ISO 9001 Surveillance Audit: The Complete 2026 Guide

Your ISO 9001 surveillance audit is the annual visit that keeps your certificate alive, and from September 2026 it carries a second job: it is also where your certification body moves you onto ISO 9001:2026. Most quality managers treat the surveillance visit as a lighter rerun of the certification audit. It is shorter, but it is not a smaller copy. ISO/IEC 17021-1 fixes eight things the auditor has to look at every single time, the accreditation rules fix roughly how long it lasts, and missing the visit window has a defined consequence that is not a stern letter.

This guide covers what an ISO 9001 surveillance audit must review, when it has to happen, how many days it takes, what the ISO 9001:2026 transition adds to it, and what actually happens when findings land.

What an ISO 9001 surveillance audit covers (and what it does not)

The rulebook is not ISO 9001. It is ISO/IEC 17021-1:2015, the standard your certification body is itself accredited against. Clause 9.6.2.2 says surveillance audits “are on-site audits, but are not necessarily full system audits” — which is exactly why an ISO 9001 surveillance audit takes one day where your stage 2 took three. The auditor samples rather than sweeping clause 4 to clause 10.

What they cannot sample away is a fixed list. Clause 9.6.2.2 requires every surveillance to include a review of eight areas:

Required review area (ISO/IEC 17021-1 9.6.2.2)	What the auditor expects to see
a) Internal audits and management review	The internal audit programme, the reports it produced, and signed minutes of the most recent management review
b) Actions taken on nonconformities from the previous audit	Closure evidence, not a plan — the corrective action done and its effectiveness checked
c) Complaints handling	The complaints log, how each was resolved, and where complaints fed back into the system
d) Effectiveness against your objectives and intended results	Quality objectives with real performance data against them, not a list of aspirations
e) Progress of planned continual improvement activities	The improvement actions you committed to last year and their current status
f) Continuing operational control	Clause 8 processes still running the way your documented information says they do
g) Review of any changes	New sites, products, people, outsourcing, software, owners or legal requirements since the last visit
h) Use of marks and other references to certification	Your website, quotations, letterhead, email footers and tender responses

Clause 9.6.2.1.2 adds something people miss: an ISO 9001 surveillance audit “shall include on-site auditing”, but the certification body may also run off-site activity — enquiries to you, a review of your promotional material and website, requests for documented information, and other monitoring of your performance. Certification-mark misuse in particular gets found from a desk weeks before anyone arrives, which is why item (h) produces more findings than its size suggests.

When your ISO 9001 surveillance audit falls in the three-year cycle

Clause 9.1.3.2 sets the programme: a two-stage initial audit, then surveillance audits in the first and second years following the certification decision, then a recertification audit in the third year before the certificate expires. The first three-year cycle begins with the certification decision; every later cycle begins with the recertification decision.

Clause 9.1.3.3 then fixes two dates that are not negotiable:

• Surveillance audits are conducted at least once a calendar year, except in recertification years.
• The first surveillance audit after initial certification shall not be more than 12 months from the certification decision date.

Cycle year	Audit	Timing rule
Year 0	Stage 1 and stage 2 initial audit	The cycle starts at the certification decision, not at the audit
Year 1	First ISO 9001 surveillance audit	No later than 12 months from the certification decision date
Year 2	Second surveillance audit	At least once in the calendar year
Year 3	Recertification audit	Completed before the certificate expiry date; no separate surveillance this year

Note what the 12-month clock runs from. ISO/IEC 17021-1 ties it to the certification decision date, which is usually weeks after your stage 2 closing meeting and can differ from the date printed on the certificate. Some accreditation bodies apply the window from the last day of stage 2 instead, which is tighter. If those dates are far apart in your case, ask your certification body in writing which one it schedules from — planning your ISO 9001 stage 1 audit and the surveillance that follows off the same assumption is how organisations end up a month late.

How long an ISO 9001 surveillance audit takes

The length of an ISO 9001 surveillance audit is set by IAF MD 5, now published by Global ACI as TECH-3-004. Its clause 5 is the whole answer: during the initial three-year cycle, surveillance audit time should be proportional to the initial certification audit, “with the total amount of time spent annually on surveillance being about 1/3 of the audit time spent on the initial certification audit” — meaning stage 1 plus stage 2 combined. A note adds the floor: “It is unlikely that a surveillance audit duration will be less than one (1) audit day.”

