What ISO 27001 surveillance and recertification audits require after certification
The accredited certification body must audit the client in every calendar year of the three-year cycle, and the cycle ends with a recertification audit. Under ISO/IEC 17021-1, at least one surveillance or recertification audit must fall in each calendar year, and a delayed audit is an exception the certification body has to justify, not a way to push the next year's audit back. Budget owners should therefore read the certificate's expiry or recertification due date as the end of a planned sequence of visits, not a single renewal event. The organization owns its controls and the evidence that they operate. An implementation partner such as DeployOpen can prepare systems, records and evidence for those visits, but only the certification body audits the client and decides whether certification continues.
Each surveillance audit must check continuing operational control, so it cannot be a review of documents alone. Auditors will sample how the management system runs in practice, including the risk assessment, the Statement of Applicability, internal audit results, management review and the corrective actions raised since the last visit. The certification body also refreshes client data at each audit and reviews the planned audit time to reflect changes in the organization and its system maturity. Practically, this means the organization should expect the audit length to move with its headcount, sites and scope changes, and should tell the certification body about material changes before the visit rather than during it. Ask the certification body in writing how it plans audit time for each year and what triggers a change to it.
Surveillance audit compared with recertification audit
This table compares the surveillance audit and the recertification audit on purpose, scope, timing, planning and outcome. Read it as a checklist of what each audit must cover, then confirm the audit plan with your certification body before the first surveillance audit falls due.
| Aspect | Surveillance audit | Recertification audit |
|---|---|---|
| Purpose | Confirms that the ISMS continues to operate between certification decisions during the three-year cycle | Confirms that the ISMS still meets ISO/IEC 27001 at the end of the cycle so the certificate can be renewed |
| Required scope | Sampled parts of the ISMS, including continuing operational control, not only documents and records | A full review of the ISMS, including continuing operational control across the scope |
| Operational control | Must be included in every surveillance audit under ISO/IEC 17021-1 clause 9.6.2.2 | Must be included as part of the full review before the cycle ends |
| Timing | At least one audit in every calendar year of the cycle, with a delayed audit only as a justified exception | Before the three-year cycle ends, completed in time for the certificate's expiry or recertification due date |
| Audit plan | The certification body reviews planned audit time at each surveillance audit to reflect changes and system maturity | The planned audit time is reviewed again, and the audit programme for the next cycle starts from the recertification decision |
| Client data | The certification body obtains updated client information at each surveillance audit | Updated client information is obtained again ahead of the recertification audit |
| Open major nonconformities | Corrections must be verified before the surveillance result can support continued certification | Corrections for any major nonconformity must be verified before the certificate expires, or recertification is not recommended |
| Outcome | Certificate maintained, or suspended or withdrawn if the ISMS fails to meet requirements | Recertification recommended, starting a new three-year cycle, or the certificate lapses if activities are not complete |
How a surveillance audit runs from notice to finding
A surveillance audit confirms that the ISMS still works as certified, using refreshed client data, a planned audit time and tests of continuing operational control. It ends with findings the organization must answer before the certificate is maintained.
Certification body updates client data
Before the audit, the certification body obtains updated information about the organization, including changes to its scope, sites, systems, people in scope and the risk environment. The organization supplies this, usually through its contact for the certification relationship. The step is done when the certification body holds current client information that reflects how the organization now operates, not how it operated at the last audit.
Review planned audit time
The certification body reviews the planned audit time against the updated client data, so the audit reflects changes in the organization and the maturity of its management system. Changes such as new sites, a larger workforce in scope or significant new services can alter the time needed. The organization should ask for the planned time and the reasons for any change. The step is done when the audit plan carries a documented time basis that the organization has seen.
Plan the surveillance audit
The certification body prepares an audit plan that covers the areas to be sampled across the management system, the people to interview and the records and systems to examine. Surveillance audits do not need to repeat every clause in full each year, but they must cover the management system in a way that supports the certificate. The organization confirms dates, named contacts, access to sites and systems, and any previous findings that must be verified. The step is done when the plan is agreed and the organization knows which areas will be tested.
