After ISO certification, the work shifts from building the system to proving it keeps working: the certificate is valid for three years, the certification body returns for an ISO surveillance audit at least once a year, and a full recertification audit closes the cycle. Many companies keep a consultant on a reduced scope for internal audits, management reviews and corrective actions, while others manage everything in-house.

The common mistake is to treat the certificate as a finish line. An ISO surveillance audit samples whether the system is still alive, and a system that was built for the first audit often shows its gaps by the second. This article takes a third-party view of what happens after certification, why companies find the post-certification phase harder than expected, and when ongoing consultancy support is worth paying for.

What Is an ISO Surveillance Audit, and When Does It Happen?

An ISO surveillance audit is a periodic check by the certification body, between initial certification and recertification, to confirm that the management system still conforms to the standard. It normally happens once a year, and the first one must fall within 12 months of the certification decision.

How Often Does an ISO Surveillance Audit Take Place?

It takes place at least once per calendar year, except in recertification years, under the accreditation requirements of ISO/IEC 17021-1. The first surveillance audit after initial certification must not be more than 12 months from the certification decision date. In practice, a three-year certificate therefore carries two surveillance audits, one in each of the first two years, before the recertification audit in year three.

What Does the Auditor Actually Check?

The auditor checks a sample of the system rather than all of it, so that over the full cycle every part gets attention. Certain items come up almost every time: internal audits, management reviews, actions taken on earlier findings, complaints, changes in the business and the correct use of the certification mark. Practitioners commonly report that the visit is shorter than the initial audit, often cited at roughly half to two-thirds of its duration, although the certification body sets the exact time. Shorter does not mean casual: serious nonconformities can lead the certification body to require corrective action and, in the worst cases, to suspend or withdraw the certificate.

What Is the ISO Certification Cycle After the Initial Audit?

The cycle lasts three years: the certificate is issued after the initial audit, kept alive by a surveillance audit in each of the first two years, and renewed by a recertification audit completed before the certificate expires, which starts a new three-year cycle. Each ISO surveillance audit samples different areas, so the cycle as a whole covers the full system.

ISO certification cycle · 4 checkpoints, 1 loop

Surveillance audits fall in years one and two, and the recertification audit has to finish before expiry for the next cycle to begin.

How Does Recertification Differ From a Surveillance Audit?

Recertification is a full reassessment of the management system, while a surveillance audit is a narrower sample. It covers all clauses, processes and sites, and it must be finished, including closure of any major findings and the certification decision, before the expiry date. Starting the audit before expiry is not enough. One practitioner source advises beginning renewal preparation about six months ahead, which leaves room to correct problems without pressure.

What Triggers a Special Audit, Suspension or Withdrawal?

A special audit can be triggered at any point in the cycle by a complaint, a significant change such as a new scope or ownership, or the need to verify that earlier corrective actions worked. Suspension follows when problems are not resolved, for example an unresolved major nonconformity past its deadline, refusal to allow a surveillance audit, or misuse of the certification mark. A suspension is typically limited to about six months, and customers can check the certificate's status with the certification body, so it is visible. If the issues are not resolved in time, suspension can end in withdrawal.

Why Do Companies Struggle Between One ISO Surveillance Audit and the Next?

Companies struggle because the energy that carried the first audit fades once the certificate arrives: owners change roles, reviews slip, evidence stops being collected and no one is clearly accountable for upkeep. One practitioner source describes this decay, rather than any new external threat, as the most common source of nonconformities at surveillance.

What Are the Most Common Gaps?

Practitioners most often report the following gaps when a system has been left to drift:

• Internal audits that were skipped, delayed or done superficially
• Management reviews held late or without real inputs such as objectives and audit results
• Corrective actions closed on paper without addressing the root cause
• Documents and records that no longer match changes in people, equipment or processes
• Training evidence missing for new starters
• Changes in scope or operations that the certification body was never told about

None of these is exotic, which is exactly why they are easy to overlook.

Why Does Drift Happen Even in Well-Run Companies?

Drift happens because certification is a project with a deadline and an owner, while the following year is ordinary operations with competing priorities. The person who led the project may move on, a new product line changes how work is done, and staff turnover removes the people who remembered how the system was meant to work. A system that nobody owns day to day tends to stop producing the records that an auditor will ask to see.

What Ongoing Consultancy Support Is Available After ISO Certification?

Ongoing support usually covers internal audits, management review preparation, corrective action coaching, record upkeep, training for new staff and mock audits before each visit, with the scope and frequency agreed between the company and the consultant. Arrangements range from occasional check-ins to a regular retainer.

Which Services Does Ongoing Support Typically Include?

Typical services include:

• Independent internal audits, which bring a fresh view and free internal staff
• Preparation of management review inputs and minutes
• Coaching on root-cause analysis so corrective actions hold
• Reviews of documents and records after changes in the business
• Refresher training and induction material for new staff
• A mock audit shortly before each ISO surveillance audit

Some companies buy one or two of these rather than the whole package, which keeps cost proportionate to need.

