- Home
- Certification
- Services
- Recertification.
Recertification.
The one audit in the cycle that looks at the system in its entirety — and the one with a deadline that cannot be extended.
What actually happens.
- The effectiveness of the management system in its entirety, not a sample of it
- Internal and external changes across the whole cycle, and what they did to the system
- Whether the certified scope is still relevant and applicable to the organisation as it is now
- Demonstrated commitment to maintaining effectiveness and improving overall performance
- Effectiveness against your objectives and the intended results of the management system
- Review of every surveillance report from the cycle, read together rather than separately
- Performance of the system over the most recent certification cycle as a whole
- A Stage 1 where there have been significant changes to the system, the organisation or its context
- Renewal decision by authorised personnel independent of the audit team
The rules this runs under.
| The rule | What it requires | Reference |
|---|---|---|
| It addresses the system in its entirety | Recertification confirms continued conformity and effectiveness of the management system as a whole, and the continued relevance and applicability of the scope. This is what surveillance does not do. | ISO/IEC 17021-1:2015, 9.6.3.1.1 · 9.6.3.2.1 |
| It reads the whole cycle | The audit includes review of previous surveillance reports and considers performance of the system over the most recent certification cycle. | ISO/IEC 17021-1:2015, 9.6.3.1.3 |
| A Stage 1 may be required again | Where there have been significant changes to the management system, to the organisation, or to the context in which it operates — including changes to legislation — recertification may need a Stage 1. | ISO/IEC 17021-1:2015, 9.6.3.1.4 |
| Major findings must close before expiry | For any major nonconformity, time limits are set, and correction and corrective action must be implemented and verified before the certification expires. | ISO/IEC 17021-1:2015, 9.6.3.2.2 |
| Validity is not extended to wait for you | If the audit is not completed, or a major nonconformity cannot be verified as corrected before the expiry date, recertification is not recommended and the validity of the certification is not extended. | ISO/IEC 17021-1:2015, 9.6.3.2.4 |
| The cycle anniversary is preserved | Where recertification completes before expiry, the new expiry date can be based on the existing one, so the cycle does not drift. The issue date is on or after the decision. | ISO/IEC 17021-1:2015, 9.6.3.2.3 |
| Restoration is possible for six months | After expiry, certification can be restored within 6 months provided the outstanding recertification activities are completed. Beyond that, at least a Stage 2 is conducted. The expiry date is still based on the prior cycle. | ISO/IEC 17021-1:2015, 9.6.3.2.5 |
What you will be asked to produce.
- Internal audit and management review records covering the whole cycle, not only the current year
- Performance data across three years, so a trend can be read rather than a snapshot
- A record of every significant change to the organisation, the system and the regulatory context since the last recertification
- The current scope statement, checked against what the organisation actually does today
- Evidence of the improvement actually achieved, not the improvement planned
- Closure evidence for every nonconformity raised during the cycle
- Complaints and their outcomes across the full cycle
Where this goes wrong.
Recertification is scheduled too late. Because clause 9.6.3.2.4 prevents any extension of validity, and clause 9.6.3.2.2 requires major nonconformities to be verified as corrected before expiry, an audit held close to the expiry date leaves no room for a major finding. If one is raised, the certificate lapses. During the gap between expiry and a successful recertification decision the organisation is not certified and must not present itself as certified. Restoration within six months is possible, but it is a recovery route, not a plan. The second failure is a scope that quietly stopped describing the business three years ago — clause 9.6.3.2.1 tests exactly that.
How the audit time is determined.
Recertification time is approximately two thirds of the audit time that would be required for a full initial certification audit, calculated on current client information rather than on the information from three years ago. Where the organisation has grown, the base figure grows with it. It is unlikely to be less than one audit day.
The rest of the certification route
Describe the claim — not the service.
Tell us what must be relied on, who will rely on it and by what date. We will confirm the correct programme, evidence requirement and responsible entity — or tell you it is outside our scope.