Test continuing operational control
The auditor checks that the controls are running in practice, not only documented. Reviewing policies and records alone is not enough, because every surveillance audit must include continuing operational control. The auditor may examine access reviews, incident handling, supplier checks, risk treatment decisions, internal audit results and management review minutes, and may interview staff to confirm they follow the process. The step is done when the auditor has evidence, from both documents and operation, for each sampled area.
Record findings and nonconformities
The auditor records each observation against the requirement it relates to, separating conformities, observations and nonconformities. A nonconformity means a requirement is not met or a control is not operating as the organization says it does. The certification body issues the audit report with these findings, and the organization receives them in writing. The step is done when every finding is recorded with its evidence and the organization has confirmed it understands each one.
Close nonconformities with evidence
The organization analyzes the root cause of each nonconformity, decides on a correction and any corrective action, and submits the response with evidence within the deadline the certification body sets. The certification body then verifies that the correction works and that the cause has been addressed. Unresolved findings can affect the continuation of the certificate. The step is done when the certification body has verified and accepted each closure, and the audit outcome is recorded.
What the organization must have ready before each audit
Surveillance and recertification audits test whether the management system still runs as it did at certification, not just whether documents exist. The items below connect to one another: a scope change affects the Statement of Applicability, which affects the risk treatment plan, which auditors sample through internal audit and management review records. Each card names what to check and who on the team should own it.
Current Statement of Applicability and risk treatment plan
The Statement of Applicability must match the current risk assessment, the risk treatment plan and the controls actually operating. Check that every Annex A control marked as implemented has an owner, a working procedure and recent evidence, and that every exclusion still has a justification that holds after recent changes. Ask the information security manager to own this, with the risk owners signing off treatment decisions. Auditors often start here because it links the whole system together.
Internal audit and management review records
Auditors look for proof that the system is checked and reviewed on a schedule, not only at certification. Confirm that the internal audit programme covered the clauses and controls planned for the period, that auditors were independent of the areas they reviewed, and that management review minutes record decisions on audit results, risks and improvement opportunities. The internal audit lead and the top management sponsor should each own their part of this record.
Evidence of continuing operational control
Every surveillance audit must include continuing operational control, so document reviews alone will not satisfy the auditor. For the Annex A controls in scope, gather samples from the period since the last audit: access reviews, change tickets, backup restore tests, training completions, supplier reviews and incident records. Control owners should keep these in a predictable location so the samples can be produced on request without rebuilding them.
Updated scope, headcount and site data
Certification bodies update client data at each surveillance audit and use it to plan audit time. Refresh the ISMS scope statement, the list of people and locations in scope, the number of sites, and any new cloud accounts or products that process information within scope. Compare these figures against the certificate. HR or the platform team should provide the headcount, and the security lead should confirm the scope boundary.
Closed corrective actions from the last audit
Any nonconformity raised in the previous audit must have a documented root cause, a corrective action and objective evidence that the fix works. Major nonconformities must be verified within the timescales the certification body set, because unverified corrections can block recertification. Keep a single corrective action log with status, owner and verification date for each finding. The security lead owns the log and the control owners own their fixes.
Organizational changes since the last audit
Mergers, new products, outsourced services, office moves, key personnel changes and new regulatory obligations can all change the risks and controls the audit must consider. Record each change with its effect on the ISMS, including whether the risk assessment was updated and whether the Statement of Applicability needs a new revision. Ask the leadership team and the security lead to review changes each quarter so the audit does not uncover them for the first time.
