- Home
- Certification
- Services
- Surveillance.
Surveillance.
A surveillance audit is on site, it is not a full system audit, and the first one has a hard deadline that runs from the certification decision — not from the audit.
What actually happens.
- Internal audits and management review since the last audit
- Actions taken on nonconformities raised at the previous audit, and whether they worked
- Treatment of complaints received since the last audit
- Effectiveness of the system against your own objectives and the intended results of the management system
- Progress of the activities you planned for continual improvement
- Continuing operational control of the processes inside the certified scope
- Any changes — to the organisation, the sites, the activities, the personnel or the system itself
- Use of certification marks and every other reference you make to being certified
- Alongside the on-site audit: review of your public statements about the certification, including your website and promotional material
The rules this runs under.
| The rule | What it requires | Reference |
|---|---|---|
| At least once a calendar year | Surveillance audits are conducted at least once per calendar year, except in the year a recertification audit is carried out. | ISO/IEC 17021-1:2015, 9.1.3.3 |
| The first one runs from the decision | The date of the first surveillance audit after initial certification is not more than 12 months from the certification decision date. This is the most commonly misquoted rule in certification: the clock does not start at Stage 2 and it does not start at certificate issue. | ISO/IEC 17021-1:2015, 9.1.3.3 |
| Eight elements are the minimum | Internal audit and management review, previous nonconformities, complaints, effectiveness against objectives, improvement progress, continuing operational control, changes, and use of marks. | ISO/IEC 17021-1:2015, 9.6.2.2 |
| It is explicitly not a full system audit | Coverage of the whole standard is achieved across the audit programme for the cycle, not within each surveillance visit. | ISO/IEC 17021-1:2015, 9.6.2.2 · 9.1.3 |
| On site, plus other monitoring | Surveillance includes on-site auditing and may also include enquiries, review of your statements about your operations, and requests for documented information. | ISO/IEC 17021-1:2015, 9.6.2.1 |
| Time is proportionate, not nominal | Annual surveillance time is approximately one third of the initial certification audit time, and is unlikely to be less than one audit day. | IAF MD 5:2023, Issue 4 Version 3, clause 5 |
What you will be asked to produce.
- Internal audit programme, reports and the competence basis of the internal auditors
- Management review records for the period, with the decisions taken
- The complaints register, including complaints that were closed without action and why
- Evidence that previous corrective actions were effective — not that they were carried out
- A statement of changes since the last audit, including changes you judged not to be significant
- Performance data against the objectives, covering the full period rather than the month before the audit
- Every current use of the certification mark, on documents, packaging, vehicles and online
Where this goes wrong.
Two failures account for most of it. The first is treating surveillance as a lighter repeat of the certification audit and preparing only the same evidence — surveillance has its own mandatory content under clause 9.6.2.2, and use of marks and treatment of complaints are in it. The second is the 12-month deadline. Because it runs from the certification decision, an organisation that had a long gap between Stage 2 and the decision has less time than it assumes. Missing it is not an administrative matter: the audit programme under clause 9.1.3 is a condition of the certification.
How the audit time is determined.
Surveillance time is derived from the initial certification audit time rather than calculated from scratch — approximately one third of the combined Stage 1 and Stage 2 time, recalculated where the effective number of personnel, the sites or the scope have changed. It is unlikely to be less than one audit day regardless of how small the organisation is.
The rest of the certification route
Describe the claim — not the service.
Tell us what must be relied on, who will rely on it and by what date. We will confirm the correct programme, evidence requirement and responsible entity — or tell you it is outside our scope.