What is a surveillance audit?
A surveillance audit is the yearly audit a certification body carries out between ISO certification and recertification, to check that the management system is still being run and improved. It is shorter than the initial certification audit and looks at a sample of the system each time.
Where it fits in the cycle
An ISO certificate runs on a three-year cycle. The initial certification audit has two stages. Surveillance audits follow in each of the next two years, and a recertification audit in the third year looks at the whole system again before a new certificate is issued.
ISO/IEC 17021-1, the standard certification bodies are accredited against, requires surveillance at least once a calendar year. The first surveillance audit must take place within twelve months of the certification decision. Missing it puts the certificate at risk of suspension.
What the auditor checks
A surveillance audit samples the management system. Some areas are covered at every visit, while others rotate between years, so controls outside this year’s sample still have to work.
- Internal audit and management review. That both happened since the last visit, with records to show it.
- Previous findings. That corrective actions for earlier nonconformities were taken and worked.
- Changes. New products, sites, suppliers or scope, and how the risk assessment and, for ISO 27001, the Statement of Applicability reflect them.
- Complaints and objectives. How complaints were handled, and progress against the system’s objectives.
- Use of the certificate. That certification marks and claims are used correctly.
Preparing for one
Expect the auditor to ask for records from across the year, not only from the weeks before the visit. Access reviews, supplier reviews and risk assessments should show the dates they actually ran.
Most surveillance findings come from a management system that went quiet after certification: an internal audit that slipped, a management review that never met, or a risk register nobody touched for a year. Put those on a calendar at the start of the cycle, and keep evidence of the fixes for last year’s findings, because the auditor starts there.
Findings are graded the same way as at certification. A minor nonconformity needs a corrective action plan, which the auditor checks at the next visit. A major nonconformity has to be corrected within the time the certification body sets, or the certificate can be suspended.
Questions
Surveillance audit, answered
How long is a surveillance audit?
Shorter than the initial certification audit. IAF MD 5, which accredited certification bodies use to set audit time, puts surveillance at roughly a third of the initial audit time. The exact number of days depends on headcount and scope.
What happens if we fail a surveillance audit?
A surveillance audit is not marked pass or fail; the auditor raises nonconformities instead. Minor ones need a corrective action plan. A major one left uncorrected past the deadline the certification body sets can lead to the certificate being suspended.
Can we change certification body between surveillance audits?
Yes. An accredited certification body can take over a valid certificate through a transfer process, which usually includes a review of the previous audit reports and any open findings.
Working through this for an audit?
Talk it through with someone who has run the audit before, or look up another term.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them