Recertification audit: the deadline that cannot slip
The recertification audit has to be finished, and corrections for any major nonconformity verified, before the current certificate expires. If either is still open on the expiry date, the certification body does not recommend recertification and cannot extend the certificate's validity. Under ISO/IEC 17021-1, the certificate's expiry date is set by the three-year cycle, so the date printed on the certificate is the one that counts, not the date the audit team happens to be available. Ask your certification body to confirm the expiry date in writing and to show you the date by which its report must be issued.
If the certificate does lapse, recovery is possible but more expensive. A certification body can restore an expired certificate within 6 months, provided the outstanding recertification activities are completed. Otherwise it needs at least a stage 2 audit. In both cases the expiry date remains tied to the previous cycle, so the restored certificate does not give you a fresh three years. For customers who check certificates in IAF CertSearch, a gap in validity is visible and can trigger questions in their supplier reviews, so treat the lapse as a customer relationship risk, not only a scheduling problem.
Plan the recertification window with the certification body several months before expiry. Agree the audit dates, confirm that the audit time has been reviewed for changes in your organization and system maturity, and book time to close any major nonconformities raised in the audit with evidence the auditor can verify. Once the recertification decision is made, a new cycle starts and the certification body builds the audit programme for the full new three years, so the next surveillance dates follow from that decision. Ask for that programme in writing so the first audit of the new cycle is on your calendar before the recertification certificate is issued.
What happens if a certificate lapses or moves to another body
When an ISO 27001 certificate reaches its expiry date without a completed recertification, the three-year cycle has ended and the certificate cannot be extended on its own. Under ISO/IEC 17021-1, the certification body does not recommend recertification if the recertification audit is not completed, or if corrections for any major nonconformity are not verified, before expiry. The organization then has to rebuild its position through a restoration route, which has its own limits.
- No automatic extension: validity is not extended while the recertification audit is incomplete.
- Open major nonconformities: unverified corrections block the recertification recommendation.
- Customer impact: buyers that check the certificate in the IAF CertSearch database will see it as no longer valid.
- Dependence on the body: only the certification body decides whether a route is open.
Before the expiry date, confirm with your certification body the exact date on the certificate and whether any recertification activity is still outstanding.
Under clause 9.6.3.2.5 of ISO/IEC 17021-1, a certification body can restore an expired certificate within 6 months, provided the outstanding recertification activities are completed in that window. If those activities cannot be completed, the body needs at least a stage 2 audit before it can restore. In both cases, the expiry date stays tied to the prior cycle, so restoration does not start a new three-year cycle. The organization must be prepared to show that its management system has kept operating throughout the gap.
- 6-month window: the body can restore if outstanding activities are finished within it.
- Stage 2 fallback: if the activities cannot be finished in time, at least a stage 2 audit is needed.
- Original expiry date: the restored certificate keeps the expiry date of the prior cycle.
- Operating evidence: records from the gap period must show the ISMS was still running.
- Body decision: the certification body determines which route applies.
Ask your certification body in writing which route applies to your case and what evidence it will need to see before deciding.
An organization that wants to move its certification to a different accredited certification body can do so under the Global ACI document ACI-TECH-3-002 (M), issued on 10 July 2026 and based on IAF MD 2:2023. The receiving body first carries out a pre-transfer review of the existing certification. If the review is satisfactory, the certification cycle continues from the previous cycle, so the transfer does not reset the three-year clock or the expiry date.
- Valid accredited certification: the certificate must be current and issued by an accredited body.
- Pre-transfer review: the receiving body reviews the certification before accepting it.
- Cycle continuity: the cycle carries on from the previous cycle rather than restarting.
- Customer notice: update the certificate holder information and inform customers who rely on it.
Request the pre-transfer review scope and timing from the receiving body before you give notice to your current body.
The Global ACI document sets out situations in which certification cannot be transferred. Certification that is suspended, that is not issued by an accredited body, or where required surveillance or recertification audits were not completed cannot be moved. In those cases the organization is treated as a new client by the receiving body, which means it starts an initial certification process rather than continuing an existing cycle. Because a new client process includes a full two-stage initial audit, the difference in timeline and cost can be large.
