Your first surveillance audit is due within twelve months of the certification decision, and a surveillance audit falls in each calendar year of the cycle after that, except the year you recertify. Recertification has to be complete before the certificate expires. These dates come from ISO/IEC 17021-1, the standard our own accreditation is granted against, so we have no discretion to extend them. Where a surveillance audit slips outside its window, the certificate is suspended, and a suspension that is not resolved ends in withdrawal.
The twelve months run from the certification decision, which is the date a reviewer who did not conduct your audit granted certification on the file. That is usually some weeks after the closing meeting at your Stage 2 audit, once your responses to any findings have been verified. We plan the first surveillance for around the eleventh month for that reason. One month of slack absorbs a single postponement without putting the certificate at risk.
Annual, in the cycle, means at least once in each calendar year, which is why a three-year cycle carries two surveillance audits and none in the recertification year. The audit needs a period of operation to look at. We sample what has happened since the last audit, and clause 9.2 and clause 9.3 of ISO 9001, ISO 14001 and ISO 45001 place an internal audit and a management review inside that period. A surveillance audit in month eleven means both have to be complete and recorded before it. An organization that reads "annual internal audit" as month twelve arrives at its surveillance with nothing for us to sample, and that is a nonconformity against clause 9.2 in a year when the system was otherwise running well.
When a date slips
Postponing an audit inside its window is scheduling. Moving it outside the window is a certificate matter, and the two arrive in the same email. Where the first surveillance cannot be held within twelve months of the decision, or a later one cannot be held in its calendar year, the certificate is suspended. A suspended certificate is not in force for the period of the suspension. Certification is reinstated once the audit has been conducted and any findings closed, and where that does not happen the certificate is withdrawn and the organization begins again with an initial certification.
Recertification runs on the expiry date instead. The audit, your response to any findings and the certification decision all have to be complete before the certificate expires, which is why the audit is planned for around the thirty-third month of the cycle rather than the thirty-sixth. Where the certificate expires first, ISO/IEC 17021-1 allows certification to be restored within six months of expiry, provided the outstanding recertification activities are completed. Past that, the route back is an initial certification with a Stage 2 audit, and a new three-year cycle from a new decision.
Planning the audit into a real year
The audit plan names dates, the audit team, and which sites, shifts and processes will be visited, and you receive it in advance. What makes a proposed date workable is whether the work in your scope is running when the auditors arrive. A plant in its summer shutdown cannot show us the processes named on its certificate. A contractor whose only two active projects hand over in the same month has no active works for a site visit, and the sites listed on the certificate are the ones we have to sample.
The constraints are worth telling us about early. Ramadan, a shutdown, an audit stacked against a customer's own inspection, a scope or site change that has to be assessed before it can appear on the certificate: each of these changes the plan, and each is straightforward while the eleventh month is still ahead. The same information reaching us in the twelfth month leaves nothing to work with, because the date is not ours to move.
One consequence is worth keeping in view. The status of a certificate is public from the day it changes. Our register records suspended and withdrawn as statuses of their own, so a customer checking you there reads a lapse before you have had the chance to describe it. The audits in the cycle, and what each of them covers, are set out on how certification works.
The windows are a condition of the accreditation your certificate carries rather than a scheduling preference of ours, which is why a certificate can be suspended over a date. It is also why we plan a month early and ask about your year before the plan is issued.