Recertification is calculated differently, and this catches people out. It is approximately 2/3 of the time a fresh initial audit would need at the time of recertification — not 2/3 of what your original audit took. A company that has tripled in headcount since certification gets a recertification audit sized against its current self.

Table QMS 1 in MD 5 gives the starting point for initial audit days by effective number of employees. The surveillance and recertification columns below apply the 1/3 and 2/3 proportions to it, rounded the way certification bodies normally schedule:

Effective employees	Initial audit, stage 1 + stage 2 (days)	Surveillance, about 1/3 (days)	Recertification, about 2/3 (days)
1–5	1.5	1 (the one-day floor)	1
6–10	2	1	1.5
16–25	3	1	2
26–45	4	1.5	2.5
46–65	5	1.5–2	3.5
86–125	7	2–2.5	4.5
176–275	9	3	6
426–625	11	3.5–4	7.5

Treat those as typical planning figures, not a quote. MD 5 lets the certification body move them for risk category, multiple sites, the number of processes in scope, system maturity and the share of the audit done with remote techniques. It also requires the planned audit time to be reviewed at every surveillance and recertification audit, so your year-2 visit can legitimately run longer than year 1 if you have grown or added scope. For what those days cost in money rather than time, see the ISO 9001 certification cost breakdown.

Your ISO 9001 surveillance audit is now the ISO 9001:2026 transition audit

ISO 9001:2026 was published in September 2026. Global ACI, which took over the International Accreditation Forum’s role from 1 January 2026, published the binding transition rules as Global ACI-TECH-3-TR 2029-09-30 (M), Transition Requirements for ISO 9001:2026 — issued 4 September 2026, implementation date 16 September 2026, transition period three years. It is mandatory for every accreditation body in the Global ACI arrangement and every certification body they accredit.

Date	What has to happen
31 March 2027	Accreditation bodies ready to assess to ISO 9001:2026, with their transition process announced
30 June 2027	Certification bodies submit their transition declaration and supporting documents to their accreditation body
30 September 2027	Accreditation body transition decisions on certification bodies completed
31 March 2028	New and initial certifications may only be issued to ISO 9001:2026 — no new 2015 certificates after this date
30 September 2029	Accredited certifications to ISO 9001:2015 are no longer valid

Here is the part that changes how you plan the next three years. The transition document requires your certification body to conduct a transition audit, and says it “may be conducted in conjunction with the certified organisation’s surveillance audit, recertification audit or through a separate special audit.” That audit must review the changed requirements of ISO 9001:2026, changes to your organisation’s context, and the need for any other changes to your management system. It may be run remotely using ICT methods under IAF MD 4 (Global ACI TECH-3-003), provided the certification body can demonstrate the objectives were met.

On extra days, the document answers “Possibly”. The certification body has to consider whether additional time is needed and justify the calculation under ISO/IEC 17021-1 and MD 5, weighing how much your management system actually changed and whether the transition runs inside an annual audit or as a standalone special audit. A note says additional time may not be needed for a full system audit. So folding the transition into an ISO 9001 surveillance audit is normally the cheaper route — but do not budget zero.

Then the sting. If you decide not to transition, your certification body may keep auditing you against ISO 9001:2015, but it must tell you the certification expires at the end of the transition period, and your certificate “may not remain valid for the entire certification cycle” if it currently runs past 30 September 2029. Certification bodies may shorten the printed expiry date to reduce confusion in the market. The practical rule: if your next recertification falls after September 2029, an ISO 9001 surveillance audit is the only scheduled visit left to transition in, so do not wait for recertification. Work out what changed first — the ISO 9001:2026 transition guide walks the clause-level differences.

What the auditor asks for at an ISO 9001 surveillance audit

Because the eight review areas are fixed, the evidence an ISO 9001 surveillance audit requests is predictable. Have these ready as a pack rather than hunting for them live:

• The internal audit schedule covering the full cycle, plus every internal audit report issued since the last external visit.
• Management review minutes with attendance, the inputs actually tabled, and the decisions and actions that came out.
• Closure records for each nonconformity raised at the previous audit — root cause, action taken, effectiveness verified, dated.
• The complaints register, including complaints resolved informally, and evidence that trends were analysed.
• Quality objectives with measured performance, including the ones you missed and what you did about them.
• A change log for the period: sites, products, services, key personnel, outsourced processes, software and applicable legal requirements.
• Risk and opportunity records showing they were reviewed, not written once at certification.
• Certification mark usage — screenshots of the website pages, a current quotation and a tender response that reference certification.

