Surveillance audit preparation for a small team: what gets forgotten between audits

You have the certificate. The project team has gone back to their day jobs, and the ISMS has become one more thing in the corner of someone's week. Then the surveillance audit appears in the diary and the question is the same one every time: can we show that this has been running since the last visit?

This guide is for the business owner or IT manager who has to answer that without a compliance team. The aim isn't to cram. It's to make the next audit a normal part of the year, so you keep the customers who ask for your certificate and win the bigger ones who ask harder questions.

What a surveillance audit is for

Certification usually runs on a three-year cycle: a surveillance visit in each of the first two years, then a recertification audit. Your certification body sets the exact timing and scope, so check your own arrangements. In general the auditor samples part of your system to see that it is still operating, not just that it was set up well once.

That is why the evidence of ordinary months matters more than a tidy folder in the last week.

What gets forgotten between audits

These are the things small teams most often let slip. None is difficult. They are easy to miss when nobody is chasing.

• Records of reviews that were meant to repeat. Access reviews, supplier reviews, policy reviews and restore tests all come round on a schedule. If one is missed, there is a gap to explain.
• The internal audit and management review. Both are expected at planned intervals, and both take preparation. See our guide on internal audits and management review without a compliance team.
• Follow-up on earlier findings. An issue raised at the last audit, or in an internal audit, needs an owner, a date and a recorded outcome.
• Changes. A new system, supplier or office, or a leaver, can change your scope and risks. If the register still describes last year's business, that shows.
• Training and awareness. New joiners get missed, and refresh dates pass quietly.
• Incidents and near misses. Small ones tend to go unrecorded because they were sorted out in a chat message.

A routine that works for a small team

1. Put the year on one calendar. List the recurring reviews and checks, who owns each one and when it is due. Start from your last audit report.
2. Check once a month. Fifteen minutes: what is overdue, what changed, what needs a record. Doing it monthly is far easier than rebuilding a year at the end.
3. Record as you go. A short note and a linked file at the time beat reconstruction later.
4. Close the loop on findings. Each one gets an owner, a date and an outcome.
5. Run a rehearsal. Ask someone who didn't write the answers to look for gaps six to eight weeks before the visit, while there is still time to fix them.

How ClearIMS helps

ClearIMS records internal audits, management reviews and nonconformities as owned, dated records, with recurring tasks so they come round on time. It works like a virtual ISMS manager: it emails people about outstanding and overdue actions, and they can reply in plain text to update them. A Readiness view shows where your ISMS stands across governance, risks, evidence, suppliers and audit preparation, with each item linked to its source record. Evidence gap radar flags missing or stale evidence, and audit rehearsals let you write the answer you would give an auditor and see the gaps. These are preparation support, not an auditor's judgement. When the audit comes, your auditor can be given scoped, read-only access to approved records through a link that expires.

Your people approve everything; ClearIMS never approves, and your certification body decides the outcome of the audit.

Questions people ask

How far ahead should we start? Ideally you are never starting: a monthly check means there is little to catch up. If you are behind, begin with overdue reviews and open findings.

Can software make us pass? No. It helps you keep records and reminders in order. The audit result is the certification body's decision.

What if we missed something? Record it honestly, work out why, and fix the cause. How you handle a miss is itself something an auditor looks at.

Next step

A small team is more likely to keep ISO 27001 running when the work is visible and the reminders do the chasing. The price is £300 a month, monthly with 30 days' notice, unlimited users, no VAT charged. See also running ISO 27001 as a small team when one person holds it all, keeping an existing certificate going, and sector pages for public-sector suppliers, NHS suppliers and ISPs and altnets.

Book a 20-minute call or try the demo company to see an ISMS that is already set up.