The ISO 27001 certification cycle: stage 1 to surveillance and recertification

Getting an ISO 27001 certificate isn't the finish line. It starts a three-year certification cycle: your certification body comes back every year to check the ISMS is still working, and in the third year it audits the whole system again to renew the certificate. Keeping on top of that cycle is mostly about dates, findings and a few records that are easy to forget until the auditor asks for them.

How the cycle works

• Stage 1 reviews your documents and decides whether you're ready for stage 2.
• Stage 2 tests whether the ISMS works in practice. After it, the certification body decides whether to award the certificate. Certificates usually last three years.
• Surveillance audits happen in years one and two. They're shorter and sample part of the ISMS, plus anything that's changed and any findings left open from last time.
• Recertification happens before the certificate expires, in year three. It looks at the whole ISMS again, and at how it performed across the cycle.

Your certificate comes from your certification body. Nobody else can award it.

Why it matters

ISO/IEC 27001:2022 expects the ISMS to keep running and improving between audits, not just on the day:

• Clause 9.1, 9.2 and 9.3: monitoring, internal audits and management reviews happen at planned intervals, across the whole cycle.
• Clause 10.1 and 10.2: findings are corrected and the system keeps improving.
• Certification body rules (set out in ISO/IEC 27006-1, which bodies follow) mean yearly surveillance and recertification before the certificate expires. Miss them, and the certificate can be suspended or lapse.
• Use of the certification mark is governed by your certification body's own rules. Misusing it, for example putting it on a product or claiming a scope you don't hold, is something they can act on.

What an auditor looks for

At each surveillance and recertification audit, the auditor typically checks:

• Findings from last time are closed, with the cause dealt with, not just the symptom.
• Internal audits and management reviews continued, and over the cycle covered every clause and the applicable Annex A controls.
• Changes since the last visit: new systems, suppliers, sites or people, and whether the scope still fits.
• Certificate and mark use: the scope you describe matches the certificate, and the mark is used the way the body allows.
• Evidence of performance over time, not just a fresh set of documents.

Common reasons it goes badly: open findings nobody followed up; an internal audit programme that quietly skipped half the controls; a website claiming a wider scope than the certificate.

An example

A 40-person software company gets certified in March. Its stage 2 auditor raised two minor findings and one observation. In its first year it:

• logs both minors as nonconformities and the observation as an improvement, each with an owner and the response deadline the body set;
• books surveillance 1 for the following February and starts preparing in December;
• lists the three places it shows the certification mark (website footer, sales deck, email signature) and checks them once a year;
• confirms before the visit that the scope wording on the certificate still matches what it actually does.

When the auditor arrives, the findings are closed with evidence and there are no surprises.

Common mistakes, and how to keep it manageable

• Forgetting the date. Surveillance comes round faster than you'd think. Put every visit in a calendar with a prep task well ahead.
• Losing findings in email. Record each finding exactly as the body graded it, with its response date and an owner.
• Letting the scope drift. The business changes; the certificate wording doesn't. Check them side by side before each audit.
• Using the mark loosely. Read the body's rules once, then keep a list of where you use it.
• Answering document requests from memory. Log what was asked for and what you sent, so nothing is missed and you can send the same thing next time.

How to do it in ClearIMS

Open Evidence and audits > Certification cycle.

1. Record the certificate: certification body, certificate number, scope wording as issued, issue date and expiry date.
2. Fill in the audit calendar: Stage 1, Stage 2, Surveillance 1, Surveillance 2 and Recertification. The owner gets a prep task 60 days before each audit, and you can change the lead time.
3. Watch the six pre-visit checks. Each shows Ready or Open, with its reason and lead time. Each open check has its own owner task, and a nightly job reopens the task if its check goes stale.
4. Log certification body audits. Record findings exactly as the body graded them: major, minor, observation, or Stage 1 area of concern. Each finding gets a response deadline and an owner task. One click raises a nonconformity for a major or minor, or an improvement for an observation. Add the audit plan as a link or an uploaded file.
5. Keep the document request log. Record what the auditor asked for, when, when it's due, and what you sent: an approved document version or evidence. Overdue requests are flagged, and you can add a sent item to the auditor portal.
6. Re-confirm the scope. ClearIMS shows the certificate's scope wording beside your approved ISMS scope, warns you if they've drifted apart, and records your decision: "scope still holds" or "wording must change".
7. Keep the mark and claims register. Confirm you've read your certification body's rules for using its mark, then list every place the mark or a certification claim appears, each with an owner and a last-checked date. Each place gets a yearly check task, and Raise nonconformity is one click if it's being misused.

Only owners and admins can edit these records, and every change is recorded in the audit trail. Once you're certified, Readiness adds surveillance and recertification stages, and Home shows your next audit. To see how the visits fit into the year's work, use Annual workload.

ClearIMS supports the whole cycle, from stage 1 and stage 2 through surveillance and recertification, but it doesn't connect to your certification body or decide anything on its behalf. The audit decision is always theirs.

Related pages

• Readiness: stage 1, stage 2, surveillance and recertification.
• Internal audits: coverage across the whole cycle.
• Nonconformities: where major and minor findings go.
• Auditor portal: sharing what the auditor asks for.
• Management reviews: audit results as an input.
• Annual workload: planning the hours.