Surveillance audits and recertification explained

Certification is not a one-time event

Once a certification body issues a certificate, it does not stay valid on its own. The body keeps checking that your management system is still working. The two parts are surveillance audits and recertification.

Surveillance audits

A surveillance audit is a periodic, smaller audit carried out during the certificate's validity period. It does not review every requirement each time. The certification body samples parts of your system across the cycle so that, over time, the whole system is covered.

Typical areas include:

• internal audits and management review
• how complaints and nonconformities are handled
• progress on corrective actions from earlier audits
• changes to your organization, activities or sites
• correct use of the certificate and any certification marks

The timing and number of surveillance audits are set by the certification body and the certification scheme, so confirm them in your agreement. Do not assume a fixed pattern.

Recertification

Before the certificate period ends, the certification body carries out a recertification audit. It reviews the performance of the management system over the whole period and decides whether certification can continue. A new certificate follows a positive decision.

Plan recertification early. If it is not finished in time, the certificate may lapse, which could affect tenders and customer requirements. See ISO certification for tenders.

If issues are found

Auditors record findings. Minor issues usually need a corrective action plan. A serious failure may lead the body to suspend or withdraw the certificate until it is fixed. What counts as serious, and the process that follows, is set by the certification body's rules.

Terminology

Use the right words with customers and in documents. A certificate is maintained through surveillance audits and continued through recertification. Surveillance is not a renewal, and recertification is not an automatic extension. Check your own agreement and certificate for the actual dates and terms.

Cost and planning

Surveillance and recertification have their own audit time and fees, which your quote should show. See certification cost. If you change certification body during the cycle, see certificate transfer.

For the full path from first application, read how it works. For a plain description of what auditors do, see what happens during an ISO certification audit.