ISO 14001 surveillance audit and recertification: what the three-year cycle asks of your EMS

What happens after the ISO 14001 certificate is issued?

The certificate opens a three-year cycle rather than closing a project. The rules come from ISO/IEC 17021-1, which accredited certification bodies work to, not from ISO 14001. Counting from the certification decision, the body audits you at least once in each calendar year, the first surveillance audit no later than 12 months after the decision. In the third year the recertification audit has to be completed, and decided, before the expiry date on the certificate.

The expiry date holds only while audits happen when due and their findings are resolved. Sterling does not certify: your independent, accredited certification body sets the audit programme, sends the auditors and decides whether the certificate continues.

The cycle year by year

Visit length follows the accreditation rules on audit time for quality, environmental and OH&S systems (IAF MD 5, now reissued by Global ACI): annual surveillance totals roughly a third of the initial audit time, and recertification normally around two thirds of what a fresh initial audit would need, recalculated from current figures.

What an ISO 14001 surveillance audit checks

A surveillance audit is on site but deliberately partial. ISO/IEC 17021-1 names the items each visit must include:

• the internal audit and the management review since the last visit;
• what you did about the previous audit's nonconformities;
• how complaints were handled;
• whether the EMS is achieving its objectives and intended results;
• progress with continual improvement;
• continuing operational control;
• changes since the last audit;
• how the certificate, the mark and references to certification are used.

In an EMS, operational control means the auditor walks the chemical store, waste yard or effluent point and compares it with your operating criteria. Intended results means monitoring data for emissions, effluent, waste, energy and water against permit limits, from calibrated meters. Complaints include neighbours and regulators. Expect to be asked for the compliance evaluation under 9.1.2: what you checked, the result and what you did where you fell short.

The rest is sampled: different sites, activities or significant aspects each year, weighted towards change. Findings are graded major or minor as at Stage 2: a major must be corrected and verified within the body's time limit or suspension becomes a risk; a minor is usually followed up at the next visit. See ISO 14001 nonconformities: major, minor and how to close them.

What ISO 14001 recertification re-examines

Recertification asks whether the whole EMS still conforms, works and matches the certified scope. The body reviews the cycle's surveillance reports, then audits the full system on site: whether the EMS stayed effective through internal and external change, whether top management remains committed to it, and whether environmental objectives and intended results are met. After significant change, new environmental legislation for instance, it may add a Stage 1.

The audit, and the correction and verification of any major nonconformity it raises, must be finished before expiry, or the certificate is not extended. The body can restore certification within six months once the outstanding recertification work is done, but beyond that it will require at least a Stage 2 audit. Recertify in time and the new expiry date can run on from the old one without a gap.

Which EMS changes must go to the certification body?

Under your certification agreement, anything that could affect the EMS's ability to keep meeting ISO 14001 is reported without delay. The first five rows are ISO/IEC 17021-1's own examples.

Adding a site or activity needs an application: the body reviews and audits the extension, sometimes at a surveillance visit, and it counts once the certificate shows it. Wording the scope is covered in ISO 14001 scope: sites, activities and the mistakes that cost you.

How to keep the EMS running between surveillance audits

Surveillance samples the months since the last visit, so an EMS that wakes only in audit season shows: monitoring gaps then a burst of readings, a compliance evaluation signed the week before, a drill only on paper.

• Monitoring on a fixed schedule, reviewed against permit limits as results arrive.
• The aspects and obligations registers kept current, updated when a process, material, site or law changes. See Environmental aspects and impacts: building the register and Compliance obligations and the legal register, site by site.
• Internal audits spread through the year and weighted towards significant aspects and recent change. See ISO 14001 internal audit: planning, conduct and reporting.
• A management review that decides, with actions carrying owners and dates. See ISO 14001 management review: inputs, outputs and the record.
• Drills that test spills and releases, not only evacuation, with the plan revised afterwards.

Also check how the certificate and mark appear on your website, tenders and vehicles.

ISO 14001:2026 and your current cycle

ISO 14001:2026 was published on 15 April 2026. Under Global ACI's transition requirements, certificates to the 2015 edition must complete the move by 30 April 2029, and from 31 October 2027 accredited bodies issue new certificates only to the 2026 edition. The transition can be assessed at a scheduled surveillance audit, at recertification or at a separate transition audit, so most organisations can fold it into a visit already in the programme. Agree which with your body early and leave time to close findings. ISO 14001:2026: what changes and how to transition sets out the changes themselves.

How Sterling supports surveillance and recertification

Sustain™, the Sterling OS™ phase after certification, covers surveillance readiness, internal audits, refresher learning and future transitions, as your proposal states.

ISO 14001 surveillance audit and recertification: questions buyers ask