ISO 27001 surveillance audit: what happens in years two and three, how long it takes and what the auditor samples

An ISO 27001 surveillance audit is the certification body’s annual check that your ISMS is still running. It happens at least once a calendar year, the first within 12 months of the certification decision. Each takes about a third of the initial audit time and samples part of the system. Miss one and the certificate is suspended.

This guide covers frequency, duration, what every visit must cover, what gets sampled, the evidence to have ready, nonconformities, suspension, and why year two goes wrong.

When	Audit	Audit time	What it establishes
Month 0	Stage 1 and Stage 2, then the certification decision	100%	The ISMS was built and is operating
Within 12 months	Surveillance audit 1	about 33%	It kept running after the project ended
Next calendar year	Surveillance audit 2	about 33%	It is still running, on a different sample
Before expiry at 36 months	Recertification	about 67%	All requirements, evaluated again

How often are ISO 27001 surveillance audits?

At least once a calendar year, except in recertification years. ISO/IEC 17021-1, the standard every accredited certification body works under, adds that the first “shall not be more than 12 months from the certification decision date” (clause 9.1.3.3). The cycle is fixed by accreditation rules, so it is broadly the same wherever you certify. The first two visits are covered in Stage 1 and Stage 2 audits.

The 12 months run from the certification decision date, not from the last day of Stage 2. European Accreditation has confirmed that a calendar year without an audit is an exception the body must justify, not a date that can slide. Companies that treat the anniversary as a soft target are the ones who end up explaining a suspension to a customer.

How long does an ISO 27001 surveillance audit take?

About a third of the initial audit time, every year. ISO/IEC 27006-1, the accreditation standard for ISMS certification bodies, sets annual surveillance at roughly one third of the Stage 1 plus Stage 2 time, and recertification at roughly two thirds. IAF MD 5 uses the same ratios for quality, environmental and OH&S audits.

Initial audit time scales with the people in the ISMS scope. Selected bands:

People in scope	Initial audit days	Surveillance, per year	Recertification
1 to 10	5	about 1.7	about 3.3
11 to 15	6	about 2	about 4
16 to 25	7	about 2.3	about 4.7
26 to 45	8.5	about 2.8	about 5.7
46 to 65	10	about 3.3	about 6.7
86 to 125	12	about 4	about 8
176 to 275	14	about 4.7	about 9.3

These are base figures before the body adjusts for complexity. You must tell the body about significant changes without delay (ISO/IEC 17021-1, 8.5.3), and it can add time or an extra audit. The fee follows the days: see ISO 27001 certification cost.

Shorter does not mean lighter. The auditor arrives with a fixed list and less time to be charmed.

What does an ISO 27001 surveillance audit cover?

Surveillance audits are not necessarily full system audits, but ISO/IEC 17021-1 (9.6.2.2) lists what each one must include:

1. Internal audits and management review.
2. Actions taken on nonconformities from the previous audit.
3. Treatment of complaints.
4. Effectiveness in achieving your objectives and intended results.
5. Progress of planned continual improvement.
6. Continuing operational control.
7. Review of any changes.
8. Use of marks and other references to certification.

ISO/IEC 27006-1 adds the ISMS items: the risk assessment and maintenance of controls, changes to controls and to the Statement of Applicability, and the controls the audit programme selects.

The five that decide the visit

In practice, five items carry most of the weight.

• Last audit’s findings. Closed with evidence, not marked closed in a spreadsheet. If Stage 2 raised a minor about access reviews, the auditor wants the access reviews.
• Internal audit. Clause 9.2 says planned intervals. Auditors expect at least one since the last visit, with findings and follow-up.
• Management review. Real minutes, the clause 9.3 inputs, decisions. Not a calendar entry.
• Risk assessment currency. New office, new cloud platform, forty new staff, an acquisition. If the business moved and the risk assessment did not, that is a finding.
• Corrective action as routine. Issues raised and closed when no auditor is due.

Internal audit and management review are often the ones companies miss, and the two that cannot be produced retrospectively with any credibility. How to run both is in internal audit and management review.

The forgotten item is use of marks: how your website and tenders describe the certificate. Claiming a wider scope than the certificate states is a common problem.

What does the auditor sample, and why does it change?

Annex A of ISO/IEC 27001:2022 has 93 controls, and your Statement of Applicability lists the ones you apply. The body does not re-audit all of them at each visit. It samples against an audit programme written for the whole cycle.

In practice the sample rotates so the whole Statement of Applicability is covered across the three years. Apart from open findings, whatever the auditor examined last time is less likely to be examined next. A company that fixed exactly what Stage 2 sampled and left the rest has arranged to fail surveillance audit one.

The sample also leans towards whatever changed. Operations are never optional: European Accreditation has confirmed a surveillance audit cannot look only at the management system. And auditors watch proportionality after growth. Controls reasonable at twenty-five people are often not reasonable at eighty, and headcount growth is visible before they walk in.

How does an ISO 27001 surveillance audit work?

1. The body asks for current headcount, sites, scope and changes, and adjusts audit time.
2. The lead auditor sends a plan naming the clauses, controls and people to be sampled.
3. Opening meeting, interviews, record sampling, system walk-throughs. Parts can be remote, and ISO/IEC 27006-1 requires the report to say how much.
4. Closing meeting: findings graded as major or minor nonconformities.
5. You submit cause analysis, corrections and corrective actions by the body’s deadline.
6. The body reviews them and confirms that certification continues.

