In short
The certification cycle lasts three years and starts from the certification decision: two surveillance audits, then recertification before expiry.
The first surveillance audit must take place within 12 months of the decision, later ones at least once per calendar year.
Every surveillance audit always covers internal audits, management review, actions on previous nonconformities, complaints and use of the mark.
If you don't allow audits at the required frequencies, the certification body must suspend certification; without a fix, withdrawal follows.
An expired certificate can be restored within six months by completing recertification, but in the meantime the company is not certified.
You don't earn your certificate just once. Every year you have to show the system is still alive, and a single missed audit can land you in suspension. Many SMEs treat their first ISO certificate as a finish line: the work is done, the frame is hanging in reception. In reality, that is the day the three-year certification cycle begins, with a surveillance audit every year and a recertification audit before expiry.
In this guide we look at how the three-year cycle works, what the auditor checks during surveillance, how recertification differs, and what happens if an audit is missed or the certificate expires. The rules aren't invented by the certification body: they are set out in ISO/IEC 17021-1, the standard that lays down requirements for bodies certifying management systems, and they apply in the same way to quality, environment, information security or health and safety. If you need the basics on standards, certificates and scope, start with our guide on what ISO certifications are. Here we focus on what comes after the first certificate.
How does the three-year certification cycle work?
The certification cycle lasts three years and starts with the certification decision, not with the audit. Surveillance audits take place in the first and second years; in the third, before expiry, comes the recertification audit.
ISO/IEC 17021-1 says so explicitly: the audit programme for initial certification includes a two-stage initial audit, surveillance audits in the first and second years after the decision, and a recertification audit in the third year. Subsequent cycles start from the recertification decision. You'll find the stages of the initial audit, Stage 1 and Stage 2, explained in our guide to how the two-stage certification audit works.
When | Activity | What it checks |
|---|---|---|
Year 0 | Initial audit (Stage 1 and Stage 2), then certification decision | That the system conforms to the standard and is implemented |
Year 1 | First surveillance, within 12 months of the decision | That the system is maintained and working |
Year 2 | Second surveillance | Maintenance, improvement, management of change |
Year 3 | Recertification, before expiry | The effectiveness of the system as a whole over the full cycle |
When the cycle starts and ends
The date that matters is the certification decision, which the certification body takes after the audit, using people other than those who carried it out. That's when the three-year count begins, and it sets the first key deadline: the first surveillance audit cannot fall more than 12 months after that date.
For later surveillance audits the standard uses a different criterion: at least once per calendar year, except in recertification years. That leaves some flexibility over the date, but it doesn't remove the obligation. A note in the standard allows the frequency to be adjusted for factors such as seasonality, for example when the activity to be observed only takes place in certain months. The practical point is simple: put the decision date in your calendar straight away and plan backwards, rather than waiting for the certification body to remind you.
Some sector-specific certification schemes may set a cycle of a different length. For the most widely used ISO management system standards, however, the reference remains the three-year cycle.
Who sets the audit programme and what it's based on
The certification body defines an audit programme for the full cycle, which must cover all management system requirements over the three years. Not everything is looked at every year, but by the end of the cycle nothing should have been left out.
The standard requires the programme to take into account the size of the organisation, the scope and complexity of the system, its processes and products, the level of effectiveness demonstrated and the results of previous audits. Among the factors that may change the programme it also lists complaints received by the certification body about the client, changes to legal requirements and performance indicators. If the organisation works in shifts, the certification body must also consider the activities carried out during shift work. In practice, the programme isn't a fixed template: it adapts to how your system performs, audit after audit.
What is a surveillance audit and what does the auditor check?
A surveillance audit is an on-site audit that confirms the certified system continues to meet the requirements between renewals. It isn't a full system audit, but it has some fixed points the auditor must always cover.
According to ISO/IEC 17021-1, every surveillance audit must include at least the following:
internal audits and management review;
a review of actions taken on nonconformities from the previous audit;
complaints handling;
the effectiveness of the system in achieving the organisation's objectives and intended results;
progress of planned continual improvement activities;
continuing operational control;
a review of any changes;
use of marks and any other reference to certification.
