An ISO 27001 certificate is valid for three years from the certification decision. The certification body audits you at least once a calendar year in between: surveillance audits in years one and two, shorter than the initial audit and focused on whether the ISMS is still running and improving, then a recertification audit before the certificate expires, which re-examines the whole system. Miss a surveillance audit or leave a major nonconformity open and the certificate can be suspended, then withdrawn. These rules come from ISO/IEC 17021-1 and apply to every accredited certification body.
Getting the certificate is the shorter half of ISO 27001. Keeping it means a certification body auditor comes back every year for three years, then starts the cycle again. The rules are the same for every accredited body because they come from ISO/IEC 17021-1, with the audit time set by IAF MD 5. This article explains what each visit covers and what can end a certificate early.
The three-year cycle
| When | Audit | What it covers | Relative effort |
|---|---|---|---|
| Year 0 | Initial certification: Stage 1 and Stage 2 | Readiness, then the whole ISMS in operation | The full audit time for the scope |
| Within 12 months of the decision | First surveillance audit | The mandatory items below plus a sample of controls and clauses | As a rule of thumb, about a third of the initial audit time per year, per IAF MD 5 |
| Year 2 | Second surveillance audit | The mandatory items again plus the parts not sampled in year one | About a third of the initial audit time |
| Before the expiry date | Recertification audit | The whole ISMS, its performance over the cycle and its continued relevance to the scope | About two thirds of the initial audit time |
What every surveillance audit covers
ISO/IEC 17021-1 fixes a minimum for every surveillance audit, whatever else the certification body samples that year:
- The internal audits and the management review since the last visit.
- What was done about the nonconformities raised at the previous audit.
- How complaints were handled.
- Whether the ISMS is achieving its objectives and the intended results.
- Progress on planned activities for continual improvement.
- Continuing operational control.
- Changes to the organisation, the scope or the system.
- Use of the certification mark and references to being certified.
Beyond those, the auditor samples clauses and Annex A controls. The certification body's audit programme is planned so that the whole standard is covered over the cycle, which is why the second surveillance audit often lands on the controls the first one skipped.
The recertification audit
Recertification is a full audit of the ISMS against the standard, planned from the results of the two surveillance audits and looking at performance across the whole cycle: whether the system is still effective, still relevant to the scope, and still improving. Where there have been significant changes to the system or the organisation, the certification body can require a Stage 1 as well.
The timing matters. The audit, the closure of any major nonconformities and the certification decision all have to be complete before the current certificate expires, or the certificate lapses. ISO/IEC 17021-1 lets the certification body restore a lapsed certificate within six months if the outstanding recertification activities are completed; after that, at least a Stage 2 audit has to be done again. A renewed certificate's expiry date follows on from the previous cycle, so finishing early does not shorten the cycle.
Suspension, withdrawal and scope reduction
A certification body suspends a certificate when the ISMS has persistently or seriously failed to meet the requirements, when you do not allow surveillance or recertification audits to take place at the required frequency, or at your own request. A suspended certificate is temporarily invalid and you may not advertise it. If the cause is not resolved within the time the body sets, which is usually no more than six months, the certificate is withdrawn or its scope reduced to exclude the failing parts. A withdrawn certificate means starting again with a new initial audit.
Keeping the ISMS alive between audits
- Run the internal audit programme and the management review every year, not in the weeks before the auditor arrives; both are checked at every visit.
- Keep evidence accumulating as controls run, so a sample request for any month of the year can be answered from records rather than reconstructed.
- Review the risk assessment on the schedule you set and whenever something significant changes, and update the Statement of Applicability to match.
- Tell the certification body about changes to the scope, the organisation, the sites or the key systems; a surveillance audit is also where scope extensions are assessed.
- Track corrective actions from the last audit to closure with evidence, because they are the first thing the next audit opens.
The timeline article covers the road to the first certificate, and the Stage 1 versus Stage 2 article explains the initial audit the cycle begins with.
Primary sources
- ISO/IEC 17021-1:2015 — requirements for bodies providing audit and certification of management systems, ISO
- IAF MD 5 — determination of audit time of quality, environmental and occupational health and safety management systems, International Accreditation Forum
- ISO/IEC 27001:2022 — information security management systems, ISO