What annual evidence do auditors review?

The window is the whole period since the last visit, not the week before it. A sensible evidence pack:

ISO 27001 SURVEILLANCE EVIDENCE PACK
Period: since the last certification body visit

Management system
[ ] Internal audit programme, reports, findings, follow-up
[ ] Management review minutes: clause 9.3 inputs, decisions
[ ] Corrective action log: raised, cause, action, closed, date
[ ] Closure evidence for each finding from the last audit
[ ] Security objectives and metrics, with results
[ ] Risk assessment and treatment plan, reviewed after changes
[ ] Statement of Applicability, with version history
[ ] Change log: people, sites, suppliers, systems, scope
[ ] Security complaints from customers and suppliers
[ ] Where and how the certificate and mark are used

Controls (dated records across the whole period)
[ ] Access reviews and leaver removals
[ ] Supplier assessments, new and critical suppliers
[ ] Training and awareness records
[ ] Vulnerability scans and patch records
[ ] Backup restore tests
[ ] Incident log and lessons learned

What happens if you get a nonconformity?

ISO/IEC 17021-1 defines a major nonconformity as one that affects the capability of the management system to achieve its intended results. A minor one does not.

For either, you analyse the cause and describe the correction and corrective action within a defined time. The body verifies them and says whether it needs documents, a limited extra audit or a full one. ISO/IEC 27006-1 says the time allowed should match the severity and the information security risk. The exact deadlines sit in your body’s certification rules. Read them before the visit.

Many surveillance audits produce a minor or two. You agree the plan, implement it, show the evidence. No drama. A major not resolved in time can lead to suspension.

What happens if a surveillance audit is missed?

Expect a suspension. ISO/IEC 17021-1 (9.6.5) requires suspension when, for example, the client does not allow surveillance or recertification audits at the required frequencies, or the system has persistently or seriously failed to meet requirements. A suspended certificate is temporarily invalid, and you must stop promoting it.

Resolve the issue and the body restores it. If it is not resolved within the time the body sets, certification is withdrawn or the scope reduced. The standard notes that suspension would in most cases not exceed six months.

For an unbroken certificate, recertification must be decided before expiry. After expiry, the body can restore certification within six months if the outstanding activities are completed; otherwise at least a new Stage 2 is needed.

The realistic risk for most SMEs is not withdrawal. It is a suspension that overlaps with a tender.

Why does year two often go wrong?

Certification is a project, with a deadline, a budget and someone assigned. Then the project ends, the person who ran it returns to their real job, and the system has no owner.

Eleven months later somebody notices the surveillance date. The internal audit planned for month four did not happen. The management review was a fifteen-minute item with no minutes. The risk assessment describes the company before the new platform. Three months of access reviews are missing.

None of that can be fabricated convincingly, because all of it is dated. That is why evidence that assembles itself is worth more than evidence prepared for the occasion. It is also the argument for a named owner with actual time.

The technical reality: surveillance tests whether the system ran, not whether it worked

A surveillance audit verifies that the management system operated: reviews happened, audits ran, findings closed, a sample of controls is in place. It tests process continuity. It does not test whether your estate is defensible on the day, and is not designed to.

The auditor samples once a year. An attacker does not sample. A company can pass consecutive surveillance audits while an internet-facing service stays unpatched for most of the cycle, because nothing in the audit programme is built to find it. The wider argument is in certified is not secure.

Closing that gap means measuring continuously what the audit samples annually: an asset inventory built from what is running, patch and exposure state visible rather than declared, access reconciled against leavers, restores verified rather than scheduled. Surveillance then stops being an event you prepare for. That is what the CloudSoul platform does, as an automated platform with human-in-the-loop expertise, and how we run ISO 27001 programmes. A security audit will tell you what the last sample missed.

ISO 27001 surveillance audit checklist

• Book both surveillance dates the week the certificate is issued.
• Schedule the internal audit for month four or five, not month eleven.
• Hold the management review as its own meeting, with minutes that record decisions.
• Revisit the risk assessment and Statement of Applicability after every material change, and record it.
• Tell the certification body about significant changes before the visit.
• Close last year’s findings with evidence, not a status change.
• Keep control evidence generating as it goes: access reviews, supplier checks, training, restores.
• Check how your website and tenders describe the certificate’s scope.

Sources

• ISO/IEC 17021-1:2015, Requirements for bodies providing audit and certification of management systems, clauses 8.5.3, 9.1.3, 9.4, 9.6.2, 9.6.3 and 9.6.5, ISO.
• ISO/IEC 27006-1:2024, Requirements for bodies providing audit and certification of information security management systems, clause 9.6.2 and Annex C (audit time), ISO.
• ISO/IEC 27001:2022, clauses 9.2 and 9.3 and Annex A, ISO.
• IAF MD 5:2023 (Issue 4, Version 3), Determination of audit time of quality, environmental and occupational health and safety management systems, IAF.
• European Accreditation FAQs on ISO/IEC 17021-1: surveillance every calendar year (37.12), operational control at surveillance (44.2), audit time after notified changes (38.19), restoring certification after expiry (47.5).
• ANAB, ISO/IEC 27006-1:2024 transition and changes.

Frequently asked questions