Why surveillance isn't a full audit, but isn't a formality either
Surveillance is leaner than the initial audit because it samples: it looks at representative areas and functions within the scope, on a rotating basis, rather than going through every requirement. Full coverage of the requirements is spread across the whole cycle.
Lean doesn't mean light, though. The first two items on the list, internal audits and management review, are where organisations trip up most often, because they're the first activities to be postponed when the year gets busy. If the auditor finds an internal audit that never took place, or a management review written in a hurry the week before, that is evidence of a system that doesn't run by itself. To set them up properly, see our guide to the ISO internal audit.
Other surveillance activities
Alongside the on-site audit, the certification body may carry out other monitoring activities during the year. The standard mentions enquiries to the client about the certification, reviewing the client's statements about its operations, such as promotional material and website, and requests for documents.
The website case is more common than you might think. A company certified to ISO 9001 for its production site only that states "certified company" on its homepage without specifying the scope, or that applies the certification mark to a product, is misusing the reference to certification. It's one of the fixed points of surveillance, and it takes five minutes to fix if you look at it before the audit rather than during it.
How do you prepare for surveillance without chasing evidence?
You prepare for surveillance over the previous twelve months, not in the fortnight before. The auditor isn't looking for perfect documents: they're looking for traces of a system that is genuinely used, with dates spread across the year.
Take a typical company: 40 employees, mechanical manufacturing, certified to ISO 9001. It arrived at its first audit well prepared, with a consultant who had written procedures and records. Then the year flew by: supplier evaluations weren't updated, the new warehouse operator's training wasn't recorded, the internal audit slipped to "after the summer". Six weeks before surveillance, the quality manager discovers that evidence is missing or scattered across emails, shared folders and shop-floor notebooks. The result is a scramble to reconstruct it, with a real risk of nonconformities on requirements the company actually meets.
The evidence auditors almost always ask for
Some records come up in almost every surveillance audit, whatever the standard. Keeping them up to date during the year is the simplest way to arrive at the audit with evidence already in place:
the report of the internal audit carried out in the period, with any nonconformities and actions;
the management review minutes, with decisions and owners;
the status of corrective actions opened at the previous audit, with the effectiveness check;
the complaints log and how each complaint was handled;
performance against objectives and indicators, compared with the previous year;
a sample of operational records: training, maintenance, supplier evaluation, inspections.
How Complaion handles it
At Complaion, maintenance is set up so that this evidence doesn't pile up at the last minute. The dedicated Lead Auditor supports the company throughout the cycle, not just up to the first certificate: they conduct the internal audit and plan the management review with you, tell you what the certification body's auditor will look at and stand beside you during the visit.
Having your Complaion Lead Auditor conduct the internal audit changes the outcome: they apply the same yardstick as the certification body, without checking any operational work of their own, so gaps surface months before surveillance, while there is still time to close them. And the management review starts from real data, not from minutes written the week before.
The platform collects evidence as it's produced, manages documents and versions and keeps a schedule of system activities, from training to maintenance, right up to the date of the next surveillance audit. When the audit comes, the material is already in order and the Lead Auditor uses it to prepare the visit with you. You can see how it's organised on the Complaion platform page.
What is a recertification audit and how does it differ from surveillance?
The recertification audit is the audit that, in the third year, confirms the conformity and overall effectiveness of the system and its continued relevance to the scope of the certificate. If the outcome is positive, the certification body decides on renewal and a new three-year cycle begins.
The difference from surveillance is one of perspective. Surveillance samples; recertification must assess fulfilment of all the requirements of the standard. The standard also requires the certification body to review previous surveillance reports and consider the system's performance over the most recent cycle. In other words, the auditor looks at the three years, not just the last quarter.
What the auditor assesses at recertification
According to ISO/IEC 17021-1, the on-site recertification audit must address three topics. The first is the effectiveness of the whole system in the light of internal and external changes, and its continued relevance to the certified scope. The second is demonstrated commitment to maintaining the effectiveness and improvement of the system. The third is effectiveness in achieving the organisation's objectives and intended results.
In practice: if in three years the company has reorganised, opened a new line or added a service, the auditor asks whether the system has kept up with those changes. A context analysis stuck in year one, objectives copied from one year to the next, indicators never discussed in management review: these are signs that the system exists on paper more than in practice. That's why it pays to reach year three with a management review that genuinely tells the story of the cycle just completed.
