Why the certificate depends on what happens between audits
An ISO 27001 certificate is valid for three years. Between the initial certification and the recertification audit, the certification body runs surveillance audits at least once a calendar year, as required by ISO/IEC 17021-1, the standard that governs accredited certification bodies. The first surveillance audit takes place within twelve months of the certification decision. The rules of the cycle are set out in our article on the stage 1 and stage 2 audit.
This article covers the other half of the question: what the organisation has to produce between those dates. A surveillance audit does not look at the project that won the certificate. It looks at the period since the last visit and asks whether the information security management system, the ISMS, kept running. The evidence it samples is a set of records that only exist if the work happened at the right time.
The difference between an ISMS and a folder of policies shows up here first. Policies written for the initial audit can stay unchanged for years. The records an ISMS generates cannot, because they are dated and tied to the period being audited.
What the ISMS has to produce every year
ISO 27001:2022 does not use the word annual for most of its activities. It says "at planned intervals" and leaves the interval to the organisation. In practice, the certification body visits every year and expects to find each of the activities below completed at least once since the previous audit, with records that prove it.
Internal audit
Clause 9.2 requires internal audits at planned intervals, run against an audit programme the organisation defines. The programme sets the frequency, the methods, the responsibilities and the scope of each audit. Across the three year cycle, it has to cover the whole ISMS, including the Annex A controls listed as applicable.
The auditor will ask to see the programme, the reports from the audits already run and the evidence that findings were followed up. Internal auditors must be objective and impartial, which in a small company usually means someone outside the area being audited or an external auditor. An internal audit report written by the person who runs the controls it audits is a common surveillance finding.
Management review
Clause 9.3 requires top management to review the ISMS at planned intervals. Clause 9.3.2 lists the inputs the review must consider: the status of actions from previous reviews, changes in external and internal issues, changes in the needs and expectations of interested parties, feedback on information security performance, feedback from interested parties, the results of risk assessment and the status of the risk treatment plan, and opportunities for improvement.
The output, under clause 9.3.3, is a set of decisions on continual improvement and on any changes needed to the ISMS. The record of the review is what the auditor samples. Minutes that list the inputs but record no decisions suggest that the review was a formality.
Risk assessment and risk treatment
Clause 8.2 requires information security risk assessments at planned intervals and when significant changes are proposed or occur. Clause 8.3 requires the risk treatment plan to be implemented and its results retained. A risk register with the same date as the initial certification is a signal that the assessment has not been repeated.
The practical test is whether the register reflects the company as it is now. New products, new suppliers, new office locations and new threats should appear in it. Our guide to the ISO 27001 risk assessment explains the method; the surveillance audit checks that it has been applied again.
Objectives, monitoring and measurement
Clause 6.2 requires information security objectives that are measurable where practicable, with plans to achieve them. Clause 9.1 requires the organisation to determine what is monitored and measured, when, and how the results are analysed. Each surveillance audit asks how the objectives set last year turned out and what the measurements show.
Objectives that are never measured, or measurements that nobody analyses, are a weak point the auditor will find quickly. The records needed are simple: the objective, the target, the result and what was decided because of it.
Nonconformities and corrective action
Clause 10.2 requires the organisation to react to nonconformities, evaluate the need to eliminate their causes, implement corrective action and review its effectiveness. Findings from the previous certification audit, from internal audits and from incidents all feed into this process.
The first thing a surveillance audit checks is the status of the findings from the last external audit. Minor nonconformities left open, or closed without evidence that the cause was addressed, are the most common route to a major nonconformity at the next visit.
Competence, awareness and the Statement of Applicability
Clauses 7.2 and 7.3 require evidence that people are competent for their security roles and aware of the security policy and their contribution to the ISMS. Training records, onboarding checklists and the results of phishing simulations are the usual evidence, and they need to cover people who joined during the year. Our article on security awareness and ISO 27001 sets out what the control expects.
The Statement of Applicability has to match the controls actually in place. When a control is added, removed or changed, the SoA changes with it. An auditor comparing the SoA with what they observe on site will treat a mismatch as a finding.
The certification cycle, year by year
The three year cycle has a rhythm. Knowing what each year is for makes the records easier to plan.
