ISO 27001 · Audit cycle
What happens in an ISO 27001 recertification audit?
A recertification audit is the full-scope audit your certification body runs before your ISO 27001 certificate expires at the end of its three-year cycle. Every control is tested again, and passing it issues a new certificate and starts the next cycle.
When is it scheduled?
Before the current certificate expires, typically in the final three to four months of year three, so a new certificate can be issued without a gap. Miss the window and you are back to an initial audit with Stage 1 and Stage 2.
What is tested?
The whole management system, not a sample: the control set in your Statement of Applicability, the risk assessment and treatment, internal audits and management reviews across the cycle, and how you handled every finding from the two surveillance visits. The auditor also looks at whether the system improved over three years, because ISO 27001 asks for continual improvement, not just continued existence.
What does the auditor need from you?
Three years of history that can be read, not reconstructed. Which findings were raised, what was fixed, who verified it, and the evidence at each step. Where that history lives in one record attached to each engagement, the renewal conversation takes an hour. Where it lives in email threads, it takes the first two days of the visit.
In Certifyi the recertification engagement carries the prior findings from both surveillance visits, with verification recorded against a named person, and evidence that was withdrawn is kept with its reason rather than deleted, so the record of what the last auditor saw survives.
What is the outcome?
A new three-year certificate with a new number and validity dates, and the cycle count resets. Record the certificate with its scope and expiry so the next renewal is planned from a date, not a reminder somebody set in a calendar.
Where you stand
Score your own readiness in one sitting
The free self-assessment walks through the controls an auditor samples, gives you a scored report, and takes about fifteen minutes. No account needed.
Related questions
Is a recertification audit the same as Stage 2?
Similar in depth, without Stage 1. Stage 1 checks documentation readiness for a first certification; at recertification the system already exists, so the auditor goes straight to full-scope fieldwork.
What if we changed scope during the cycle?
Tell the certification body before the visit. A scope extension is handled as a special audit and does not advance the cycle count; folding it into recertification without notice is a common cause of delay.
How long does a recertification audit take?
Roughly the length of the original Stage 2 audit for the same scope. Small organisations typically see two to three days of fieldwork.