When recertification requires Stage 1 again
Recertification is normally a single-stage audit. The standard does, however, provide that a Stage 1 may also be needed when there have been significant changes to the system, the organisation or the context in which it operates, for example relevant changes in legislation.
The typical case is a company that, during the cycle, has merged with another business, moved its main site or significantly expanded its activities. In these situations the certification body may need to review the foundations before checking implementation. Notifying these changes in good time, as we'll see below, avoids surprises in planning.
Major nonconformities before expiry
If a major nonconformity emerges at recertification, the certification body sets time limits for correction and corrective action, and these must be implemented and verified before expiry of the certificate. Submitting a plan isn't enough: the certification body must have verified implementation.
This is the practical reason why recertification should be planned well ahead of expiry, and the standard asks for this explicitly: it must be planned in due time to allow renewal before the expiry date. An audit scheduled right up against expiry leaves very little margin to close a major. If you want to understand clearly what separates a major nonconformity from a minor one, read our guide on major and minor nonconformities.
What happens if you miss an audit or the certificate expires?
Missing a surveillance audit or failing to complete recertification in time has precise consequences set out in the standard: suspension, reduction of scope, withdrawal or expiry of the certificate. These aren't arbitrary choices by the certification body, but rules that apply to everyone.
Suspension: a temporarily invalid certificate
ISO/IEC 17021-1 lists the cases in which the certification body must suspend certification. They include a system that has persistently or seriously failed to meet requirements, including effectiveness requirements, and a client that does not allow audits for surveillance or recertification at the required frequencies. Suspension can also be requested voluntarily by the organisation.
During suspension, certification is temporarily invalid. For the company this means that, in that period, it cannot present itself as certified: a serious problem if the certificate is needed for a tender, a supplier register or a contract. If the issue is resolved, the certification body restores certification. A note in the standard indicates that in most cases suspension does not exceed six months.
Withdrawal and reduction of scope
If the causes of the suspension aren't resolved within the time set by the certification body, the result is withdrawal or reduction of scope of the certification. Reduction applies when requirements aren't met in only part of the scope: that part is excluded from the certificate.
Imagine a company certified for design and manufacturing that, for a year, lets all controls on its design process lapse. The certification body may decide to reduce the scope to manufacturing only. The certificate remains, but it covers less than customers believe, and anyone who checks the certificate will notice.
Expired certificate: the six-month window
If recertification isn't completed before expiry, or the certification body can't verify the actions on a major nonconformity, renewal cannot be recommended and validity isn't extended. The certificate expires.
The standard leaves a way out: within six months of expiry, the certification body can restore certification, provided the outstanding recertification activities are completed. Beyond that limit, at least a new Stage 2 is required. Watch out for one detail, though: even when certification is restored, the effective date on the certificate is on or after the recertification decision, while the expiry date remains tied to the previous cycle. Between expiry and restoration, the company is not certified.
What changes must you notify to the certification body during the cycle?
During the cycle you must inform the certification body, without delay, of changes that may affect the system's ability to keep meeting the standard. This obligation comes from the contractual arrangements that ISO/IEC 17021-1 requires certification bodies to have with certified organisations.
Which changes are covered
The standard gives some examples: changes in legal, commercial or organisational status or ownership; in organisation and management, such as key managerial or technical staff; in contact address and sites; in the scope of operations covered by the system; and major changes to the system and processes.
A concrete example: an IT services company certified to ISO 27001 opens a second office and moves its development team there. If it reports this straight away, the certification body can assess whether to include the new site in the next surveillance audit. If it comes out during the audit, the company has to explain why such a significant change wasn't reported, and the programme has to be revised on the fly.
Special audits, extensions and short-notice audits
Besides surveillance and recertification, the standard provides for special audits. The first case is extension of scope: if you want to add an activity or a site, the certification body reviews the application and decides which checks are needed, often alongside a surveillance audit.
The second case is short-notice or unannounced audits, which the certification body may carry out to investigate complaints, in response to changes or as follow-up on a suspended client. The conditions under which they can take place must be communicated to the organisation in advance, usually in the contract. They're worth re-reading: knowing when an unscheduled audit might happen is part of managing the cycle.
