You got your ISO 9001 certificate — congratulations! Now you need to maintain it. ISO 9001 certification operates on a 3-year cycle with annual surveillance audits in Year 1 and Year 2, followed by a full recertification audit in Year 3. This guide tells you exactly what happens at each stage and how to stay audit-ready without disrupting your business.
The 3-Year ISO 9001 Certification Cycle
ISO 9001 certification does not last forever — it requires regular audits to confirm you are maintaining the quality management system. The cycle works as follows:
| Timing | Audit Type | What Happens | Duration |
|---|---|---|---|
| Initial — Year 0 | Certification Audit (Stage 1 + Stage 2) | Full audit to earn the certificate | 2-4 days |
| Month 9-12 — Year 1 | Surveillance Audit 1 | Verify continued compliance, check key processes | 0.5-1 day |
| Month 21-24 — Year 2 | Surveillance Audit 2 | Verify sustained performance, check remaining areas | 0.5-1 day |
| Month 30-36 — Year 3 | Recertification Audit | Full re-audit, new 3-year certificate issued | 1.5-3 days |
What Is a Surveillance Audit?
A surveillance audit is a shorter, focused audit by your certification body (CB) to verify that you are maintaining and continuing to improve your quality management system. Unlike the initial certification audit which covers everything, surveillance audits are more targeted — typically focusing on:
- Areas where non-conformities were found previously
- High-risk processes or those that have changed significantly
- Key ISO 9001 requirements: internal audits, management reviews, customer complaints, corrective actions
- A sample of other processes not covered in the previous audit
Year 1 Surveillance Audit — What to Expect
The first surveillance audit (typically 9-12 months after initial certification) checks whether you have truly embedded the QMS into daily operations:
What the auditor will always check:
- Have you conducted at least one internal audit since certification?
- Have you held a management review meeting?
- Are quality objectives being monitored — and is performance acceptable?
- Are customer complaints being handled per your documented procedure?
- Are corrective actions from the initial audit closed out?
- Are records being maintained correctly?
Year 1 Tip — Conduct Internal Audit Before Surveillance
Schedule your internal audit 4-6 weeks before the surveillance audit date. This gives you time to identify and correct any issues before the CB auditor arrives. Elite Assured offers internal audit support as part of ongoing post-certification assistance.
Year 2 Surveillance Audit — What to Expect
The second surveillance audit (months 21-24) assesses whether the QMS is being continuously improved — not just maintained.
Additional focus areas in Year 2:
- Trends in quality performance metrics — are things getting better?
- Evidence of continuous improvement actions beyond just fixing problems
- Processes not audited in Year 1 surveillance
- Customer satisfaction trends and actions taken
- Any significant changes to products, services, or processes since Year 1
Year 3 Recertification Audit
The recertification audit (months 30-36) is a comprehensive re-audit of your entire QMS — similar in scope to the original certification audit. It covers all processes, all clauses, and assesses the overall effectiveness and maturity of your quality management system. Successful completion issues a new 3-year certificate.
Most Common Surveillance Audit Findings in India
| Finding | Root Cause | Prevention |
|---|---|---|
| No internal audit conducted | Busy operations, forgotten after certification | Schedule internal audit in calendar immediately after cert |
| Management review not held | Not prioritized after initial audit excitement | Schedule annual management review in advance |
| Records not updated | Team reverts to old informal ways | Monthly record check by QMS coordinator |
| Quality objectives not tracked | KPI data not collected systematically | Monthly quality dashboard review |
| Corrective actions overdue | Actions assigned but not followed up | Monthly corrective action register review |
How to Stay Audit-Ready All Year
The secret to painless surveillance audits is treating ISO 9001 as a living system, not a filing cabinet. Simple monthly habits:
- Month 1-12: Fill in quality records as work happens (not in a rush before the audit)
- Quarterly: Check quality objective performance against targets
- 6 months before surveillance: Conduct internal audit, close any findings
- 1 month before surveillance: Hold management review, update corrective action register, ensure all records are current