Twenty-two people were killed when Salman Abedi detonated a suicide bomb after a pop concert on 22 May.
Lord Kerslake, the ex-head of the civil service, said those affected would have insights "that won't necessarily be available to the emergency services".
An interim report should be complete by Christmas, he added.
Speaking to Radio 5 live, he said the review - on behalf of Greater Manchester mayor Andy Burnham - would not look into whether the attack after an Ariana Grande concert at Manchester Arena could have been prevented.
"That's a separate thing... we are focusing very much on the preparedness of Greater Manchester for such attacks and their response in the period, the week-and-a-half or so in which they had to respond.
"The issue of whether it could have been prevented is a different review process."
He said he would be "very surprised" if his recommendations were not acted upon.
"There were thousands who were affected in some way by this terrible, terrible event. I see that as a key part of role as chair to make sure that their voices are heard as part of this review.
"They will have insights and ideas that won't necessarily be available to the emergency services, good though they are."
He added that he was "very confident" he would get access to information from the security services.
"This is a very well-established process: everybody recognises that you get much better results if you're open and honest about the lessons learned."
Information will also be collected from reviews conducted by each of the emergency services, he added.
"I'm sure there will be a lot of good things that will come out, but also the things that could have been done better."

Avast carried out the check to coincide with the first day of the Mobile World Congress trade show in the city.
In addition, it said it had found more than 470,000 other types of vulnerable smart devices.
The firm warned that unsuspecting owners could be spied upon as a consequence.
"If webcams are set to livestream for example, hackers or anyone can connect making it easy for cybercriminals to spy on... oblivious school pupils, workers or citizens nearby," said the firm's chief executive Vince Steckler in a statement.
"[But] what is far more likely is the possibility of a cyber-crook hijacking an insecure webcam, coffee machine or smart TV to turn it into a bot which, as part of a wider botnet, could be used in co-ordinated attacks on servers to take down major websites."
Avast used the connected-objects search engine Shodan to identify the devices.
It said to qualify they needed to either:
It carried out the study to help promote its own security tools.
But another independent expert said he thought the public needed to be aware of the threat.
"This research underlines just how easy it is to locate potentially vulnerable 'smart' devices and how they might be compromised," said Ken Munro, from the cybersecurity testing specialists Pen Test Partners.
"That's not to say that all internet-connected devices can be easily compromised; for example some more recent kettles, coffee machines and fridges are much harder to hack than earlier models.
"But consumers should exercise caution with smart devices. Ask yourself first if you actually need that device, then think about what data it might collect about you and expose.
"For example, baby monitors with video and two-way audio would obviously be more concerning than a simple audio-only device."
The review into the response to the Manchester attack will "give voice" to the victims' families, its chair Lord Kerslake has said.
[NEXT_CONCEPT]
A leading security company says it has discovered 22,000 hackable internet-connected baby monitors and other types of webcam in Barcelona.