ISO 22301 Surveillance Audit: The Complete 2026 Guide

An ISO 22301 surveillance audit is the shorter, on-site audit your certification body runs in each of the two years between initial certification and recertification, and for a business continuity management system it tests something most surveillance audits never touch: whether your continuity capability still works a year after the certificate was issued. Records alone will not carry it. The auditor wants to see that the business impact analysis was revisited, that exercises actually ran, and that what they found changed something.

This guide sets out what the rules require, when the visit falls due, how long it should take, the eight areas every visit must cover, what auditors test in a BCMS specifically, and what gets a certificate suspended. Clause numbers come from ISO/IEC 17021-1:2015, the accreditation standard every accredited certification body works to, and from ISO 22301:2019 itself.

What an ISO 22301 surveillance audit is, and what it is not

ISO/IEC 17021-1 clause 9.6.2.2 sets the scope in one line: surveillance audits are on-site audits, but they are not necessarily full system audits. The auditor samples. They do not re-audit every clause of ISO 22301 against every product and service in scope.

Two consequences follow. First, surveillance cannot be done purely by desk review. Clause 9.6.2.1.2 requires surveillance activities to include on-site auditing, and lets the certification body add other activities around it: enquiries about your certification, a review of your public statements and website, requests for documented information, and other monitoring of your performance. Those supplement the visit; they do not replace it. Remote techniques are allowed under the remote-audit rules (IAF MD 4, now published as Global ACI TECH-3-003) where the certification body can show the audit objectives were met.

Second, a clean surveillance report is not a statement that your whole BCMS conforms. It says nothing in the sampled areas undermined confidence in the certificate. Organizations that treat the annual visit as the only real check on their continuity program usually discover the gaps at recertification, or worse, during an actual disruption.

When your ISO 22301 surveillance audit falls due

Clause 9.1.3.2 of ISO/IEC 17021-1 sets the standard three-year program: a two-stage initial audit, surveillance audits in the first and second years after the certification decision, and a recertification audit in the third year before the certificate expires. The cycle starts at the certification decision, not at the stage 2 audit and not at whatever date is printed on the certificate if those differ.

Clause 9.1.3.3 adds two hard rules. Surveillance audits happen at least once a calendar year, except in recertification years. And the first surveillance audit after initial certification shall not be more than 12 months from the certification decision date. If your decision was made in February, a visit booked for the following March is late, whatever your own audit calendar says.

Cycle year	Audit	Timing rule (ISO/IEC 17021-1)
Year 0	Stage 1 + stage 2 initial audit, then the certification decision	9.1.3.2: the three-year cycle starts at the decision
Year 1	First surveillance audit	9.1.3.3: no more than 12 months after the decision date
Year 2	Second surveillance audit	9.1.3.3: at least once per calendar year
Year 3	Recertification audit	9.6.3: completed before the certificate expires

A note to clause 9.1.3.3 allows the frequency to reflect factors such as seasons or certification of limited duration. For a BCMS this can matter: if your peak-risk period is year-end trading or hurricane season, ask for the visit to land where the auditor can see the capability under realistic load, and agree it when the program is planned.

How long an ISO 22301 surveillance audit takes

This is where BCMS differs from quality or environmental certification, and where most generic advice is quietly wrong. IAF MD 5, the mandatory document on audit time, is titled and scoped for quality, environmental and occupational health and safety management systems only. Its section 0.5 says that although it is set up for those three, elements of it “may be used” for other ISO/IEC 17021-1 schemes. There is no published BCMS audit-day table in MD 5, so each certification body sets ISO 22301 audit time through its own documented method, which its accreditation body assesses.

In practice most certification bodies borrow MD 5’s surveillance principle. Section 5 of MD 5 says annual surveillance time should be proportional to the initial audit, at “about 1/3” of the stage 1 plus stage 2 time, and that the planned surveillance time must be reviewed at every surveillance and recertification audit to reflect changes in the organization and system maturity, with the review recorded.