Year one: from the certification decision to the first surveillance audit
The first year after certification is when most ISMSs slow down. The project team disbands, the consultant leaves and the policies sit unchanged. The first surveillance audit, within twelve months of the certification decision, is designed to catch exactly this.
By that date, the organisation needs one complete pass of the operating cycle: an internal audit against the programme, a management review with recorded decisions, a risk register reviewed since certification, corrective actions closed for the findings from the stage 2 audit and measurements against the objectives set at the start.
Year two: the second surveillance audit
The second surveillance audit usually samples different processes and controls from the first, following the certification body's audit programme. Areas that were not looked at in year one are more likely to be examined now.
This is also the year in which changes accumulate. The company has often grown, changed tools or added suppliers since certification. The second audit checks that the ISMS absorbed those changes through the risk assessment and the SoA, rather than leaving them outside the system.
Year three: preparing for recertification
The recertification audit has to be completed, and the certification decision taken, before the certificate expires. Certification bodies plan it several months ahead, so the internal audit programme should finish covering the whole scope before then, and the last management review of the cycle should take place in time for its decisions to be visible.
This is the moment to read the three year history as the auditor will: the internal audit reports, the management review records, the corrective action log and the evolution of the risk register. Gaps that were tolerable in a single year become visible when the cycle is reviewed as a whole.
Changes the certification body needs to hear about
Certification bodies require certified clients to inform them without delay of changes that may affect the management system or the certificate. Typical examples are changes to the legal status or ownership of the company, to key management, to addresses and sites, to the scope of operations under the certificate and major changes to the ISMS and its processes. Each certification body sets out the list in its certification agreement, which is the document to check.
The reason is practical. Audit duration is calculated from factors such as the number of people within scope and the number of sites. A company that has doubled its headcount since certification may need longer audits, and the certificate may need to be reissued with a new scope or address. Reporting the change before the audit lets the certification body plan for it. Discovering it on the day of the audit can lead to a finding or a rescheduled visit.
Scope changes also work in the other direction. A company that wants to extend the certificate to a new product or site can ask for the extension to be assessed during a surveillance audit, as long as the new scope has been running inside the ISMS long enough to produce evidence.
What recertification adds to a surveillance audit
A surveillance audit samples part of the ISMS. A recertification audit evaluates the continued fulfilment of all the requirements of ISO 27001 and reviews the performance of the management system over the whole certification period, including the reports from previous surveillance audits. It is closer in depth to the initial stage 2 than to a surveillance visit.
Timing matters more here than anywhere else in the cycle. If the recertification activities are not completed before the certificate expires, the certificate lapses. According to the European co-operation for Accreditation's interpretation of ISO/IEC 17021-1, the certification body can restore the certificate within six months of expiry if the outstanding recertification activities are completed. After those six months, at least a stage 2 audit is required, and the organisation is in effect certifying again.
During the gap, the organisation has no valid certificate. For a company that holds ISO 27001 because a customer contract requires it, that gap can be the most expensive outcome of the whole cycle.
Changing certification body during the cycle
A company can move its certificate to another accredited certification body during the cycle. The process is governed by IAF MD 2, the International Accreditation Forum's mandatory document on transfers. Only valid accredited certification can be transferred, and a certificate known to be suspended cannot be accepted for transfer.
The accepting certification body carries out a pre-transfer review, which covers the validity of the certificate, the reports from recent audits and the status of any open nonconformities. If the review finds no problems, the certification cycle continues from where it was. If it finds issues that prevent the transfer, the client is treated as a new client and the cycle starts again from a new certification decision.
The practical advice is to transfer between audits, with no open major nonconformities, and with the previous audit reports available. A transfer is not a way to escape findings: they move with the certificate.
Where Qalea fits
The records a surveillance audit samples are the ones that are easiest to postpone, because nobody outside the security team notices when they are missing. Qalea's platform schedules the internal audit programme, the management review and the risk reassessment, and keeps their records against the clauses they satisfy. The monitoring layer, with EDR, SIEM and a SOC, produces the operational evidence for the technical controls as part of normal work, not as a collection exercise before the auditor arrives.
For a company that certified because a customer required it, that means the security work keeps running between audits, which is what keeps the certificate valid. The same discipline applies to ENS, as described in our article on maintaining ENS certification between audits. More on the standard is in our ISO 27001 topic hub.
