Maintaining ISO 9001 certification after year one: surveillance audits explained

The mistakes that actually lead to losing certification

Certificates are rarely lost because of one dramatic failure. They are lost through a predictable, gradual pattern that auditors have seen many times before:

• Treating the QMS as an audit-week exercise. Procedures get dusted off the week before the auditor arrives instead of being used day to day. Auditors can tell — inconsistent records, gaps in dates, and staff who can't explain the procedure they supposedly follow are the giveaway.
• Not closing corrective actions on time. A minor nonconformity left open past its agreed deadline typically escalates in severity at the next audit. Repeated unresolved findings signal a management commitment problem, which is a Clause 5 issue, not just a paperwork issue.
• Skipping or watering down internal audits. Internal audits are your own early-warning system. Organisations that stop running them, or run them as a formality without real findings, walk into surveillance audits blind — and so does the external auditor, who will dig deeper when internal audit evidence looks thin.
• Ignoring documentation after staff turnover. A quality manager leaves, the QMS owner changes, and nobody updates the document control log, training records, or competence matrix for months. Clause 7.2 (competence) findings are common in this scenario.
• Uncontrolled change. A new production line, ERP system, or supplier is introduced without updating the relevant procedures or risk assessment. The QMS documentation stops matching reality — a major nonconformity risk.
• Not tracking customer complaints properly. A complaints log that is incomplete, or complaints that never trigger root-cause analysis, is one of the most common findings at surveillance stage.

When a major nonconformity is raised, the certification body sets a correction deadline — commonly around 90 days, though the exact period depends on the certification body's procedures and the severity of the finding. If it isn't closed in time, the certificate can be suspended; if suspension isn't resolved, it can be withdrawn entirely, meaning you start the initial certification process again from scratch.

Preparing for recertification in year three

The recertification audit is close in depth to the original certification audit — the certification body needs to re-confirm your QMS meets ISO 9001:2015 across the full scope, not just the clauses sampled during surveillance. Good preparation starts long before the audit date:

1. Review the full three-year audit history. Pull every finding from the initial audit and both surveillance visits, and confirm each one has closed, evidenced corrective action — not just a note that says "fixed."
2. Run a genuine internal audit covering the whole QMS scope in the months before recertification, not just the clauses that are easy to check.
3. Hold a management review with real inputs (audit results, KPI trends, complaint trends, risk register updates) and real outputs (decisions, resourcing, objectives for the next cycle).
4. Reconcile documentation with reality. Any process, supplier, site, or product change since the last full audit needs its procedures and risk assessments updated to match.
5. Check competence records are current for all staff in scope — training certificates, inductions, and the competence matrix required under Clause 7.2.

Where the ongoing cost and effort really goes

Most organisations budget carefully for the initial certification cost but underestimate the ongoing internal labour of staying audit-ready across three years — someone has to keep hundreds of procedures, forms, and records current, findable, and reviewed on schedule between audits. If you are still scoping the investment, it's worth using the ISO 9001 certification cost calculator to calculate the exact cost for your company, including the ongoing surveillance-audit and documentation-maintenance effort most quotes leave out.

IgeraIndustria indexes your full QMS — procedures, work instructions, forms, and records — so quality managers can instantly find the current approved revision of any document, check when a procedure was last reviewed, and pull evidence for an auditor's question in seconds instead of searching shared drives. That matters most in the months between audits, when documentation drift is easiest to let happen unnoticed.

Practical tips to stay audit-ready year-round

Frequently asked questions

How often are ISO 9001 surveillance audits carried out?

Once a year, in year one and year two of each three-year certification cycle. Some certification bodies offer six-monthly surveillance for higher-risk sectors or larger, multi-site organisations, but annual is the standard model under ISO/IEC 17021-1.

Can I lose ISO 9001 certification between audits, not just at a surveillance visit?

Yes, in specific circumstances — for example if you fail to pay certification fees, fail to notify the certification body of significant organisational changes as required, or if a customer complaint or incident triggers an unannounced or short-notice audit that uncovers serious nonconformities. Suspension and withdrawal are governed by the certification body's procedures, which themselves follow ISO/IEC 17021-1 rules.

What is the difference between a minor and a major nonconformity?

A minor nonconformity is an isolated lapse that doesn't undermine the QMS's ability to deliver its intended results — for example, one missing signature on a form. A major nonconformity indicates a systemic failure, an absence of a required process, or several related minor findings that together show the system isn't working — for example, no evidence that internal audits happened all year. Major nonconformities carry a stricter closure deadline and put certification at real risk if unresolved.

Does recertification cost the same as the initial certification?

Recertification audits are generally similar in scope and duration to the initial Stage 2 audit, so day rates are comparable, though the exact fee depends on the certification body, your organisation's size, and whether your scope or site count has changed since the last full audit. It is usually less expensive than initial certification because there is no Stage 1 gap-analysis audit, but it is not a token fee — budget for a comparable audit duration.

If we change certification body mid-cycle, do we restart the three-year clock?

Transfer of accredited certification between certification bodies is possible under IAF rules and, when done correctly, preserves your original certification date and cycle rather than restarting it. The receiving certification body will typically review your existing certificate, audit history, and any open corrective actions before accepting the transfer.

Article reviewed by IgeraIndustria Quality Team, updated 2026-08-02. References: ISO 9001:2015 Quality management systems — Requirements; ISO/IEC 17021-1 Conformity assessment — Requirements for bodies providing audit and certification of management systems; IAF Mandatory Documents on certification transfer and MLA scope.