Initial audit (stage 1 + stage 2)	Typical surveillance at about one-third	Illustrative profile
3 audit days	1 day	Single site, under ~25 people in scope
6 audit days	2 days	Single site, ~100–250 people, several critical services
9 audit days	3 days	Multi-site or complex supply chain, ~500+ people
12 audit days	4 days	Large multi-site scope with outsourced recovery sites

Treat that table as arithmetic on the one-third principle, not a published entitlement. Typical ranges vary by certification body. What you can do is ask for the documented review of surveillance time: if your scope has shrunk or your system has matured and the quote has not moved, that record is the thing to request.

The eight areas every ISO 22301 surveillance audit must review

Clause 9.6.2.2 of ISO/IEC 17021-1 lists what each surveillance shall include a review of. It is the closest thing to a fixed agenda, and it is the right basis for preparation.

#	Required review area	What to have ready for a BCMS
a	Internal audits and management review	Internal audit reports covering the period and minutes of a management review held since the last visit (ISO 22301 clauses 9.2 and 9.3)
b	Actions on nonconformities from the previous audit	Root cause, correction, corrective action and your own effectiveness check (clause 10.1)
c	Complaints handling	Complaints about service availability or recovery, and how each was closed
d	Effectiveness against objectives	Business continuity objectives with measured results, not just targets (clause 6.2)
e	Progress of planned continual improvement	Improvement actions raised from exercises and incidents, with status (clause 10.2)
f	Continuing operational control	Evidence the clause 8 processes still run: BIA, risk assessment, strategies, plans, exercises
g	Review of any changes	New sites, suppliers, IT platforms, products, or a reorganization since the last audit
h	Use of marks and references to certification	Website, tender responses and marketing that cite the certificate and its scope

Item (h) catches more organizations than it should. A certificate covers a defined scope, and a sales deck that implies the whole group is ISO 22301 certified when only one data center is in scope is a finding. The certification body can find it without visiting, because reviewing your public statements is a listed surveillance activity.

Item (g) is where an ISO 22301 surveillance audit gets expensive. A migration to a new cloud provider, a new outsourced call center or an acquired business changes your dependencies and can invalidate recovery strategies. Tell the certification body before the audit, not during it.

What auditors actually test in a BCMS surveillance visit

The eight areas give the headings. In practice, findings at an ISO 22301 surveillance audit cluster in five places, all of them specific to continuity.

• A business impact analysis that has gone stale. Clause 8.2.2 requires the BIA process to be maintained. An auditor will compare the BIA’s date and recovery time objectives against changes since certification. A BIA that predates a new product line or a platform migration is the most common finding there is.
• An exercise program that exists only on paper. Clause 8.5 requires a program of exercises that, over time, validates your strategies and solutions, and requires each exercise to be documented and reviewed. Expect to be asked which plans were exercised this year, what failed, and what changed. An exercise report with no issues raised is read as an exercise that was not a real test.
• Evaluation that never happened. Clause 8.6 requires you to evaluate the suitability, adequacy and effectiveness of your BIA, risk assessment, strategies, solutions, plans and procedures, through reviews, analysis, exercises, tests, post-incident reports and performance evaluations, and to update them when needed. Auditors look for the evidence trail from a real incident or exercise back into an updated plan.
• Strategies that no longer match the BIA. If the BIA now says a service must be back in four hours and the recovery solution under clause 8.3 still takes two days, the gap is a nonconformity, and it often appears after a supplier change nobody fed back into the BIA.
• Plans people cannot execute. Clause 8.4.4 requires business continuity plans, and the auditor may test them by interviewing someone named in a call tree. Contact details that are a year out of date, or a deputy who has never seen the plan, are classic surveillance findings.

The climate amendment is now part of that agenda too. ISO 22301:2019/Amd 1:2024 added climate change to the context requirements in clause 4.1 and to interested-party requirements in clause 4.2. Auditors at surveillance check that climate was considered and recorded as a context issue. For a BCMS that is usually easy to evidence, because physical climate risks already sit in most disruption scenarios; the gap is generally that nobody wrote the determination down.

