I think only Jane B summed it up correctly.The spec does not say "Top Management" so the IT manager,the admin Manager are all part of " Management". They dont make the decisions, they see that "Top Management's" decisions are carried out, in the case of the M/R if he/she is part of Man but not Top,if production dont do CAR's, they dont have to complain to T/M, but make out a NCR against the system. Then the 2nd and 3rd party auditors will address the issue with T/M. Objective proof of this is clause 5.5.2 (b)