Surveillance audits and the three-year certification cycle

The certificate on the reception wall is not the end of the job. Accredited management-system certification is a cycle: initial certification, surveillance, recertification. Teams that treat Stage 2 as “done” spend the next two years surprised. Teams that treat surveillance as a courtesy coffee spend them writing late corrective actions.

This page is the after chapter. It is written for mid-market manufacturers and professional-services firms — typically operations, quality, IT, or compliance leads — who already hold, or are about to hold, ISO 9001, ISO/IEC 27001, ISO 14001, ISO 45001, and/or ISO/IEC 42001.

It does not republish Stage 1 versus Stage 2. It does not republish how to transfer. It does not invent prices, audit-day totals, or accreditation identifiers. You already have a quote anatomy page for the commercial shape. This page is what those remaining visits actually do.

1. The certificate is not “done”

A typical accredited cycle is three years. The certification body (CB) writes an audit programme for that window when it takes you on — not a single Stage 2 invoice with a shrug about “later.”

What that programme usually contains:

1. Initial certification — Stage 1 (readiness) and Stage 2 (implementation). That is how you got here.
2. Surveillance — periodic visits after the certificate is issued. Most programmes are annual. Some scopes or risk profiles are visited more often. The first surveillance is commonly due inside twelve months of the certification decision, not “whenever the plant is quiet.”
3. Recertification — a fuller look at continued conformity, planned so a new decision can be made before the certificate expires.

Transfer does not reset that clock when the review is clean. Recertification starts a new one. Those are different jobs. Confusing them is how a plant books two auditors for the same June.

The product you bought is not a PDF. It is permission to claim accredited certification while the system still conforms and while the programme is kept. If a required visit is missed, or a major sits open past the CB’s due date, that permission can be suspended or withdrawn. Customers who stored the certificate number will notice before your reception sign does.

2. What surveillance samples — and what “lighter” does not mean

Stage 2 asked whether the system works. Surveillance asks whether it still works, on a sample.

Almost every surveillance looks at the same spine:

• Internal audit that matches this system, not last year’s orphan binder
• Management review that actually decided something
• Complaints and what you did
• Use of the CB’s mark and any accreditation mark (brochures, websites, trucks)
• Status of every open nonconformity from the last visit
• Changes since last time: people, sites, processes, software, outsourced work

The rest is a rotating sample. In a plant that means a different process family, shift, or line than last year — receiving this visit, calibration the next, a second-shift cell if you claimed one. In an ISMS that means a different control cluster: access reviews, incident records, supplier due diligence, backup tests. In an AIMS that means a model that was approved, monitored, or retired since the last visit — not the same vendor demo twice.

	Stage 2	Surveillance	Recertification
Question	Does the system work?	Does it still live?	Should a new cycle start?
Coverage	Designed full look at implementation	Sample across the cycle	Fuller look at continued conformity
People	Heavy process-owner and shop-floor time	Targeted; still not “office only”	Closer to Stage 2 staffing
Outcome	Certification decision	Continue, suspend, or withdraw	New cycle — or not

“Lighter” is a day-count word, not a severity word. The CB usually spends fewer days than at Stage 2 because it is not re-walking every clause every year. That is sampling, not a discount on findings.

“Lighter” does not mean:

• Findings are informal, or majors can wait until recertification
• You can skip internal audit “because the registrar is coming”
• A remote opening meeting replaces floor or evidence time the programme called on-site
• A new warehouse, a new model, or a doubled headcount can hide until someone asks
• The certificate stays valid if you decline the visit

If two CBs described very different remaining programmes on the same scope pack, that is a quote problem you should have caught before Stage 2. You can still ask for the current programme in writing. You cannot invent a smaller one by being busy.

3. Scope creep: say it before the auditor finds it

The scope statement on the certificate is a claim. Surveillance is where that claim meets the building.

Tell the CB before the next visit — not in the opening meeting — when any of these moved:

New sites. A plant, warehouse, design office, or “temporary” overflow that does certified work is usually a scope extension, not a storytelling update. You cannot move a site that was never on the certificate and call it a transfer either; that is the same distinction the transfer guide makes. Multi-site sampling only covers sites that were in the design.

