Use this for each scheduled review, typically once or twice a year, and for an extra review after a major incident or a large change. You get four files in a new folder, ./management-review-pack/: a two to four page briefing leadership reads before the meeting (pre-read.md); the meeting agenda, decisions first (agenda.md); a minutes template with blanks for what leadership decides (minutes-draft.md); and a spreadsheet you can open in Excel tracking every action, its owner and due date (actions.csv). This skill drafts for a human to review and sign; this skill never marks a control effective. Leadership makes the decisions; the minutes record what they decided, never what the skill proposed.

Inputs to gather

Read the previous review's minutes and action log, the risk register and treatment plan, internal and external audit reports and the finding tracker, the incident log, the objectives and metrics the management system set itself, supplier issues, customer complaints and security questionnaire trends, and any change in scope, regulation, products or organisation since the last review. Ask the reader in one message: who attends and who chairs, how long the meeting is, which decisions are already pending, and whether any framework other than security is in scope (privacy, AI).

Step 1: close the loop on the last review

List every action from the previous minutes with its status and the record that shows it. Overdue actions go first on the agenda. A review that does not check its own actions teaches leadership that its decisions do not matter.

Step 2: collect the facts, short

Build the pre-read (pre-read.md), two to four pages, from the records gathered above, not from a fixed list of headings: what the incident log, audit reports, finding tracker, risk register, metrics, customer feedback, open actions and budget actually show since the last review. Organise it around what leadership must decide, and lead with what moved: an objective missed, a risk that rose, a finding overdue, a team short of people. Show each tracked metric with its target and its trend over the last three periods. The framework's own required inputs are added in Step 4 from the lookup, not assumed here.

Every figure carries its source and the date it was pulled; pull figures no more than two weeks before the meeting, since a pre-read built a month early shows a risk register that has already moved. Metrics without a target or a trend are cut; a number leadership cannot act on is noise.

Step 3: turn findings into decisions

For each topic that needs leadership, write a decision paper of five lines: the question, two or three options with cost and effect on risk, the recommendation, and the deadline. Typical decisions: approve or decline a budget ask, accept or treat a top-band risk, change an objective that is wrong rather than missed, change scope, assign an owner where nobody owns a problem. Aim for three to six decisions; a review with none rubber-stamped the system.