Findings, suspension and withdrawal

Surveillance findings follow the same nonconformity process as any certification audit. ISO/IEC 17021-1 does not fix closure deadlines in days; the certification body sets them in its own rules. Typical practice is a corrective action plan within about 30 days and evidence of closure for a major nonconformity within about 60 to 90 days, sometimes with a follow-up visit. Minor nonconformities are usually verified at the next audit. Check your certification agreement for the exact timescales, because those are the ones that apply to you.

Clause 9.6.5 covers what happens when things go wrong. A certification body suspends certification where the certified management system has persistently or seriously failed to meet certification requirements, where the client does not allow surveillance or recertification audits to happen at the required frequency, or where the client voluntarily requests suspension. During suspension the certification is temporarily invalid, and if the issues are not resolved within the time the certification body sets, it withdraws the certificate or reduces its scope.

The frequency rule is the trap here. Postponing an ISO 22301 surveillance audit past its due date because of a busy quarter is not a scheduling detail; it is a ground for suspension.

How to prepare for an ISO 22301 surveillance audit

1. Confirm the due date against the certification decision date, not the stage 2 date.
2. Close last year’s findings properly. Show root cause, the corrective action, and your own check that it worked.
3. Re-validate the BIA with process owners, and record that they agreed the recovery time objectives.
4. Run and evaluate at least one meaningful exercise since the last visit, with a report, issues raised and actions tracked to closure.
5. Complete the internal audit and management review before the visit, using an ISO 22301 internal audit checklist so the coverage is visible.
6. List every change since the last audit: sites, suppliers, platforms, people, products, and tell the certification body in advance.
7. Check every public claim about your certificate against its scope statement.
8. Refresh contact details and call trees in every plan, and brief the people the auditor is likely to interview.

If the BIA is the weak point, our guide to the ISO 22301 business impact analysis walks through what a maintained BIA looks like. For how the visit compares in another standard, see the ISO 14001 surveillance audit guide, which uses the same 17021-1 rules with a published audit-time table.

Surveillance is easiest when every clause already has a maintained record behind it. The ISO 22301 Toolkit includes the BIA and risk assessment workbooks, plan templates, the exercise program and report, and the internal audit and management review set, each mapped to the clause it satisfies.

A third edition is coming, but not to this year’s ISO 22301 surveillance audit

ISO 22301:2019 remains the certifiable edition. The third edition is listed on iso.org as ISO/CD 22301, a committee draft under review, which is earlier than a draft international standard. There is nothing to transition to yet, and no transition audit can be bundled into your next surveillance visit until the new edition is published and a transition plan is issued. Keep your documentation mapped clause by clause, and the eventual transition becomes a short exercise rather than a project.

Frequently asked questions

How often is an ISO 22301 surveillance audit carried out?

At least once a calendar year in the two years between initial certification and recertification, with the first no more than 12 months after the certification decision date (ISO/IEC 17021-1 clause 9.1.3.3).

Is a surveillance audit a full audit of ISO 22301?

No. It is an on-site sample that must cover the eight areas in clause 9.6.2.2 of ISO/IEC 17021-1. Over the three-year cycle the certification body plans coverage so the whole scope is examined, and the recertification audit reviews the system as a whole.

How many days does an ISO 22301 surveillance audit take?

Typically about one-third of the initial stage 1 plus stage 2 time, often one to three days for small and mid-sized scopes. MD 5’s audit-time tables do not cover BCMS, so your certification body applies its own documented method.

Can the surveillance audit be done remotely?

Partly or fully, if the certification body’s remote-audit procedure allows it and it can show the audit objectives were met. Many still prefer on-site sampling for exercise evidence and interviews.

What happens if we postpone the surveillance audit?

Not allowing surveillance at the required frequency is a ground for suspension under clause 9.6.5. Agree any rescheduling with the certification body inside the permitted window.

References

• ISO 22301:2019, Business continuity management systems: Requirements (iso.org)
• ISO/IEC 17021-1:2015, Requirements for bodies providing audit and certification of management systems (iso.org)
• IAF MD 5:2023, Determination of audit time of quality, environmental and OH&S management systems

For the full certification path, from gap analysis to stage 2, start with our ISO 22301 certification guide, and see the ISO 22301 certification cost breakdown for what the annual visits add to the budget.