9.3 Management review

Entry 9.3 requires top management to conduct periodic reviews of the Business Continuity Management System to confirm its continuing suitability, adequacy and effectiveness. The review must consider performance metrics, audit findings, incident reports, corrective actions and changes in internal or external context, and result in decisions on improvements, resource needs and any necessary modifications to the BCMS.