Headcount bands. Audit duration is calculated from effective personnel, complexity, and risk (IAF MD 5 is the usual starting point for quality, environment, and safety). If you hired through a band, added a shift, or folded a sister team into the same processes, the days they quoted may no longer match. Hiding the roster to keep last year’s number is how certificates get challenged later. This page will not invent the bands or the day counts. Your CB already has a table. Ask what they used.

Outsourced processes. Heat-treat, contract packaging, a managed SOC, a payroll processor that touches HR data, a model host — if the process can affect conformity, it is still your system. Surveillance will sample how you control it. “The vendor is certified” is evidence of their certificate, not of your control.

New AI systems (ISO/IEC 42001). A shop-floor vision model that was a pilot last year and a third-party copilot in delivery are different objects. If they are in the AIMS, they need an owner, an approval record, monitoring, and a retirement path. If they are not in the AIMS and they are doing certified work, you have a scope problem. Do not infer 42001 coverage from a 27001 certificate or a group brochure. Confirm the legal entity’s live AIMS schedule in the quarter you add the system — the same caution as verifying accreditation and the 9001 → 27001 → 42001 path.

Write the change in one paragraph: what moved, which sites, which standards, whether you want it on the certificate this cycle or next. Send it. A quiet expansion is not a strategy. It is a finding.

4. Nonconformities and corrective action — surveillance is not a softer closer

Labels vary by CB. Major and minor are common. A major is usually a systemic failure or the absence of a required process — something that raises doubt the system can meet its own claims. A minor is a lapse that does not, by itself, collapse the system. Do not argue the adjective in the closing meeting if the evidence is real. Argue the evidence if it is not. The grades, the response, and the questions to ask the body — including while you are still comparing quotes — are closing ISO nonconformities. This section is the surveillance consequence.

What you owe after the visit:

1. Containment where product, data, or people are still at risk.
2. Root cause that is not “human error” as a full sentence.
3. Correction of the instance they found.
4. Corrective action so the class of problem is less likely to recur.
5. Evidence on the date the report named — not a promise to look after peak season.

The CB sets the due date. This page will not invent one. Majors move faster than minors. Unresolved majors can suspend the certificate or block recertification. A plan for remaining minors is often acceptable; an ignored major is not.

Recurrence at the next surveillance is worse than the original finding. It says the action did not work. “We closed it in the portal” is not the same as “the process changed.”

Do not use a mid-cycle transfer to escape an open major. The accepting CB cannot issue until those majors are closed and it has accepted your plan for remaining minors. Shopping for a softer closer is visible in the file.

The registrar still must not write the procedure they will audit next year. If you need implementation help, hire it separately. That boundary did not loosen because the certificate already exists.

5. Recertification is not a transfer

Two different jobs get sold as “the three-year thing.”

Recertification is a fuller look at continued conformity with the same CB, planned so a certification decision can be made before expiry. Staff it more like Stage 2 than like a quiet surveillance: process owners, shop-floor or practitioner voices, IT and security for 27001 and 42001, leadership for the leadership clause. You should leave with a report, not a hallway assurance. The new certificate starts a new cycle.

Transfer is the accepting CB recognizing a valid, accredited certificate another accredited body already issued, then putting its name on the remainder of the current cycle. The rule set is IAF MD 2. The walkthrough is how to transfer an ISO certificate. A clean transfer does not restart the clock. A failed review — missing reports, unresolved majors, a skipped required visit, a certificate that is not what it seemed — makes you a new client. That is Stage 1 and Stage 2 again.

If this is true	The job is
Same CB, certificate still fits, expiry is coming	Recertification
Different CB, certificate still valid and accredited	Transfer
Expired, suspended, or a required visit was missed	New certification
New site that was never on the certificate	Scope extension, then the programme you already have

Do not run a transfer and a recertification as one surprise quarter. Do not skip a due surveillance so the new CB can “pick it up.” Do not wait until thirty days before expiry and then discover the portal still lists the outgoing mark.

If you do not yet hold a certificate, you are not in this chapter. Start with how to choose a registrar.

6. Scheduling honesty for plants and mid-market teams

Mid-market plants cannot pause a line because two calendars collided. Professional-services firms cannot empty the people who run the ISMS for a week in the same month as a customer audit. Write the constraints down.

Book the first surveillance when the certificate is issued, not when someone remembers. The clock usually runs from the certification decision. “We are still implementing the CA from Stage 2” is a reason to keep the system moving. It is not a reason to slide the visit past the programme.

