says, with no missed meetings, or with documented justification if one slipped.
• Senior management attended. The chair is genuinely senior and present in the record, not just on the distribution list.
• Every required input category is represented, with a clear data cutoff and consistent definitions period to period.
• Inputs are presented as trends with interpretation, not as raw counts.
• The status of every prior action is reviewed at the top of the meeting.
• Each issue exits as a tracked action with a single owner and a due date.
• The record contains an explicit conclusion on PQS effectiveness.
• Resource decisions are captured where the data warranted them.
• Minutes are approved and signed by senior management within a defined timeframe.
• Actions are tracked to closure and overdue actions are visible.
• You can show two or three consecutive reviews and demonstrate the action thread connecting them.

If you can hand an inspector the last two reviews and the action tracker and walk the thread from a signal to a decision to a closed action to an effectiveness check, you are in good shape.

Worked example: a quarterly review record (excerpt)

What follows is a generic, filled-in fragment of a management review record. No real company, site, or product.

Management Review Record, Q2, Site A (anonymized) Date held: 2026-04-18 Data cutoff: 2026-03-31 Chair: Site Head Co-chair: Head of Quality Attendees: Manufacturing Lead, QC Lead, Engineering Lead, Supply Chain Lead, Regulatory Lead, QA Coordinator (recorder) Quorum met: Yes (Site Head and Head of Quality present)

Status of prior actions:

Selected inputs and discussion:

New actions:

Conclusion on PQS effectiveness: The PQS is judged effective for the period with two exceptions under active management: the rising filling-line deviation trend and the CAPA aging driven by an under-resourced quality engineering team. Actions and a resource commitment are in place to address both. Next review: Q3.

Approvals: Site Head (signed 2026-04-22), Head of Quality (signed 2026-04-22).

Notice what makes this defensible. There is a data cutoff. Prior actions are tracked and one is honestly flagged overdue rather than hidden. Trends are shown over four quarters. A resource decision was actually made. And leadership rendered a verdict on effectiveness rather than ducking it.

Escalation: connecting the tiers

A management review does not stand alone. It sits at the top of an escalation pyramid. Issues that a tier or shift meeting cannot resolve roll up to the operational quality review; issues the site cannot resolve roll up to the executive management review; issues the site cannot resolve at all roll up to corporate.

Design the escalation criteria explicitly so escalation is not a judgment call made differently by each person. Reasonable triggers to escalate an item to management review include:

• A deviation or complaint trend that crosses a pre-defined threshold.
• A CAPA that has missed its due date by a defined margin or recurred after closure.
• A repeat finding across audits or inspections.
• A resource gap that a function cannot close within its own budget.
• A significant data integrity signal.
• Any critical classification event (critical deviation, recall, critical audit finding).

The reverse path matters too. Decisions and actions cascade down. A resource commitment made at executive review has to reach the manager who files the requisition. Document the cascade so the loop is closed in both directions.

A clean escalation design is one of the strongest things you can show an inspector, because it demonstrates that signals do not die at the bottom. Tie this to your broader quality event classification and triage so that what gets escalated is consistent with how events are classified at intake.

Action tracking: the part that gets cited

If management review has a single point of failure, it is action tracking. Leadership will assign actions in the room with good intent, and then a year later half of them are open, overdue, or quietly forgotten. Inspectors know this and they pull the action log on purpose.

Build the tracker so it survives scrutiny:

• One owner per action. Shared ownership means no ownership.
• A real due date, not “ongoing.” If something is genuinely continuous monitoring, classify it that way explicitly rather than parking it as a perpetual open action.
• Status with dates, so you can show when it moved.
• A link back to the meeting and forward to the evidence of closure (the CAPA number, the SOP revision, the validated change).
• An aging view that makes overdue items impossible to miss.
• Overdue actions fed back in as a management review input, so the system polices itself.

The acceptance test: pick any closed action from a year ago and trace it to objective evidence that it was done and that it worked. If the evidence is “QA says it is closed,” you have a documentation gap. Tie effectiveness verification of management-review CAPAs to your CAPA effectiveness verification process so closure means resolved, not just actioned.

How to present it under inspection

Management review is high on the list of things modern inspectors ask for, especially in EU and ISO 13485 contexts where the requirement is explicit. Expect the request early. Here is how to handle it.

What they will ask for. The management review SOP, the last one to three review records with minutes and signatures, the action tracker, and often the metrics that fed a specific input. They may ask to see the trend behind a number you presented.

How to present it. Lead with the SOP so the inspector sees the defined cadence, inputs, outputs, and roles. Then walk the most recent record, showing the prior-action review at the top, the trended inputs, the decisions, and the signed effectiveness conclusion. Then show the action tracker and walk one or two actions from signal to closure to effectiveness check. The story you are telling is: signals come in, leadership sees them in aggregate, leadership decides and commits resources, actions get tracked and verified, and the loop closes. That narrative is what proves the PQS is governed.

What not to do. Do not present a deck with no decisions. Do not show minutes where the site head did not attend. Do not let the inspector be the one to discover an overdue action you did not mention; surface it yourself with the recovery plan. Honesty about a known gap with an action in place reads as a controlled system. A hidden gap that the inspector finds reads as the opposite.

Coordinate this with your overall inspection readiness and FDA inspection readiness preparation so the management-review story is rehearsed and the binder is current, not assembled the night before.

