For many UK SMEs, an information security management system, or ISMS, starts with good intentions and a set of policies. The harder part is keeping it useful over time. That is where continual improvement and management review come in.
In simple terms, continual improvement means making your ISMS better in a steady, practical way. Management review is the leadership check-in that helps decide whether the ISMS is still fit for purpose, where it is falling short, and what should change next. Done well, these two activities stop your ISMS becoming shelfware and turn it into part of normal business governance.
This is not about creating more paperwork for the sake of it. For a small organisation, the aim is to learn from incidents, audits, changes in the business, and performance data, then make sensible decisions based on that evidence.
What continual improvement means in an ISMS
Continual improvement is the ongoing process of strengthening your security management over time. That might mean tightening access controls after a near miss, improving supplier checks after a contract review, or updating training because staff behaviour shows a gap.
Why it matters for small organisations
UK SMEs usually have limited time, budget, and specialist resource. That makes it even more important to focus on improvements that reduce real risk and support the business. A small team cannot do everything at once, so the value comes from prioritising the changes that matter most.
Continual improvement also helps leadership show that security is being managed, not just documented. If the same issues keep appearing, or if controls are not being checked and refined, the ISMS will drift away from the way the business actually operates.
How improvement differs from one-off compliance activity
One-off compliance activity is about producing evidence at a point in time. Continual improvement is about learning and adapting. A business can have a folder full of policies and still miss the point if nothing changes when issues are found.
A useful way to think about it is this: compliance asks, “Have we done the thing?” Improvement asks, “Did the thing work, and what should we do next?”
What management review should cover
Management review is the leadership discussion that looks at how the ISMS is performing. It should be proportionate, but it should also be real. A short, focused review is better than a long meeting that produces no decisions.
Typical inputs for a useful review
Good inputs usually include:
- Results from internal audits and any external assessments
- Security incidents and near misses
- Progress against previous actions
- Changes in business context, such as new services, suppliers, locations, or systems
- Risk assessment updates and treatment progress
- Performance measures, such as training completion or patching timeliness
- Feedback from staff, customers, or key suppliers where relevant
The goal is not to collect every possible report. It is to give leaders enough information to understand whether the ISMS is working and whether the current risks are still acceptable for the business.
What decisions leaders should expect to make
A management review should lead to decisions, not just discussion. Leaders should expect to decide things such as:
- Whether the current security priorities still match the business risk
- Which improvement actions should be started, continued, delayed, or stopped
- Whether resources are sufficient for the current plan
- Whether any policies, controls, or responsibilities need to change
- Whether the risk picture has changed enough to require a fresh look at treatment options
If the review ends with “noted” and nothing else, it is probably not doing enough work.
How to build a simple improvement cycle
For most SMEs, the best approach is a straightforward cycle: identify issues, assess what they mean, agree actions, track them, and check whether they worked.
Using incidents, audits, and metrics as inputs
Three sources are especially useful.
Incidents and near misses show where controls failed or nearly failed. A phishing report, a misdirected email, or an access issue can reveal a weakness that deserves attention.
Audits and reviews help test whether the ISMS is being followed in practice. They can uncover gaps between what is written down and what actually happens.
Metrics show trends over time. A single number is rarely enough, but a pattern can tell you whether things are improving or slipping.
When these inputs are reviewed together, they give a more balanced view than any one source on its own.
Turning findings into practical actions
Each finding should become a clear action with an owner, a deadline, and an expected outcome. Keep actions specific. “Improve awareness” is too vague. “Update the phishing training and brief the finance team by the end of the month” is much more useful.
It also helps to record why the action matters. That keeps the work tied to risk rather than to a generic task list. If a proposed fix does not reduce risk, improve resilience, or support the business, it may not deserve priority.
Once actions are agreed, track them in the same place every time. A simple register is often enough for a small organisation, provided it is kept current and reviewed regularly.
Useful measures for UK SMEs
Metrics should help leaders make decisions. They should not exist just to fill a dashboard. The best measures are the ones that show whether key controls are working and whether the business is becoming more resilient.
Examples of security and ISMS metrics
Useful metrics for a small business might include:
- Percentage of staff who have completed security awareness training
- Time taken to apply critical patches
- Number of overdue access reviews
- Number of incidents reported by staff each month
- Percentage of improvement actions completed on time
- Number of suppliers reviewed against agreed security requirements
- Results of phishing simulations, if you use them, viewed as a trend rather than a scorecard
These measures are not perfect, but they are practical. They help show whether the ISMS is active and whether the organisation is following through on its commitments.
How to avoid vanity metrics and focus on business value
Vanity metrics look impressive but do not help decision-making. For example, counting the number of policies you have written tells you very little about whether the business is safer. Likewise, a high training completion rate is only useful if the training is relevant and behaviour is improving.
Ask a simple question when choosing a metric: “If this number changes, what decision will we make?” If the answer is unclear, the metric may not be worth keeping.
It is also sensible to avoid too many measures. A small leadership team will usually get more value from five or six well-chosen indicators than from a long report that nobody reads.
Common mistakes to avoid
There are two mistakes that come up often in SMEs.
Treating management review as a paperwork exercise
Some businesses hold a review because the calendar says they should, then spend the meeting reading status updates aloud. That is not a useful use of leadership time. The meeting should focus on exceptions, trends, decisions, and priorities.
If the review is always the same length, covers the same slides, and produces the same actions, it may have become routine rather than reflective. A better review changes with the business. A new system, a major supplier, a growth phase, or a recent incident should all shape the agenda.
Creating actions that are not owned or tracked
Another common problem is agreeing actions without clear ownership. If nobody is responsible, the action will drift. If the deadline is unrealistic, it will be ignored. If there is no follow-up, the same issue will return at the next review.
Each action should have one owner, even if several people contribute to it. It should also be visible to leadership until it is complete. That is how improvement becomes part of normal management rather than an occasional clean-up exercise.
A lightweight approach for busy leadership teams
SMEs do not need a large governance structure to run a sensible ISMS. They need a repeatable process that fits the size and pace of the business.
Keeping reviews proportionate to the size of the business
For a small organisation, a quarterly review may be enough, with a shorter check-in if something significant happens in between. The exact frequency should reflect the pace of change, the level of risk, and the complexity of the business.
A practical review pack might be no more than a few pages. It could include the current risk picture, key incidents, action status, a small set of metrics, and any decisions needed from leadership. The point is to support judgement, not to overwhelm people with detail.
Making improvement part of normal governance
The best ISMS improvements are often the ones that are folded into existing routines. For example, access reviews can sit alongside HR leavers processes, supplier checks can be part of procurement, and incident trends can be discussed in operational meetings.
That approach keeps security connected to the way the business already works. It also makes improvement more sustainable, because it does not rely on one person remembering to chase every task.
Over time, this creates a healthier pattern. The ISMS becomes a living management system, not a separate project. Leaders can see what is improving, what still needs attention, and where the business is taking sensible steps to reduce risk.
If you want help making your ISMS reviews more practical, or you are trying to turn audit findings and incidents into a manageable improvement plan, a consultant can help you shape the process around your business rather than forcing your business around the process.
Key point: continual improvement should be treated as an ongoing business process, not a separate compliance task. Management review works best when it focuses on trends, decisions, and follow-up actions that are realistic for the organisation.
Practical next step: set aside time for a short leadership review, bring three or four meaningful inputs, and leave with a small number of owned actions. That is usually enough to keep momentum without overcomplicating things.
Speak to a consultant if you would like support building a proportionate ISMS review and improvement cycle for your organisation.
Comments are closed