Name the weeks that cannot move: inventory, peak season, a planned shutdown, the one week the quality manager and the plant manager are both out, a customer source inspection. Ask for the CB’s lead time for date changes. A registrar that cannot give you a planning window is a scheduling-honesty miss you will live with for the rest of the cycle.

On-site versus remote is a scoping conversation. Factories with material processes still benefit from floor time. An ISMS with a real evidence trail can often do part of a surveillance remotely. “We prefer Zoom” is not a risk assessment. If the programme said on-site for a process, do not convert it in the week of the visit. The buying chapter for that split — Stage 1, Stage 2, and the rest of the cycle — is remote vs on-site ISO audits.

Multi-site sampling is a design, not a raffle. Ask which sites are due this year and which are central functions. Do not assume last year’s reduction still applies after you added a warehouse. Language and shift coverage still matter; the auditor who only met first shift has not sampled second shift.

Internal audit and management review belong before the visit, and they should look at the changes in section 3. Staging a review the afternoon before so the binder is warm is the same waste as treating Stage 1 as a dress rehearsal.

Bring the CB’s audit calendar to operations planning the way you bring a customer shutdown. If you are adding 27001 or 42001 mid-cycle, those days land on the same people. Sequence is a path problem, not a surprise for the surveillance opening meeting.

7. When a CB change mid-cycle actually makes sense

Stay if the irritation is local. One blunt lead auditor or a late report is usually cheaper to manage than a transfer.

Transfer when the fit is wrong — the same tests as the transfer guide, applied to a live cycle:

• The mark is wrong. A customer portal, importer, or prime writes “ANAB only” or “UKAS only,” and your certificate carries a different IAF MLA mark. Equivalence is real; portal configuration is not. Verify the live accreditation before you collect accepting-CB quotes.
• The legal entity is wrong. The brochure was global. The contract named a regional company that does not hold the scope you thought you bought.
• The path is wrong. Your 9001 registrar cannot issue accredited ISO/IEC 27001 or ISO/IEC 42001 in the quarter you need it. Waiting, adding a second CB, or planning a transfer are the honest options.
• Competence is wrong. Factory-quality auditors are sampling an ISMS they do not understand, or a security boutique is wandering a heat-treat line — and surveillance has made that obvious.
• The issuing CB lost the scope. Accreditation expired, was suspended, or the firm ceased trading. That is a timed transfer, not a branding exercise.

Do not transfer to escape open majors, to skip a due surveillance, or because a salesperson promised a friendlier closer. Do not start the file move in the month a visit is due unless both CBs have agreed who will perform it.

If you stay, recertify on purpose: same scope pack discipline, same shortlist method and scorecard if you are also adding a standard, same refusal to treat brand as accreditation.

8. Red flags in years two and three

Slow down, or write it down, when you see:

• A surveillance agenda that is only an office tour at a plant that claimed production processes.
• Pressure to skip a due visit so a new CB can “start fresh.” Fresh is the new-client path.
• A recertification booked after expiry as if the wall certificate were a grace period.
• Scope that grew in the building and not on the paper.
• A 42001 object inferred from 27001. Confirm the AIMS schedule for the named entity.
• Corrective action that closes in a portal and not in the process. Recurrence is the tell.
• Consulting and certification from the same team. Independence does not loosen mid-cycle.
• A transfer quote that is only a Stage 2 price. If they have not described the pre-transfer review, they have not described the job.

Search the current certificate on IAF CertSearch after issue and again after recertification or transfer. Upload lag exists; a certificate that never appears is still a question for the CB.

9. How to run the rest of the cycle

1. Put the CB’s programme on one page: last visit, next visit, expiry, sites in and out, open nonconformities, and any change you have not sent them yet.
2. Send scope changes when they happen. Do not stockpile them for the opening meeting.
3. Staff surveillance like a sample of the real work. Staff recertification like Stage 2.
4. If the CB no longer fits, verify the accepting entity and run a transfer — do not skip a visit to get there.
5. If you are still choosing, or adding a standard mid-cycle, use how to choose a registrar, shortlist and score 3–5, and the directory, then send one scope pack through Get quotes.

Record the dates you viewed the live accreditation, the programme you were given, and why you stayed or moved. Future you, or the next quality manager, will need that memo when someone asks why next June is already booked.