A list of what happened is not a trend

Management review sits in ISO 13485:2016 §5.6. It has three parts.

§5.6.1, General. Top management reviews the quality system at documented intervals. The point is to confirm it is still suitable, adequate and effective. The review looks for improvement and for changes the system needs, including to the quality policy and objectives. You need a documented procedure for it, and you keep records of each review.

§5.6.2, Review input. This is where the Heatmap finding sits. The standard lists what must go into the review. It is a long list, and it is not optional:

• feedback
• complaint handling
• reporting to regulatory authorities
• audits
• monitoring and measurement of processes
• monitoring and measurement of product
• corrective action
• preventive action
• follow-up actions from previous management reviews
• changes that could affect the quality system
• recommendations for improvement
• applicable new or revised regulatory requirements

§5.6.3, Review output. The outputs are recorded, with the inputs that were reviewed. They include decisions and actions on four things. Improvements needed to keep the system suitable, adequate and effective. Improvements to product related to customer requirements. Changes needed to respond to new or revised regulatory requirements. And resource needs.

Read those three parts together. The standard is not asking for a meeting. It is asking for a decision record, built on evidence.

Management review is the one place where top management's involvement is written down. It shows whether leadership sees the system or just signs for it.

It also gives anyone reviewing your system a shortcut. One set of minutes points to every other area: audits, complaints, CAPA, suppliers, regulatory change. If the minutes are thin, it suggests the areas behind them are too.

The Heatmap finding for this area reads: "Review inputs missing trend data." That is a precise gap. The meeting happened. The inputs were listed. But each one was a snapshot. "We had 4 complaints." Four compared to what? Up or down? Same product or spread out?

A number without direction does not help anyone decide. And deciding is the job of the review.

"Do you hold management reviews at planned intervals with top management present?"

What "we do this" sounds like: "Yes, we do it once a year. The MD is always there."

What you could put on the table: your Management Review SOP, stating the interval. A schedule showing the dates set in advance. Minutes for each review held on time, with attendees listed by name and role. If a review moved, a note of why and when it was rescheduled.

"Always there" is a claim. An attendance list with a signature is evidence.

"Do reviews cover all required inputs (audit results, complaints, CAPA status, process performance, regulatory change)?"

What "we do this" sounds like: "We go through everything. Complaints, audits, CAPAs."

What you could put on the table: a fixed agenda that follows the §5.6.2 list, item by item. Under each item, the data presented. For complaints, CAPA and process performance, that data shows at least two periods side by side, so direction is visible. For regulatory change, a short note of what changed and whether it affects you. If an input had nothing to report, the minutes say "none this period" instead of skipping it.

Skipping an item looks the same as forgetting it.

"Are review outputs captured as decisions and actions with owners and due dates, then followed up?"

What "we do this" sounds like: "We discuss the issues and everyone knows what to do."

What you could put on the table: an action log from the last review. Each action has an owner, a due date and a status. The next review's minutes open by checking each one. Where an action slipped, there is a reason and a new date.

"Everyone knows" means nobody owns it.

• A Management Review SOP that states the interval and who attends
• A schedule of review dates, set ahead of time
• Minutes for each review, with attendees by name and role
• An agenda that follows every §5.6.2 input, with "none this period" where true
• Trend data for complaints, CAPA, nonconformities, audits and process measures, across at least two periods
• A note on new or changed regulatory requirements and their effect on you
• Outputs written as decisions, covering improvement, product, regulatory change and resources
• An action log with owner, due date and status
• Evidence that the previous review's actions were checked at the next one

The review is a slide deck, not a record. Someone presents. People nod. The deck goes in a folder. Nobody can show what was decided.

Snapshots instead of trends. "3 supplier issues this quarter." The minutes don't say whether that is better or worse. So no decision follows.

The list gets shortened. Feedback, preventive action and reporting to regulatory authorities quietly drop off the agenda. They are not hard. They are just easy to forget.

Regulatory change is missing. This input is on the list for a reason. In South Africa right now, there is real regulatory change to talk about.

Actions die between meetings. An action is agreed in March. Nobody looks at it until the next review. By then it is a year old.

Top management delegates the whole thing. The Quality Manager writes the pack, chairs the meeting and signs the minutes alone. In a small company that can feel normal. But the standard wants top management to own the review, not just receive the minutes.

There is a regulatory change on your agenda whether you add it or not. SAHPRA is rolling out mandatory ISO 13485:2016 certification, or the latest version, in five phases. This is set out in its MD01 notice dated 18 September 2025.

• Phase 1, Preparation (1 April 2025): holders declared a certificate. No evidence was asked for.
• Phase 2, Renewals (1 June 2025): manufacturers and distributors or importers.
• Phase 3, Companies already holding a certificate (1 April 2026): holders "will be requested to submit". SAHPRA describes the requirement as mandatory.
• Phase 4, Amendments (1 June 2027).
• Phase 5, All new applications (1 April 2028).

Your review can say which phase applies to you and what you are doing about it. That fits the §5.6.2 input on new or revised regulatory requirements.

Two other SAHPRA dates may be worth a line in your minutes, though §5.6.2 does not list them. Holders of a medical device establishment licence pay an annual retention fee on or before the last working day of June each year. And if you import electromedical products, you make an annual submission of compliance information, the ASOCI, to SAHPRA's Radiation Control unit.

When an inspector visits, your licence is what is at stake. The inspector's job is to see evidence, not intentions. Management review minutes are some of the clearest evidence of whether leadership is paying attention.

Set a timer for 60 minutes.

1. 15 minutes. Copy the 12 inputs from §5.6.2 into a one-page agenda. Add the 4 output headings from §5.6.3 at the bottom.
2. 20 minutes. Pick complaints. Count them by month for the last 12 months. Put the numbers in two rows: the last 6 months and the 6 before. That is your first trend.
3. 15 minutes. Open your last review's minutes. List every action. Next to each, write the owner, the due date and whether it is done.
4. 10 minutes. Put your next review date in the MD's calendar now, with the agenda attached.

You leave with a fixed agenda, one real trend and an honest action log. That is the backbone of a review you can defend.