Glossary · ISO and management systems
Certification is renewed in small doses: the yearly surveillance audit.
A periodic audit, at least once a year, by the certification body between full recertifications, sampling parts of the ISMS to confirm the certificate should stand.
Back to the glossary01 · In plain words
In plain words
A periodic audit, at least once a year, by the certification body between full recertifications, sampling parts of the ISMS to confirm the certificate should stand.
An ISO 27001 certificate runs on a three-year cycle. Between the initial audit and recertification, the certification body comes back for surveillance audits. Each one checks a sample of the system, not the whole of it.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
Passing the certification audit is not the end. If a surveillance audit finds that the ISMS has stopped working, for example no internal audit or no management review since the last visit, the certification body can raise nonconformities and, if they are not closed, suspend the certificate. Customers who check certificate status would see that. Treating each surveillance visit as a routine check keeps the certificate valid and the system honest.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- The certification body's three-year audit programme
- Sets which clauses and controls each surveillance visit will cover.
- Your internal audit and management review records
- Always looked at, since they show the ISMS is maintaining itself.
- The previous audit report
- Open findings from last time are checked for closure.
- The surveillance audit report
- Records findings and the recommendation to maintain the certificate.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a transcription firm's first surveillance visit
A medical-transcription company in Kochi was certified last year. Since then it has opened a second office and moved to a new ticketing tool. At the first surveillance audit, the auditor samples how the new office was brought into scope, checks the internal audit and management review, and confirms the minor nonconformity from certification was closed. One new minor finding is raised on access reviews for the ticketing tool, with a corrective action plan to follow.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Recertification audit
- A fuller audit near the end of the three-year cycle that renews the certificate. Surveillance only maintains it.
- Internal audit
- Run by or for your own organization. A surveillance audit is run by the external certification body.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Complete an internal audit and a management review before each visit.
- Close or progress every open nonconformity, with evidence.
- Record changes to scope, sites, systems and key people since the last audit.
- GuideISO 27001 certification guideThe roadmap, Stage 1 and Stage 2, and the three-year cycle.
- GuideHow long an ISO 27001 certificate lastsThe cycle of audits, and what keeps a certificate valid.
- GuideThe ISO 27001 internal auditWho may audit, what to test, and how to report.
Sources: ISO/IEC 17021-1:2015, requirements for bodies providing audit and certification of management systems; ISO/IEC 27006, requirements for bodies certifying information security management systems; ISO/IEC 27001:2022, clauses 9.2 and 9.3 (titles only).
Questions about Surveillance audit
Is a surveillance audit shorter than the certification audit?
Usually, yes.
It samples part of the ISMS rather than all of it. Audit time is set by the certification body using the rules it follows, so ask yours for the plan.
Can we skip a surveillance audit?
Not without risking the certificate.
Surveillance is part of keeping the certificate. Missing it can lead the certification body to suspend or withdraw certification under its rules.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.