You've got your ISO certificate — congratulations! But the journey doesn't end there. ISO certification is a 3-year cycle with annual surveillance audits that verify your QMS continues to perform effectively. This guide explains exactly what to expect at surveillance audits and how to maintain your certification smoothly.
The 3-Year ISO Certification Cycle
| Time | Audit Type | Purpose |
|---|---|---|
| Month 0 | Initial certification (Stage 1 + Stage 2) | Get the 3-year certificate |
| Month 9-12 | Surveillance Audit 1 | Verify continued compliance |
| Month 21-24 | Surveillance Audit 2 | Verify sustained QMS performance |
| Month 30-36 | Recertification Audit | Full re-audit, new 3-year certificate |
What is a Surveillance Audit?
A surveillance audit is an annual check by your certification body to verify your QMS continues to function effectively. It is less comprehensive than the initial certification audit (Stage 2) but covers all key areas of your QMS in a representative sample.
Key characteristics:
- Typically 50-60% the duration of your initial Stage 2 audit
- Covers a sample of processes — not every process every year
- Focuses on changes since the last audit and ongoing effectiveness
- Always reviews internal audits and management review
- Always reviews corrective actions from previous audit findings
What Surveillance Auditors Focus On
| Area | What's Checked |
|---|---|
| Internal Audits | Have they been conducted? Findings closed? Effective? |
| Management Review | Conducted at planned intervals? Top management engagement? |
| Corrective Actions | Closed effectively? Root causes addressed? |
| Customer Complaints | Trends? Recurring issues? Action taken? |
| Quality Objectives | Measured? Achieving? Updated for new period? |
| Changes | New products, processes, sites? Properly implemented? |
| Document Updates | Documents reflecting current practice? |
| Sample Process Audits | 2-4 key processes audited in detail |
| Calibration Records | Equipment calibration current? |
| Training Records | Recent training documented? Competency maintained? |
Cost of Surveillance Audits
Surveillance audit costs are typically 40-60% of the initial certification audit cost. For example:
- Small business (initial audit Rs.15,000) — surveillance audits ~Rs.7,000-9,000 each
- Medium business (initial audit Rs.50,000) — surveillance audits ~Rs.20,000-30,000 each
- Large business (initial audit Rs.1,00,000) — surveillance audits ~Rs.50,000-60,000 each
With Elite Assured, surveillance audit support is provided as part of our ongoing relationship — we help you prepare and are present during the audit.
How to Prepare for a Surveillance Audit
3-4 weeks before the surveillance audit:
- Conduct your annual internal audit — covering all processes
- Hold the management review meeting with documented minutes
- Review and update your risk register
- Update Quality Objectives for the new period if previous ones achieved
- Close any open corrective actions from internal audit or previous surveillance audit
- Ensure all required records are current and easily retrievable
- Update employee training records
- Verify calibration certificates are current
- Compile customer complaint data and trend analysis
Common Surveillance Audit Findings
- Internal audit not conducted in the past 12 months
- Management review skipped or held informally without minutes
- Previous corrective actions not closed effectively
- Calibration of equipment overdue
- Significant changes (new product, new site) not reflected in QMS documentation
- Customer complaints not analyzed for trends
- Quality objectives not measured or tracked
- Risk register not updated for changes in business context
- Document control issues — outdated versions still in use
- Training records missing for new employees
When Can a Certificate be Suspended or Withdrawn?
Certificate Suspension Reasons
Your ISO certificate can be suspended or withdrawn if: (1) Major non-conformities found at surveillance audit are not addressed within agreed timelines, (2) You don't allow the surveillance audit to take place, (3) Significant adverse findings (regulatory action, customer harm) come to the certification body's attention. Suspension is rare — almost always avoidable with basic QMS maintenance.