Your own ISO 9001 internal audit programme is the single best predictor of how the visit goes. If your internal audits are thin, item (a) fails and the auditor starts widening the sample in every other area.

What happens if you fail an ISO 9001 surveillance audit

“Fail” is not a word ISO/IEC 17021-1 uses about an ISO 9001 surveillance audit. What it defines is suspension. Clause 9.6.5.2 says the certification body shall suspend certification in cases such as these: the client failed to meet certification requirements; the certified client does not allow surveillance or recertification audits to be conducted at the required frequencies; or the client voluntarily requested suspension.

That middle trigger is the one that bites. Letting the 12-month window lapse, postponing the visit twice, or refusing access is a suspension trigger in its own right — independent of how good your quality system is. Under suspension (9.6.5.3) your certification is temporarily invalid, so you cannot present it in a tender. The certification body restores it once the underlying issue is resolved (9.6.5.4); failure to resolve leads to withdrawal, or to a reduction of scope (9.6.5.5) excluding the parts not meeting the requirement. A note in 9.6.5.4 records that in most cases the suspension would not exceed six months.

Ordinary findings are far less dramatic. ISO/IEC 17021-1 fixes an explicit closure deadline only for recertification — clause 9.6.3.2.2 requires major nonconformities to be corrected before the certificate expires. For findings raised at an ISO 9001 surveillance audit the closure window comes from your certification body’s own documented procedure, which is why 30, 60 and 90 days all circulate in the market as if they were the rule. Ask for yours in writing. Majors generally need verified corrective action before certification is confirmed; minors generally need an accepted plan, verified at the next visit.

How to prepare for an ISO 9001 surveillance audit

A clean ISO 9001 surveillance audit is mostly a scheduling problem, not a documentation problem. Six steps, in order:

• Fix the date off the decision date. Find the certification decision date on your file, add 11 months, and put the first ISO 9001 surveillance audit in the calendar there — not at 12 months, which leaves no room to reschedule.
• Finish the internal audit cycle before the auditor arrives. Not all of clause 4 to 10 every year, but enough of the programme that whatever the auditor samples has been audited by you first.
• Hold the management review, and minute it properly. An undated agenda with no decisions is the most common year-1 finding.
• Close last year’s nonconformities with evidence of effectiveness. Item (b) asks what you did, then whether it worked.
• Audit your own certification marks. Walk the website, the proposal template and the email signature against your certification body’s mark rules.
• Ask your certification body where it is in the ISO 9001:2026 transition. If it has not made its declaration yet, your transition audit cannot be scheduled, and the 30 September 2029 wall does not move for you.

If the document set behind any of that is thin, the ISO 9001 Toolkit is 84 templates written to ISO 9001:2026 — the internal audit programme, management review pack, nonconformity and corrective action records, objectives and change-control forms the eight review areas ask for — for $89. It saves the week most people spend rebuilding records an ISO 9001 surveillance audit was always going to request. For the wider picture of what the standard requires, start with the complete ISO 9001 guide.

ISO 9001 surveillance audit FAQ

Is a surveillance audit the same as an internal audit?

No. An internal audit is yours, required by ISO 9001 clause 9.2, done by your own people or a contractor you hire. An ISO 9001 surveillance audit is your certification body’s audit of you under ISO/IEC 17021-1, and your internal audit results are one of the eight things it reviews. One cannot replace the other.

Can an ISO 9001 surveillance audit be done remotely?

Not entirely. Clause 9.6.2.1.2 requires surveillance activities to include on-site auditing, so a fully remote visit is not accredited practice. Parts of it can be delivered with ICT methods under IAF MD 4, and a 2026 transition audit specifically may be run remotely if the certification body can demonstrate the objectives were met.

What happens if we miss the 12-month window?

Not allowing surveillance audits at the required frequencies is a suspension trigger under clause 9.6.5.2. In practice certification bodies chase hard before they suspend, but the discretion is theirs, not yours — so a slipped date is worth a phone call rather than a hopeful silence.

Do we have to transition to ISO 9001:2026 at our next surveillance audit?

No single visit is mandated. The transition must be complete, including certificate issuance, before 30 September 2029. But if your next recertification falls after that date, a surveillance audit is the only scheduled visit left to do it in, so that is where it has to happen.

Does a surveillance audit cover the whole standard?

No. Clause 9.6.2.2 is explicit that surveillance audits are not necessarily full system audits. Across a three-year cycle the certification body is expected to have covered the full scope, but any single ISO 9001 surveillance audit is a sample plus the eight mandatory review areas.