How Does Ongoing Support Help With New Standard Editions?

It helps by turning a revision into a planned project instead of a surprise. ISO 9001:2026 was published on 16 September 2026, and certification body LRQA states that organizations certified to ISO 9001:2015 have until 30 September 2029 to transition, with existing certificates remaining valid meanwhile. Many companies will fold the move into a scheduled surveillance or recertification visit. Another source cautions that certification bodies prioritize their existing recertification schedules, so late transition requests can be squeezed. An ISO consultant such as Wellkinetics can run a gap analysis against the new edition and help choose the audit at which to transition, though the certification body's own plan has the final say.

Is Ongoing Consultancy Support Worth the Cost After ISO Certification?

It is worth the cost when a company lacks time or in-house audit skills, or when losing certification would be expensive, and it is less valuable when a capable quality owner already runs a mature system. The deciding factor is whether the support builds the company's own capability or quietly replaces it.

What Do Supporters Say?

Supporters argue that outside support imposes calendar discipline and catches drift before the certification body does. An independent internal auditor may spot problems that insiders have stopped seeing, and fewer major findings mean fewer follow-up visits and less risk to the certificate. Guidance on revisions and changes of scope can also prevent expensive surprises between each ISO surveillance audit and the next.

What Do Sceptics Say?

Sceptics point to recurring fees and the risk of dependency. If the consultant effectively runs the system, staff may come to see quality as someone else's job, and the surveillance audit then tests the consultant's work rather than the company's. Others note that mature organizations with an engaged quality team manage perfectly well alone, and that money may be better spent on training their own internal auditors.

How Can a Company Decide?

A company can decide by asking four plain questions: who owns the system day to day, whether internal audits and management reviews happen on schedule, whether findings repeat from one visit to the next, and what changes are coming. Weak answers point toward support, while strong ones suggest a lighter option, such as a single annual health check.

How Can a Company Prepare for an ISO Surveillance Audit?

A company can prepare by keeping its year-round routines current, updating records after any change, briefing staff honestly, and confirming the audit plan with the certification body in advance. Preparation works best as a habit rather than a last-minute push.

What Should Be Done Before the Visit?

A sensible sequence runs as follows:

1. Complete the internal audit and close actions where possible.
2. Hold the management review using real data on objectives and findings.
3. Confirm that findings from the previous audit are closed with evidence.
4. Update documents and records, and tell the certification body about changes in scope, sites or ownership.
5. Brief staff on the purpose of the visit and encourage plain, accurate answers.
6. Confirm the date and plan, and consider a mock audit if internal experience is thin.

What Happens If the Auditor Raises a Finding?

The company responds with a root-cause analysis and corrective action within the deadline the certification body sets. Major findings must be resolved before certification can continue, and an unresolved one can lead to suspension, so asking early what evidence will satisfy the auditor is wiser than guessing.

Final Takeaway

Certification starts a three-year obligation, not a finish line. Each ISO surveillance audit checks whether the system is still alive, and the companies that do best treat upkeep as routine work with named owners and a calendar. Ongoing consultancy support can supply discipline, independence and guidance through standard revisions such as ISO 9001:2026.

It is not essential for everyone. Mature teams with a capable quality owner can manage alone, and any support that replaces internal ownership rather than building it carries a hidden cost. The practical test is simple: if the system would keep running next year without outside help, the certificate is on firm ground.

References

• LBMC, ISO Certification Audit Process — https://www.lbmc.com/lbmc-certification-services/iso-certification-audits/
• IAF FAQ, Postponing Activities (ISO/IEC 17021-1, clause 9.1.3.3) — https://iaffaq.com/category/postponing-activities/
• TCSA, How Long Does ISO 27001 Certification Last? — https://www.tcsa.in/frameworks/iso-27001/certificate-validity
• CASRAI, Surveillance Audit — https://casrai.org/iso-standards/surveillance-audit
• Agency, Surveillance Audit (Glossary) — https://getagency.com/glossary/surveillance-audit
• Cerrix, How Often Do ISO Certifications Need to Be Renewed? — https://cerrix.com/en/insights/blog/how-often-do-iso-certifications-need-to-be-renewed
• Presencis, How Often Are ISO 27001 Surveillance Audits? — https://cdn.presencis.com/questions/iso-27001-surveillance-audit-frequency/
• Open Exam Prep, Accredited Certification Audits and the Certification Cycle (ISO/IEC 17021-1) — https://open-exam-prep.com/study-guides/iso-9001-lead-auditor/chapter-7/accredited-certification-audits-certification-cycle
• LRQA, ISO 9001:2026 Is Live: The Transition Period Has Begun — https://www.lrqa.com/en/latest-news/iso-9001-2026-live/
• Effivity, ISO 9001:2026 Transition Timeline — https://www.effivity.com/blog/iso-9001-2026-transition-timeline