ISO 9001, 14001 and 45001 Surveillance Audit Guide

By Eren İşman, ISO Lead Auditor & TrainerPublished

Editorial note: UniCert is UAF-accredited for ISO 9001, ISO 14001 and ISO 45001, and is an IAF MLA signatory through that accreditation. See our accreditation.

An ISO auditor and a quality manager sit at a meeting room table reviewing printed management system records and a laptop during a surveillance audit.

A surveillance audit samples the certified management system rather than re-running every clause. Source: UniCert

A surveillance audit confirms that the management system behind your ISO certificate is still in use, still governed by management and still improving. It is a sampled check, normally carried out once a year, not a full re-run of the standard [1]. If you keep internal audits, management review and corrective actions live through the year, surveillance is straightforward. Problems appear when the system goes quiet after certification and the auditor is the first person to look at it in twelve months.

This guide explains where the surveillance audit sits in the three-year cycle, what to expect on the day, what auditors check every time, what they sample, and how to prepare. It covers ISO 9001, ISO 14001 and ISO 45001, whether you hold a single certificate or run integrated management system certification across all three. It is written for QHSE, quality and environmental managers at already-certified UK and US organisations with a visit in the calendar. If your system has gone quiet since the certification decision, read it alongside what happens after ISO certification.

What a surveillance audit is and where it sits in the three-year cycle

Accredited ISO certification runs on a three-year cycle. You earn the certificate through a two-stage initial audit, keep it through surveillance audits that are normally annual, and renew it through a recertification audit before it expires [1][2].

The surveillance audit is the shortest of the three. Its job is to confirm that the system is still operating, still delivering improvement, and that nothing about your organisation has changed in a way that affects the certificate. The auditor samples, looking at a slice of the system in depth rather than every clause. Across the two surveillance visits and the recertification, the whole management system is covered [1].

The first surveillance audit takes place within twelve months of the certification decision, then repeats at least once every calendar year until recertification [1]. Miss the window and the certificate can be suspended, so the date is fixed in a way an internal meeting is not.

Timeline of the three-year ISO certification cycle showing the two-stage initial audit, a surveillance audit in year one, a surveillance audit in year two, and a recertification audit before the certificate expires.

Surveillance audits sit between the initial audit and recertification in the three-year cycle. Source: UniCert

How surveillance differs from the initial audit and recertification

Surveillance is lighter than the initial audit in time and breadth, and it is not a soft version of it. It runs at about one third of the initial certification audit time, while recertification runs at about two thirds, both derived from the IAF MD 5 calculation for your organisation [2].

The biggest difference from your initial Stage 2 audit is scope. Stage 2 tested every clause of the standard before any certificate existed. Surveillance assumes the system was sound at certification and checks that it has stayed that way, focusing on evidence of ongoing use and on anything that has changed since the last visit.

Audit Typical timing Approximate duration Scope
Initial (Stage 1 and Stage 2) Before the first certificate is issued Full audit time from the IAF MD 5 calculation for your organisation [2] Whole management system, every clause, across two stages
Surveillance At least once every 12 months, with the first visit within a year of the certification decision [1] About one third of the initial audit time [2] Sampled: mandatory items every visit, the rest of the system across the three-year cycle
Recertification Before the three-year certificate expires About two thirds of the initial audit time [2] Whole management system again, plus performance and improvement over the cycle

What is checked at every surveillance audit

Every surveillance audit works through the same core set of items before the auditor turns to the year's sample [1]:

For an ISO 9001 surveillance audit that list is the backbone of the visit, alongside a sample of core operational processes [6].

ISO 14001 and ISO 45001 surveillance specifics

For ISO 14001 and ISO 45001 surveillance, auditors add environmental and occupational health and safety checks:

ISO 45001 surveillance also samples incident investigation (clause 10.2) and consultation and participation of workers (clause 5.4) [5], so keep incident records, investigation outcomes and consultation evidence to hand. Both themes run through day-to-day ISO 45001 certification.

What auditors sample beyond the mandatory items

Outside the fixed agenda, the auditor chooses a risk-based sample that changes each year. Common targets include core operational or production processes, activities with significant environmental aspects, high-risk tasks and their safe systems of work, areas that were weak at the last audit, new or changed sites, competence and training records, calibration and monitoring equipment, document and record control, and control of external providers.

Because the sample rotates, an area that was not examined last year is more likely to be selected this year. Preparing only the topics that came up at the previous visit is a predictable way to be caught out.

Surveillance audit preparation checklist

Preparation comes down to a dozen tasks you can start four to six weeks before the visit.

  1. Confirm the plan. Check the audit date, duration, standards in scope, sites and the auditor's draft agenda. An audit reminder tool keeps the date visible to everyone who needs to prepare.
  2. Close previous findings properly. For each prior nonconformity, hold root cause, correction, corrective action and objective evidence that it is effective. This is the single highest-value preparation task.
  3. Complete the internal audits due this cycle. Cover the processes and clauses scheduled for this year, raise findings honestly and record actions.
  4. Hold a documented management review. Include all required inputs, record decisions and actions, and make sure top management attended.
  5. Update objectives and show progress. Bring current data for each objective and a short explanation where targets are off track.
  6. Refresh compliance obligations (14001 and 45001). Update the register for regulatory change and record a dated evaluation of compliance [4][5].
  7. Compile incidents, near misses, complaints and feedback since the last visit, with investigation outcomes and actions.
  8. Review and declare changes. Update the organisation chart, scope statement and site list, and tell your certification body about anything material before the visit.
  9. Check mark and logo use. Audit your own website, brochures, proposals, email footers and signage.
  10. Brief process owners. Make sure the people who will be interviewed know the visit is happening and can retrieve their records.
  11. Walk the floor yourself. Look at housekeeping, labelling, waste and chemical storage, PPE, guarding and first aid provision as an auditor would.
  12. Prepare an opening pack. A short performance summary for the opening meeting sets the tone and saves time.

