ISO 9001 surveillance and recertification: what the three-year cycle demands, year by year

How the three-year cycle works

ISO 9001 does not say how often you are audited; ISO/IEC 17021-1, the standard every accredited certification body must meet, does. The cycle starts with the certification decision, not the last day of Stage 2, and spans three years: a surveillance audit in each of the first two and a recertification audit in the third, completed before the certificate expires. Surveillance happens at least once in every calendar year except the recertification year, and the first visit comes no more than 12 months after the decision. The recertification decision opens the next cycle.

The expiry date is therefore conditional: it holds only while audits happen when due and their findings are closed. Sterling does not certify; your independent, accredited certification body plans the programme, performs the audits and decides whether certification continues.

Year by year: what each audit covers and what to have ready

Visit length follows the accreditation rules on audit time (IAF MD 5, since reissued by Global ACI): surveillance in a year totals about a third of the initial certification audit time, and recertification normally about two-thirds of what an initial audit would now need, recalculated from your current headcount and sites.

What a surveillance audit samples, and what it never skips

Surveillance takes place on site but is not a full-system audit. ISO/IEC 17021-1 fixes a core that every visit examines:

• internal audits and management review;
• action on the last audit's nonconformities;
• complaints handling;
• achievement of your objectives and intended results;
• progress on planned improvement;
• continuing operational control;
• changes since the last audit;
• use of the certificate, marks and other references to certification.

The rest is sampled. As the programme must reach every requirement over the cycle, each visit normally takes a different slice of processes, sites, shifts or product lines, drawn towards complaints, changes and weak spots in the last report.

Findings are graded as at Stage 2. A major nonconformity must be corrected and verified within the certification body's time limit, or the certificate risks suspension; a minor one is normally checked at the next visit. ISO 9001 nonconformities: major, minor and how to close them covers the response.

What recertification re-examines

Recertification is not a longer surveillance visit. It confirms that the whole system still conforms, still works and still fits the certified scope. The certification body reviews the cycle's surveillance reports, then audits every requirement on site, asking whether the system remains effective given internal and external change, whether management is committed to keeping it effective and improving it, and whether it delivers your objectives and intended results. Significant change can add a Stage 1.

Timing catches organisations out. Renewal must happen before the expiry date, and so must the correction and verification of any major nonconformity; otherwise the certificate is not extended. Certification can be restored within six months once the outstanding recertification activities are complete, but later than that the body requires at least a Stage 2 audit. Finish on time and the new expiry date can follow on from the old one.

Changes you must report to the certification body

Your certification agreement obliges you to tell the body without delay about anything that could affect the system's ability to keep meeting ISO 9001; the first five rows are ISO/IEC 17021-1's own examples. Saving them for the next visit can turn a routine change into a finding.

Extending the scope needs an application: the body reviews and audits the extension, possibly alongside a surveillance visit, and it counts only once the certificate shows it. ISO 9001 scope: how to define it, and the mistakes that cost you covers the wording.

Keeping the system alive between audits

Each surveillance audit samples the months since the last one, and a system that moves only before visits shows it: internal audits dated the same week, a management review without decisions, actions closed the day before. Four routines prevent that.

• Internal audits across the year, weighted towards the processes that matter most and the areas that changed, by auditors who do not audit their own work. See ISO 9001 internal audit: planning, conduct and reporting.
• A management review that decides, held at the planned interval, covering the inputs clause 9 of ISO 9001 requires, with decisions recorded against owners and dates. See ISO 9001 management review: inputs, outputs and the record.
• Corrective action closed on evidence: logged as problems arise, traced to a cause, closed only when results show the fix held.
• Measures somebody reads: objectives, customer feedback and supplier performance reviewed on a fixed rhythm, so you see the trend before the auditor does.

And check how the certificate and mark appear on your website, proposals and packaging.

A new edition mid-cycle: ISO 9001:2026

ISO 9001:2026 was published on 16 September 2026, and certificates to the 2015 edition must complete their transition by 30 September 2029, when Global ACI's three-year transition period ends. Its transition requirements allow the transition audit at surveillance, at recertification or at a separate special audit, so most organisations can use a visit already planned: choose it now and leave time to close findings. ISO 9001:2026: what changes and how to transition covers the rest.

How Sterling's Sustain™ supports the cycle

Sustain™ is the phase of Sterling OS™ that starts once the certificate is issued; as confirmed in your proposal, it covers internal audits, system upkeep, refresher learning and future transitions.

ISO 9001 surveillance and recertification: questions buyers ask