ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
An ISO 9001 recertification audit is the full-system audit your certification body runs in the third year of every certification cycle, before your certificate expires. An ISO 9001 recertification audit is not a bigger surveillance visit. It is a fresh verdict on whether your quality management system still deserves a certificate, and under ISO/IEC 17021-1 it carries its own planning rules, its own audit-time formula and its own deadline that no one can extend for you.
If your cycle lands in 2027, there is a second thing happening at the same time: the ISO 9001:2026 transition. Most organizations will meet the new edition for the first time inside a recertification audit, and the rules for how that works were only settled in September 2026. This guide covers both the standing rules and the 2026 wrinkle.
Free gap assessment
Are you ready for the 2026 edition of ISO 9001?
Score yourself against the new edition, free, including the risk and opportunity split and the clause 10 renumbering that breaks converted checklists.
Run the free ISO 9001 gap assessment → or View premium report sample
ISO/IEC 17021-1 clause 9.1.3.2 sets the shape of the whole cycle. Your certification body must plan a three-year programme made up of a two-stage initial audit, surveillance audits in the first and second years following the certification decision, and a recertification audit in the third year prior to the expiration of certification.
Two details in that clause matter more than people expect. The first three-year cycle begins with the certification decision — not your application date, not the stage 2 audit date. Every cycle after that begins with the recertification decision. So the clock you need to watch is the date on the certificate, and the recertification audit has to happen far enough before it that a decision can be made while the certificate is still live.
Clause 9.6.3.1.1 states the purpose of an ISO 9001 recertification audit plainly: confirm the continued conformity and effectiveness of the management system as a whole, and do it in due time to enable timely renewal before the expiry date. “In due time” is the certification body’s problem to plan, but it is your problem if they leave it late.
Work backwards from the certificate expiry date, not forwards from your last surveillance visit. The timing of an ISO 9001 recertification audit is fixed by the certificate, not by the calendar year.
| Cycle point | What happens | Source |
|---|---|---|
| Year 0 | Two-stage initial audit, then the certification decision. The cycle starts here. | 17021-1 9.1.3.2 |
| Year 1 | First surveillance audit — no more than 12 months from the certification decision date. | 17021-1 9.1.3.3 |
| Year 2 | Second surveillance audit, at least once that calendar year. | 17021-1 9.1.3.3 |
| Year 3 | Recertification audit, before expiry. No surveillance audit in a recertification year. | 17021-1 9.1.3.2, 9.1.3.3 |
| After the decision | New cycle begins at the recertification decision. The new certificate’s issue date must be on or after that decision. | 17021-1 9.6.3.2.3 |
There is a quiet reward for being early. Clause 9.6.3.2.3 allows the expiry date of the new certificate to be based on the expiry date of the existing one when recertification activities are completed before that date. In practice that means finishing early does not cost you calendar time — your next cycle still runs from the old anniversary, so you do not shorten your own certificate by booking the audit in good time. Leaving it late, as the section on missed deadlines below explains, costs you a great deal.
In practice, book the ISO 9001 recertification audit three to four months before expiry. That leaves room for nonconformity correction, the certification body’s technical review and the decision itself, all of which have to be finished while the certificate is still valid.
This is where most people get the budget for an ISO 9001 recertification audit wrong, and the error is always in the same direction.
IAF MD 5 Issue 4 Version 3 — now republished by Global ACI as TECH-3-004 — sets audit duration. Clause 6 says the audit time for a recertification audit is normally approximately two-thirds of the time that would be required for an initial certification audit (Stage 1 + Stage 2) of the organization if such an initial audit were carried out at the time of recertification. The document then spells out the trap in brackets: that is not two-thirds of the original time spent on your initial audit.
Read that twice if you have grown. If you certified with 40 staff and you now have 90, your ISO 9001 recertification audit is costed against a notional fresh initial audit for a 90-person company, then multiplied by two-thirds. It is not two-thirds of the three-and-a-bit days you paid for in year zero.
MD 5 Table QMS 1 gives the starting point for an initial QMS audit by effective number of personnel. The right-hand column applies the two-thirds rule:
| Effective personnel | Initial audit (Stage 1 + 2), days | Recertification ≈ 2/3, days |
|---|---|---|
| 1–5 | 1.5 | 1 (floor applies) |
| 6–10 | 2 | 1.5 |
| 11–15 | 2.5 | 1.5–2 |
| 16–25 | 3 | 2 |
| 26–45 | 4 | 2.5–3 |
| 46–65 | 5 | 3.5 |
| 66–85 | 6 | 4 |
| 86–125 | 7 | 4.5–5 |
| 126–175 | 8 | 5.5 |
| 176–275 | 9 | 6 |
| 276–425 | 10 | 6.5–7 |
Two caveats the table cannot show about ISO 9001 recertification audit duration. MD 5 clause 3.7 makes Table QMS 1 a starting point only — the certification body must adjust it up or down for significant factors such as complexity, number of sites, outsourcing, regulatory context and prior audit results, and must record the justification. And MD 5 notes it is unlikely that a recertification audit duration will be less than one audit day, which is why the smallest band floors at a day rather than falling to 1.0 exactly.
