Clause 5.1.e Determining if the ISMS has achieved its outcomes is typically done when top management reviews the system during Management Review (see Clause 9.3).