The most common reasons organisations pick up findings at surveillance

In my experience running surveillance visits, the most frequent cause of findings is corrective actions from the previous audit that were not closed out, or were closed on paper without evidence that they worked. An unresolved prior finding can be raised as a major nonconformity [1], and secondary guidance from certification consultancies reports the same pattern [7][8].

The second common cause is a system that has gone quiet since certification: no internal audits in the last year, no management review, objectives untouched. The paperwork exists from the certification project, and nothing has moved since.

Other recurring findings include an out-of-date legal register, no recorded evaluation of compliance, incident actions agreed but not implemented, objectives with no measurement, and incorrect use of the certification mark.

Integrated surveillance: all standards in one visit

If you hold more than one of ISO 9001, ISO 14001 and ISO 45001, surveillance can be run as a single integrated visit with aligned certificate dates. Shared clauses covering context, leadership, planning, support, performance evaluation and improvement are assessed once rather than three times [3].

An integrated visit means one plan, one opening and closing meeting, one set of interviews with senior management, and one report. It also gives a consistent picture of how the system performs as a whole. If your certificates currently run on different dates, ask your certification body about aligning them at the next recertification. Our overview of the integrated management system approach in the UK explains how the shared structure works.

What happens if you get a major nonconformity

A major nonconformity puts the certificate at risk and must be resolved within the timeframe set by your certification body and stated in your certification agreement. You will normally be asked to submit root cause analysis and a correction plan quickly, then provide evidence of effective implementation, which may require a follow-up visit before the finding can be closed [1].

If the major is not cleared within the agreed period, the certificate can be suspended and then withdrawn. A minor nonconformity is less serious: you submit a corrective action plan, and closure is usually verified at the next surveillance audit. Either way, raise your own findings through internal audit before the external auditor does, because a problem you already found and are acting on rarely becomes a major.

ISO 9001, 14001 and 45001 Surveillance Audit Guide

Practical summary of the key steps covered in this guide. Source: UniCert

Frequently asked questions

What is checked at a surveillance audit?

Every surveillance audit checks internal audits, management review, actions on previous findings, complaints and feedback, progress against objectives, use of the certification mark and any changes to the organisation or scope [1]. For ISO 14001 and ISO 45001 it also checks the compliance obligations register and your evaluation of compliance, with ISO 45001 adding incident investigation and worker consultation [4][5]. The rest of the system is sampled, and the sample changes each year.

How long does a surveillance audit take?

About one third of the time of the initial audit, based on the IAF MD 5 calculation for your organisation [2]. For a small single-site company that is often one day; larger or multi-site organisations take longer. Your certification body confirms the exact duration in the audit plan.

How often do surveillance audits happen?

At least once every twelve months. The first surveillance audit falls within a year of the certification decision, and visits continue yearly until the recertification audit at the end of the three-year cycle [1].

Can you fail a surveillance audit?

There is no pass or fail mark. The risk is a nonconformity, and specifically a major one that is not resolved in time, which can lead to suspension or withdrawal of the certificate. Most organisations leave with a mix of minor findings and opportunities for improvement and keep certification without interruption. For a fuller explanation, see can you fail an ISO audit.

Do we need a full internal audit before every surveillance visit?

You need enough of your internal audit programme completed to show the system is being checked from the inside, covering the areas scheduled for this year. Over the three-year cycle your internal audits should cover the whole system, mirroring the external cycle. A programme that has not run since certification is one of the most common findings.

Making the annual visit a checkpoint, not a scramble

Surveillance audits reward organisations that treat the management system as a live process rather than a certification project that finished on the day the certificate arrived. Keep internal audits running, hold a real management review, close findings with evidence, and keep your compliance register current, and the annual visit becomes a checkpoint rather than a scramble.

If you run an integrated system, align your surveillance dates and prepare once for all three standards. Start with the twelve-step checklist above, and book the internal audit and management review well before the external auditor arrives.

UniCert is UAF-accredited for ISO 9001, ISO 14001 and ISO 45001 and is an IAF MLA signatory through that accreditation: unicertification.co.uk/accreditation.

References

  1. ISO/IEC 17021-1:2015, Conformity assessment, requirements for bodies providing audit and certification of management systems, Part 1: Requirements. Clause 9.6 covers surveillance activities, including a first surveillance audit within 12 months of the certification decision, surveillance at least once each calendar year, and coverage of the whole management system across the three-year cycle. iso.org.
  2. IAF MD 5:2019, Determination of Audit Time of Quality, Environmental, and Occupational Health and Safety Management Systems. International Accreditation Forum. Surveillance audit time is approximately one third, and recertification approximately two thirds, of the initial certification audit time. iaf.nu.
  3. IAF MD 11:2013, Application of ISO/IEC 17021 for Audits of Integrated Management Systems. International Accreditation Forum. iaf.nu.
  4. ISO 14001:2015, Environmental management systems, requirements with guidance for use. Clause 6.1.3 (compliance obligations) and clause 9.1.2 (evaluation of compliance). iso.org.
  5. ISO 45001:2018, Occupational health and safety management systems, requirements with guidance for use. Clause 5.4 (consultation and participation of workers), clause 9.1.2 (evaluation of compliance) and clause 10.2 (incident, nonconformity and corrective action). iso.org.
  6. ISO 9001:2015, Quality management systems, requirements. iso.org.
  7. Advisera, guidance on preparing for the ISO surveillance audit (secondary).
  8. Verge Academy, guidance on ISO surveillance audits and common findings (secondary).