For fees, multiply the days above by your certification body’s day rate and add the audit team’s travel. Because the day count is roughly two-thirds of a fresh initial audit, a useful planning rule is that recertification costs about two-thirds of what certifying from scratch would cost you today in audit fees — not two-thirds of what you actually paid. Our ISO 9001 certification cost breakdown has the current figures for each line.
One cost that does not count: MD 5 clause 6 states that the review of system performance does not itself form part of the audit time for recertification audits. If that review appears as billable audit days on your quote, ask about it.
An ISO 9001 recertification audit must be on-site. Clause 9.6.3.2.1 requires an on-site audit — this cannot be a desk exercise — addressing three things:
Notice what that list is really asking. Surveillance asks whether your controls are still running. An ISO 9001 recertification audit asks whether the system is still working — whether it produces the results you said it would. That is a question about your objectives, your performance data and your improvement record, not about whether your document register is tidy.
Clause 9.6.3.1.2 adds that the recertification activity includes a review of the previous surveillance audit reports. Every finding from years one and two comes back to the table, so an open corrective action from eighteen months ago is now a live problem.
Clause 9.6.3.1.3 holds one more surprise: an ISO 9001 recertification audit may need a stage 1 after all, where there have been significant changes to the management system, to the organization, or to the legislation it operates under. A major restructure, an acquisition or a new regulated product line can turn your year-three audit into a two-stage event. The same clause notes that such changes can happen at any point in the cycle and may instead trigger a special audit under clause 9.6.4.
A surveillance audit and an ISO 9001 recertification audit are often spoken about interchangeably. The difference is worth being precise about, because the two visits are priced, planned and scoped differently.
| Surveillance audit | Recertification audit | |
|---|---|---|
| When | Years 1 and 2 of the cycle; first one within 12 months of the certification decision | Year 3, before certificate expiry |
| Scope | On-site, but “not necessarily full system audits” (17021-1 9.6.2.2) | Full system effectiveness across the whole certified scope (9.6.3.2.1) |
| Audit time | ≈ 1/3 of the initial audit, annually (MD 5 cl. 5) | ≈ 2/3 of a fresh initial audit priced at today’s size (MD 5 cl. 6) |
| Stage 1 possible | No | Yes, where changes are significant (9.6.3.1.3) |
| Outcome | Certificate continues | New certification decision and a new certificate |
| Deadline for major NCs | No clause-specified deadline | Corrected before certificate expiry (9.6.3.2.2) |
Our guide to the ISO 9001 surveillance audit covers the years-one-and-two visits in the same detail.
ISO 9001:2026 was published in September 2026, and Global ACI issued its transition requirements — document TECH-3-TR 2029-09-30 (M) — on 4 September 2026, with implementation from 16 September 2026 and a three-year transition period.
| Deadline | Requirement |
|---|---|
| 31 March 2027 | Accreditation bodies ready to assess certification bodies against the new edition |
| 30 June 2027 | Certification bodies submit their transition declarations; any CB not transitioning must tell affected clients in writing by this date |
| 30 September 2027 | Accreditation body decisions on CB transitions completed |
| 31 March 2028 | New and initial certifications issued only against ISO 9001:2026 |
| 30 September 2029 | ISO 9001:2015 accredited certifications are no longer valid |
Here is how that collides with your ISO 9001 recertification audit. Global ACI requires certification bodies to run a transition audit for every certified client, and allows that transition audit to be conducted in conjunction with the client’s surveillance audit, recertification audit, or through a separate special audit. For most organizations the cheapest route is to fold it into the ISO 9001 recertification audit they were already paying for.
The transition audit must review, at minimum, the changed requirements of ISO 9001:2026 against the previous version, changes to the organization’s context, and the need for any other changes to the management system. It may be run remotely using ICT methods under IAF MD 4 (Global ACI TECH-3-003) if the certification body can demonstrate the objectives are met.
Will it add audit days? The transition document answers “Possibly” — the certification body must consider whether additional time is needed and justify the calculation under 17021-1 and MD 5, weighing the degree of change to your system and whether the transition audit is bundled with an annual audit or run separately. It also notes additional time may not be needed for a full system audit, which an ISO 9001 recertification audit already is. Bundling is the lever worth pulling.
And the part that catches people out: section 6.4 says that if a certified organization chooses not to transition, the certification body may keep auditing it against ISO 9001:2015 — but must inform the client that the certification will expire at the end of the transition period. Where an organization has declared it will not transition, the certification may not extend beyond 30 September 2029, so it may not remain valid for the entire certification cycle if it currently expires later. The document notes that certification bodies may modify the certificate to reduce its validity and bring the printed expiry date forward. A 2028 recertification decision does not buy you a 2031 certificate if you have refused the new edition.
If you have not started, read our ISO 9001:2026 transition guide before you book the audit, not after.
The deadlines around an ISO 9001 recertification audit are hard, and there are four distinct ways an ISO 9001 recertification audit can leave you uncertified.
Major nonconformities raised at the audit. