The initial ISO 27001 certificate is the visible milestone. The surveillance audits that follow are where most certified organizations find out whether their ISMS kept running after the certificate arrived. A team that worked hard for stage 2 and then stopped will usually discover this at the first surveillance audit, a year later.
Surveillance audits are shorter than the initial audit and do not re-examine everything. They are not lighter in the way that matters. The auditor is looking specifically for evidence that the management system operated during the year, which is the hardest thing to produce at the last minute.
This article covers when surveillance audits happen, what each one must cover, how coverage is spread across the cycle, and how to use the year between them.
Where surveillance sits in the cycle
An accredited ISO 27001 certificate runs on a three-year cycle.
Year one: the initial certification audit, in two stages.
The following years: surveillance audits.
Before the certificate expires: a recertification audit, which starts the next three-year cycle.
ISO/IEC 17021-1, the standard certification bodies are accredited against, requires surveillance audits at least once a calendar year, except in recertification years. The first surveillance audit after initial certification must take place no more than 12 months after the certification decision date. In a standard cycle that gives two surveillance audits per certificate.
The 12-month limit is counted from the certification decision, not from the last day of stage 2. Check the decision date on your certification documents and plan back from it, leaving time for your certification body's scheduling.
What every surveillance audit covers
Surveillance audits do not need to cover the whole ISMS each time, but ISO/IEC 17021-1 requires certain elements in every one. Paraphrased:
Internal audits and management review. That they happened since the last audit, and what they found and decided.
Actions on previous nonconformities. That findings from the last audit were addressed, and that the corrective actions worked.
Complaints handling. How complaints relevant to the ISMS were handled.
Effectiveness of the ISMS. Whether it is achieving your objectives and intended results.
Continual improvement. Progress on planned improvement activities.
Continuing operational control. That the processes and controls are still operating.
Changes. A review of any changes to the organization, the ISMS, or its context.
Use of the certification. How you use the certification body's marks and refer to your certification, for example on your website or in sales material.
The first two are where findings cluster. A surveillance audit that finds no internal audit since stage 2, or a management review that never happened, will produce nonconformities regardless of how well the controls are running. Similarly, a previous finding marked closed with no evidence that the fix worked is likely to be raised again.
How coverage is spread across the cycle
Beyond the required elements, the certification body samples. It plans an audit program for the whole cycle so that, across the surveillance audits, the scope of the ISMS and its controls receive appropriate coverage. In practice, each surveillance audit focuses on some processes, locations, and Annex A controls, and the next one picks up others.
Ask your certification body for the audit plan in advance of each audit. It tells you which areas, controls, and people the auditor expects to see. That is not a way to prepare only those areas; anything in scope can be sampled, and the auditor can change course based on what they find. It does tell you whose calendars to hold.
Audit duration is set using rules that depend largely on the number of people working within the scope, adjusted for complexity. If your headcount or scope changes significantly, the duration of future audits can change too.
Changes the certification body needs to hear about
Your certification agreement will require you to tell your certification body about significant changes. Check its wording, but expect it to cover at least:
Changes to the legal entity, ownership, or organizational status
Changes to key management, or to contact people for the ISMS
Changes to the scope, such as new products, services, or locations
Significant changes to the ISMS or its processes
Significant changes in the number of people within scope
Some changes can be handled at the next surveillance audit. A large one, such as an acquisition or a new site, may need a special audit or a scope extension. Telling your certification body early is cheaper than having the auditor discover it, which is itself a likely finding.
Findings at surveillance
Nonconformities at surveillance work the same way as at the initial audit. You correct them, find and address the cause, and provide the evidence the certification body asks for within its timescales. If findings are not addressed, the certification body can suspend the certificate, and a suspended certificate cannot be presented as valid.
The more common outcome is less dramatic and more expensive over time. A minor finding left open from one year carries into the next, reappears in the same area, and starts to suggest a systemic problem. Close findings with evidence, and check at the next internal audit that the fix held.
Keep every surveillance audit report alongside your corrective action records. The reports are a natural input to your next internal audit plan, because they show which areas the certification body has examined recently and what it found. They also feed the management review, where audit results are a required input.
Using the year between audits
The surest way to a clean surveillance audit is an ISMS that runs on a calendar. A workable rhythm for a hypothetical organization with a surveillance audit each autumn:
Month 1, after the audit. Raise corrective actions for every finding, with owners and dates. Brief top management on the outcome.
Months 2 to 4. Close corrective actions. Run the first round of recurring controls, such as access reviews and supplier reassessments.
Month 6. Repeat the risk assessment, or confirm no significant changes require one. Update the Statement of Applicability if anything moved.
Months 7 to 9. Run the internal audit, focusing on areas the certification body has not sampled recently and on last year's findings.
Month 10. Hold the management review, with the internal audit results as an input.
Month 11. Confirm the audit plan with the certification body, brief control owners, and check evidence for the period is complete.
The order matters more than the exact months. The internal audit should come before the management review, and both should come before the surveillance audit, with enough time to act on what they find.
The stage 1 vs stage 2 article covers the initial audit that starts the cycle, and how auditors sample controls explains why evidence that covers the whole period matters. Keep your Statement of Applicability current between audits, because the auditor will compare it with what they see. The ISO 27001 framework page summarizes the standard.
How TrustLynce helps
TrustLynce runs continuous monitoring on your controls between audits and routes failures to their owners, so problems surface during the year rather than at surveillance. The auditor portal keeps each year's requests and findings in one place, which makes follow-up on previous findings straightforward to show.