- Suspended certification: a suspended certificate cannot be transferred.
- Unaccredited issuer: certification from a body that is not accredited does not qualify.
- Missed audits: a surveillance or recertification audit that was not completed blocks transfer.
- New client treatment: the receiving body handles the organization as a new applicant.
Check your audit history against each year of the cycle before approaching another body, because a single missed audit can change the route entirely.
Common reasons surveillance audits slip or fail
Most surveillance audit findings trace back to a small set of habits: records that stop being maintained, changes that go unreported, and planning that starts too late. Each pitfall below shows the effect on the certificate and the check that prevents it, so the organization can test its own management system before the certification body does.
Letting the internal audit lapse
Clause 9.2 requires the organization to run internal audits at planned intervals, and the certification body will ask for the audit programme, the reports and the follow-up actions. When the internal audit slips, the surveillance auditor finds a gap in the evidence that the ISMS is checking itself. Confirm that the programme covers every clause and Annex A control within the cycle, that auditors are independent of the controls they examine, and that findings flow into management review.
Stale Statement of Applicability
The Statement of Applicability must match the current risk treatment plan, the controls actually operating and the 93 Annex A controls in the 2022 edition. Controls added, merged or retired since the last audit often leave the document describing a system that no longer exists. Before each surveillance audit, compare every line against the live environment and record the date and reason for each change.
Scope changes not reported
A new product, a new office, a new cloud account or an outsourced service can move information outside the certified scope without anyone telling the certification body. Surveillance auditors check whether the scope on the certificate still matches the organization, and changes that affect the ISMS must be communicated. Keep a change log tied to the scope statement and review it with the certification body's requirements before each audit.
Missed corrective actions
A nonconformity from the last audit must be corrected and the correction verified, and the certification body checks this at the next visit. Open actions with no owner, no root cause analysis or no evidence of effectiveness are a common reason findings are repeated. Track each corrective action to closure with the verification record attached, and treat a repeated finding as a sign the root cause was not addressed.
Controls that exist only on paper
Every surveillance audit must include continuing operational control, so auditors sample live operation and not just policies. A written access review that nobody performs, or a backup procedure with no restore test, will fail at the first sample. Before the audit, pick several controls at random and confirm that the records were produced in the last period, that the people named in them did the work, and that the output can be shown on request.
Waiting too long to plan recertification
The recertification audit must be completed, and any major nonconformities verified, before the certificate expires. If it is not, the certification body does not recommend recertification, and restoring an expired certificate can require a stage 2 audit after the 6-month window. Start planning in the final year of the cycle, agree the audit date early, and treat the expiry date on the certificate as the deadline for all open work.
Questions buyers ask about surveillance and recertification
Can a surveillance audit be done on documents alone?
No. Under ISO/IEC 17021-1 clause 9.6.2.2, every surveillance audit must include continuing operational control, so the certification body has to check that the management system is working in practice, not only that the records exist. The auditor samples operating evidence such as risk treatment progress, access reviews, incident handling, internal audit follow-up and management review outputs. A desk review of the ISMS documents can support the audit, but it cannot replace it. Ask the certification body to explain its audit plan for each surveillance visit before you sign.
Does an ISO 27001 certified organization have to be audited every year?
Yes. A certification cycle lasts three years, and the certification body must carry out at least one audit, either a surveillance audit or the recertification audit, in every calendar year. The European Accreditation guidance treats a delayed audit as an exceptional case that the certification body must justify, and a delay cannot be used to push the following year's audit back by a year. Plan the audit calendar with the certification body at the start of the cycle so that the annual visit does not fall into a busy period for your team.
What happens if the recertification audit is not finished before the certificate expires?