What are the most common mistakes in maintaining certification?
Maintenance mistakes are almost always the same ones, and almost always organisational rather than technical. These are the ones an auditor sees most often in SMEs.
Treating the internal audit and management review as tasks to rush through just before surveillance, rather than as tools for running the business.
Leaving corrective actions from the previous audit open without checking their effectiveness, with the risk that the same nonconformity comes back.
Not notifying the certification body of changes in site, ownership or activities, and having them come out only during the audit.
Scheduling recertification too close to expiry, with no margin to close a possible major nonconformity.
Misusing the reference to certification on the website, in catalogues or on products.
Letting the system depend on a single person, internal or external, who takes the knowledge of where the evidence lives with them when they leave.
The common thread is continuity of the system: a management system that only comes to life on audit days produces repeated nonconformities and stress. One that is used every month arrives at surveillance with almost no dedicated preparation. If you manage several standards together, the same logic applies even more, because the deadlines add up: the certifications and regulations you work with can share internal audit, management review and document management.
How does Complaion help you through surveillance and recertification?
Maintaining certification means keeping the system alive for three years, not just passing an audit. Complaion supports you with a dedicated Lead Auditor who follows your company throughout the cycle: they conduct internal audits, plan the management review with you, prepare you for surveillance and recertification and accompany you during the certification body's visits.
Alongside the Lead Auditor is the platform, which collects evidence, manages documents, keeps the schedule of activities and prepares the audit, so the material is ready when it's needed. The pathway is proposed according to your company's needs, the standards you hold and those you'll need. More than 1,000 clients have already chosen Complaion to get certified and keep their certifications over time.
If you have a surveillance or recertification audit coming up, talk to a Complaion expert to work out how to set up your next cycle.
Frequently asked questions about ISO surveillance and recertification
How often is the ISO surveillance audit carried out?
According to ISO/IEC 17021-1, surveillance audits take place at least once per calendar year, except in years when recertification is carried out. The first surveillance audit must take place within 12 months of the certification decision date. The three-year cycle therefore includes two surveillance audits, in the first and second years. The frequency can be adjusted in particular cases, for example for seasonal activities.
How long does an ISO certificate last?
For the most widely used ISO management system standards the certification cycle lasts three years. The first cycle starts from the certification decision, later ones from the recertification decision. Validity, however, depends on passing the annual surveillance audits: a certificate can be suspended or withdrawn before it expires. Some sector schemes may set cycles of a different length.
What is the difference between a surveillance audit and a recertification audit?
Surveillance checks on a sample basis that the system continues to meet requirements, with some fixed points such as internal audits, management review and actions on previous nonconformities. Recertification instead assesses all the requirements of the standard and the effectiveness of the system over the whole cycle, also taking surveillance reports into account. It's recertification that, if successful, leads to renewal for another three years.
What happens if I postpone or skip a surveillance audit?
If the organisation doesn't allow audits at the required frequencies, ISO/IEC 17021-1 requires the certification body to suspend certification. During suspension the certificate is temporarily invalid. If the issue isn't resolved within the time set by the certification body, it leads to withdrawal or reduction of scope. If a postponement is unavoidable, agree it with the certification body in good time, staying within the limits of the standard.
Can an expired ISO certificate be recovered?
Yes, within limits. If recertification activities are completed within six months of expiry, the certification body can restore certification; beyond that, at least a new Stage 2 is required. The restored certificate is valid from the recertification decision, so between expiry and restoration the company is not certified.
Do I need to tell the certification body if I change site or organisation?
Yes. A certified organisation must inform the certification body without delay of changes that may affect the system: legal status or ownership, key staff, addresses and sites, scope of operations and major changes to processes. The certification body then assesses the action needed, which can range from a check at the next surveillance audit to a special audit.
Does recertification require Stage 1 and Stage 2 again?
Normally not: recertification is an on-site audit that assesses the system as a whole. The standard does, however, provide that a Stage 1 may also be needed if there have been significant changes to the system, the organisation or the context, for example relevant legislative changes. A new Stage 2 is required if the certificate expired more than six months ago.