Common mistakes and inspection-finding patterns

These are the recurring failure modes that show up as findings. None reference any specific company.

• Senior management not actually present. The single most damaging pattern. If the record shows quality talking to itself, the regulator concludes leadership is not engaged, which undercuts the entire premise of Q10.
• Frequency not met. SOP says quarterly, records show two meetings. A procedural deviation against your own document, and an easy citation.
• Prior actions not reviewed. No accountability loop. Each meeting is a fresh snapshot, and overdue actions accumulate unseen.
• Inputs missing. A required category (complaints, supplier quality, audit results) is simply absent from the record. With ISO 13485 the input list is explicit, so a missing category is a direct nonconformity.
• Data without analysis. Counts presented with no trend and no interpretation. Leadership cannot govern what it cannot understand.
• No decisions or no effectiveness conclusion. The meeting recorded information but management never rendered the verdict Q10 asks for.
• Actions with no owner or due date, or a tracker full of long-overdue actions. Demonstrates the loop does not close.
• Effectiveness asserted but not evidenced. Saying the PQS is effective while the metrics show rising deviations and aging CAPAs, with no acknowledgment of the contradiction.
• Management review disconnected from the data systems. Numbers in the deck that do not reconcile with the deviation, complaint, or CAPA systems. Once an inspector finds one mismatch, they distrust the whole record.
• Resource commitments made and never honored. A pattern of leadership “approving” headcount or capital that never materializes erodes the credibility of the whole exercise.

Interview-ready: questions you should be able to answer

If you are interviewing for a quality role, or being questioned by an inspector, these are the questions that come up and strong ways to answer them.

What is the regulatory basis for management review? ICH Q10 names it as a management responsibility and a PQS element. It is enforced through GMP regulations: EU GMP Chapter 1 requires periodic management review with senior management involvement; the FDA quality systems guidance describes management responsibility for the quality system; and for devices, ISO 13485 Section 5.6 and the US QMSR mandate it explicitly with a defined input and output list.

Who has to be in the room? Senior management, genuinely. The site head or equivalent and the head of quality at minimum, plus the functional leads who own the data. The whole point is leadership ownership, so a review without senior management present fails its own purpose.

What are the required inputs? Process performance and product quality, deviations and investigations, CAPA status, complaints, change control, audit and inspection results, supplier quality, recalls and field actions, regulatory changes, training and resources, customer/post-market feedback, status of prior actions, and progress against quality objectives. ISO 13485 5.6.2 gives the explicit device list; the same set applies in spirit for drugs.

What are the required outputs? Decisions on PQS effectiveness, actions with owners and dates, resource commitments, escalations, and an explicit conclusion on whether the system is effective. ISO 13485 5.6.3 frames outputs as improvements to the PQS, improvements to product, and resource needs.

How often should it happen? Periodically, with the interval defined in your SOP and then met. A tiered cadence is common: monthly or quarterly operational reviews feeding an annual or quarterly executive review. The key is that the interval is defined and honored, and that there is a trigger for an out of cycle review after a major event.

What is the most common finding on this topic? Senior management not attending, the frequency not being met, prior actions not reviewed, and actions assigned with no owner or due date and then left overdue. The underlying theme is a review that looks like governance on paper but has no closed loop.

How do you know your management review is effective? I can take any signal, a rising deviation trend say, and trace it through the review record to a leadership decision, a resourced action with an owner and date, evidence the action was completed, and an effectiveness check confirming the trend reversed. If I can walk that thread across consecutive reviews, the loop is closed and the system is governed.

How does management review connect to the rest of the PQS? It sits at the top of the escalation pyramid. It consumes outputs from CAPA, deviation, change control, complaint, audit, and metrics systems, aggregates them into trends, and produces decisions and resource commitments that flow back down. It is the integration point where leadership sees the whole system rather than individual events.

Practical tips

• Automate the metrics. The biggest drag on management review is manual data assembly. If your quality metrics program produces the trends on a fixed cutoff, the coordinator’s job shrinks from weeks to hours and the data reconciles with source systems by construction.
• Keep input definitions stable. Changing how you count deviations between quarters destroys the trend. Lock the definitions in the SOP.
• Make the chair run the room. Quality should curate and present, but the senior leader should drive decisions. If QA is assigning all the actions, governance has slipped.
• Write the effectiveness conclusion as a sentence, every time. Forcing leadership to state effectiveness on the record is the discipline that makes the meeting real.
• Surface your own overdue actions before the inspector does. A known gap with a recovery plan reads as control. A hidden one reads as the opposite.
• Pre-read or it fails. A meeting where people see data live is a status update, not a review. Send the package early and use the room for decisions.
• Tie it to triage. Consistent quality event classification at intake means consistent escalation into the review, which means the right things reach leadership.

Related reading

• Pharmaceutical Quality System for the ICH Q10 framework that management review sits inside.
• Quality Metrics and KPIs for the trended inputs the meeting depends on.
• What is a CAPA and CAPA Effectiveness Verification for the action and verification loop the review oversees.
• Quality Event Classification and Triage for how signals get classified and escalated upward.
• Annual Product Review (PQR) for a key product-level input.
• FDA Inspection Readiness and Inspection Readiness for presenting the review under inspection.
• Internal Audit Program and Quality Metrics and KPIs for two of the most scrutinized inputs.