Recertification is not recommended and the certificate's validity is not extended. If the recertification audit is not completed, or major nonconformities are not verified as closed, before expiry, the certification body cannot renew the certificate on time. Under clause 9.6.3.2.5, the body may restore an expired certificate within 6 months if the outstanding recertification activities are finished. Otherwise, it needs at least a stage 2 audit. The restored certificate keeps its expiry date from the previous cycle. Customers that check certificates will see the lapse, so schedule recertification well before the expiry date.
Can an ISO 27001 certificate move to a different certification body?
Yes, if the certificate is valid and accredited. Global ACI-TECH-3-002 lets an organization transfer accredited certification to another accredited body after a pre-transfer review, and the certification cycle then continues from the previous cycle rather than restarting. A certificate that is suspended, not accredited, or missing a required surveillance or recertification audit cannot be transferred, and the organization is treated as a new client. Ask the receiving body what its pre-transfer review will examine, and gather the last audit reports before you start.
Can an implementation partner carry out the surveillance or recertification audit?
No. An implementation partner prepares the systems, controls and evidence, but only the accredited certification body audits the ISMS and decides on certification. DeployOpen follows the same rule: it does not issue audit reports, attestations or certifications. An auditor who helped design the ISMS also creates an impartiality problem, so the certification body will normally keep its audit role separate from any consulting work. Use your partner to prepare evidence and run internal checks, and use the certification body for every audit decision.
What does the internal team have to do between audits?
The organization owns its controls, so the internal team must keep the ISMS running throughout the cycle, not only before audits. Typical recurring work includes reviewing the risk assessment at planned intervals, keeping the Statement of Applicability in step with the risk treatment plan, running internal audits, holding management review, tracking corrective actions, and collecting operating evidence for the Annex A controls. The effort depends on how many people, systems and sites are in scope and how much of the evidence is generated automatically by the platforms you run. Confirm the named owner for each recurring task before the first surveillance audit.
What drives the cost and effort of surveillance and recertification?
The main drivers are the audit time the certification body plans, the number of people and sites in scope, the number of nonconformities raised, and how much evidence is already produced automatically. The certification body must review its planned audit time at least at every surveillance and recertification audit, so the figure can rise or fall as your organization changes. IAF MD 26:2023 set specific extra auditor days for transition audits, but no supplied figure covers routine surveillance fees, so ask the certification body for a written quote based on your scope. Clean evidence trails and a well-run internal audit usually lower the effort on each visit.
How DeployOpen prepares evidence for each audit cycle
DeployOpen prepares the systems, controls and evidence that an organization's certification body will sample at each surveillance and recertification audit. Work starts with a written scope that names the ISMS boundary, the systems and sites in it, the Annex A controls the organization has selected, and the evidence each control should produce. Because a surveillance audit must include continuing operational control, not just a review of documents, the preparation focuses on records that show controls running over the year: access reviews, change records, backup restore tests, logging and incident tickets. DeployOpen configures and documents those systems inside the client's own infrastructure and hands over the documentation in a form the organization can present and keep current.
DeployOpen does not issue audit reports, certificates or attestations. Only the independent certification body issues them, and it decides whether a surveillance audit is passed and whether recertification is recommended. Hiring DeployOpen does not guarantee a result, because the outcome depends on how the organization operates its ISMS between audits, what the auditor finds and how nonconformities are closed. Before engaging, ask the partner to state in writing which evidence it will prepare, which items remain the organization's responsibility, and how it will hand over records for the next audit. Expect a quote that follows from that written scope, with the cost of each audit cycle, the internal effort it requires and any changes in the certification body's audit time reflected in it.
Ongoing support for evidence upkeep, control reviews and audit preparation is available as a retainer, which suits organizations that want the same team to maintain the records between audit windows. Fixed-scope work is better suited to a one-off recertification preparation. Confirm with the certification body, before any work starts, which evidence formats it accepts, how it plans audit time for the cycle, and whether it expects a retainer partner's staff to be absent from the audit sample. These checks keep the preparation aligned with what the auditor will actually test.
