Surveillance and recertification: the three-year cycle

The three-year cycle

An accredited management system certificate is issued for three years. During that time the certification body has to keep confirming that the system continues to meet the standard, which it does through surveillance audits in the years between initial certification and recertification.

ISO/IEC 17021-1 requires surveillance at least once a calendar year, except in recertification years. The first surveillance after initial certification must take place within twelve months of the certification decision. Your audit programme sets out the planned dates, and you should agree any change well in advance.

The cycle runs from the certification decision, not from the audit date. When recertification is completed on time, the new cycle normally follows on from the previous expiry date.

What surveillance audits sample

A surveillance audit is shorter than the initial audit and does not cover every requirement every time. It samples, so that over the cycle all of the standard and all of the scope are covered. Some topics are examined at every surveillance because they show whether the system is still alive.

Surveillance audits are planned in advance as part of the audit programme, but the auditor may change emphasis based on what they find. A rise in complaints, an incident or a new process will draw attention even if it was not in the original plan.

• Internal audits and management review since the last visit.
• Action taken on nonconformities raised at the previous audit.
• Handling of complaints.
• Progress against objectives and continual improvement.
• Changes to the organisation, scope, sites or processes.
• Continued operational control in a sample of processes.
• Use of certification marks and references to certification.

Tell us about changes

Certification rules require you to tell the certification body about significant changes, such as new sites, a change of legal entity or ownership, a major change in activities or a serious incident. Some changes can be handled at the next surveillance. Others need an earlier visit or a change to the scope.

Raising changes early avoids a situation where the certificate describes an organisation that no longer exists in that form, which customers checking the register will notice. It also gives us time to plan auditors with the right competence for any new activity.

Suspension

A certification body suspends a certificate when the conditions for certification are not being met. During suspension the certification is temporarily invalid, and you must not promote it. The suspension is recorded in the public register, so customers who verify your certificate will see it.

Suspension is time-limited. If the issues are resolved within the period set out in our certification rules, the certificate is restored; if not, it is withdrawn or the scope is reduced.

In most cases suspension can be avoided. If an audit date cannot be kept, or a corrective action will be late, contact us before the deadline so a revised date can be agreed and recorded.

• A persistent or serious failure of the management system to meet the standard, including major nonconformities not addressed in time.
• Not allowing surveillance or recertification audits to take place at the required frequency.
• A voluntary request from the certified organisation.
• Misuse of the certificate or certification marks.

Withdrawal

Withdrawal ends the certification. It follows an unresolved suspension, a confirmed serious breach of certification rules, or a request from the organisation to end certification. Once withdrawn, the certificate shows as withdrawn in the register and the organisation must stop all references to it.

Coming back after withdrawal means a new initial certification. You can appeal a suspension or withdrawal decision through our complaints and appeals process, which is handled by people who were not involved in the original decision.

A reduction of scope is a related outcome. If part of the organisation no longer meets the requirements, the certificate can be reissued for the part that does, rather than withdrawn entirely.

Planning recertification

Recertification has to be completed, and any major nonconformities verified as corrected, before the certificate expires. That means planning it several months ahead, so that the audit, any follow-up and the certification decision all fit before the expiry date.

The recertification audit looks at the whole system over the full cycle: performance across the three years, the results of surveillance, and whether the system is still effective for the current scope and context. It is closer in depth to the stage 2 audit than to a surveillance.

If recertification is not completed before expiry, the certificate expires. ISO/IEC 17021-1 allows a certification body to restore it within six months, provided the outstanding recertification activities are completed; otherwise at least a stage 2 audit is needed. Customers will see the gap in the register either way.

Remote and multi-site audits

Some surveillance activities can be carried out remotely where the standard, accreditation rules and the risks allow it, for example document review or interviews with staff in other locations. Activities that depend on seeing the work, such as operational controls on a production floor, are usually audited on site.

Organisations with several sites are sampled across the cycle according to accreditation rules on multi-site certification. Not every site needs a visit every year, but central functions such as internal audit and management review are examined at each surveillance.

Keeping the cycle steady

Organisations that keep their certificates without drama tend to do the same few things. They run internal audits on a schedule rather than in the weeks before a visit, hold management reviews that make decisions, and close corrective actions promptly with evidence.

Put the dates for the whole cycle in your own calendar when you receive the audit programme. Check your entry in the register from time to time, and contact us as soon as anything changes that could affect the scope.

Treat each surveillance report as input to your management review. The findings and opportunities for improvement are an outside view of your system, and acting on them steadily makes recertification a confirmation rather than a test.