Surveillance audit and recertification audit
An ISO certificate is valid for three years. During those three years, the auditor returns every year for a surveillance audit, also called an interim audit. At the end of the cycle comes the recertification audit. It reviews the whole system again and issues a new three-year certificate.
The rules are set out in ISO/IEC 17021-1 , the standard for certification bodies. Every certification body accredited by the Raad voor Accreditatie (RvA, Dutch Accreditation Council) must follow it. The structure is therefore the same for ISO 9001, ISO 27001, ISO 14001 and the other management system standards. The cycle begins after the initial audit.
What does the three-year certification cycle look like?
Each cycle has the same four moments. ISO/IEC 17021-1 requires an audit in every calendar year: a surveillance audit or, in the third year, the recertification.
| Moment | Audit | Purpose |
|---|---|---|
| Start | Initial audit (stage 1 and stage 2) | Obtain the certificate |
| Year 1 | First surveillance audit | Does the system still work? Sample check |
| Year 2 | Second surveillance audit | Same, different parts |
| Year 3 | Recertification audit | Review the whole system again, new certificate |
After recertification, the cycle starts again with surveillance audits in years 4 and 5. Some sector schemes use a different cycle. The standard allows for that.
When is the first surveillance audit?
The first surveillance audit may not take place later than twelve months after the certification decision. This date is usually shown on your certificate as the start date. After that, there is at least one surveillance audit per calendar year.
In practice, you schedule the surveillance audit in the same month every year. This keeps your own annual planning predictable.
Example: audit planning for a three-year cycle
A company obtains its ISO 9001 certificate with a stage 2 audit in March 2026. The certification body makes the certification decision on 15 April 2026. This is what the planning looks like, with the company’s own activities that must come before it.
| Date | Activity | Who |
|---|---|---|
| April 2026 | Certification decision, certificate valid until April 2029 | Certification body |
| Jan-Feb 2027 | Complete internal audits | Own organisation |
| February 2027 | Management review | Management |
| March 2027 | Surveillance audit 1 (by 15 April 2027 at the latest) | Certification body |
| Jan-Feb 2028 | Internal audits, management review | Own organisation |
| March 2028 | Surveillance audit 2 | Certification body |
| Jan 2029 | Internal audits, management review of the whole cycle | Own organisation |
| February 2029 | Recertification audit, well before the expiry date | Certification body |
| April 2029 | New certificate, valid until April 2032 | Certification body |
Plan your internal audit and management review before the surveillance audit. Both are part of what the auditor reviews at every surveillance audit.
What does the auditor check at a surveillance audit?
A surveillance audit is a sample, not a full audit. ISO/IEC 17021-1 names parts that every surveillance audit must cover:
| Part | What the auditor asks or checks |
|---|---|
| Internal audits and management review | Were they carried out, and what came out of them? |
| Nonconformities from the previous audit | Have the corrective actions been carried out and are they effective? |
| Complaint handling | How do you deal with complaints, and what do you learn from them? |
| Objectives and results | Are you meeting your objectives and the intended results? |
| Progress on improvement actions | What has improved since last year? |
| Operational control | Do the core processes work as described? |
| Changes | New locations, products, legislation, organisation? |
| Use of the certification mark | Do you use your logo and certificate correctly? |
In addition, the auditor chooses different processes or departments each year. Over the three years, the whole system is covered this way.
The part on “nonconformities from the previous audit” is the most important one. A minor nonconformity that is still open or has not been resolved effectively can easily become a major. See major and minor nonconformity.
What is the difference between a surveillance audit and a recertification audit?
The recertification audit looks at the whole system and at performance over the past three years. The auditor also reads the reports of the previous surveillance audits.
| Surveillance audit | Recertification audit | |
|---|---|---|
| When | Years 1 and 2 | Year 3, before the expiry date |
| Scope | Sample | All requirements of the standard |
| Look-back | Since the previous audit | The whole three-year cycle |
| Duration (ISO 9001, 14001, 45001) | Per year, roughly a third of the initial audit time | Roughly two thirds of the time an initial audit would now take |
| Stage 1 needed? | No | Only with major changes in the organisation or its context |
| Outcome | Certificate remains valid | New certificate for three years |
The duration ratios come from the mandatory document IAF MD 5 of the International Accreditation Forum . A surveillance or recertification audit lasts at least one audit day. For ISO 27001 and some other standards, separate calculation rules apply. Your certification body can show you the calculation. For what it costs, read ISO certification costs.
What happens if your certificate expires?
Your recertification must be completed before the expiry date, including resolving any major nonconformities. If that does not happen, the certification body does not renew the certificate. ISO/IEC 17021-1 still allows one way out.
Within six months of expiry
The certification body can restore the certificate if the outstanding recertification activities are completed. The original cycle continues.
After six months
At least a full stage 2 audit is then required. In practice, you almost start again.
Note: between expiry and restoration, you have no valid certificate. This can have direct consequences for tenders and customer requirements. Plan the recertification two to three months before the expiry date.
Can you postpone a surveillance audit?
Only to a limited extent. The rule of “at least one audit per calendar year” and the twelve-month limit for the first surveillance audit are strict. Small shifts within the year are usually not a problem. If you refuse a surveillance audit or let it lapse, the certification body can suspend your certificate. During a suspension, the certificate is temporarily invalid.
How to prepare for a surveillance audit
- Close last year’s nonconformities, with evidence that they are effective.
- Complete internal audits and management review and make sure the reports are ready.
- Report changes in advance to your certification body: a new location, a merger, strong growth, new services.
- Check your objectives: which have you met, which have you not, and what have you done about it?
- Check how you use the logo on your website, quotes and letterheads.
Want to switch certification body? Many organisations do this at recertification, because a full audit takes place then anyway. Read choosing a certification body and checking a certificate.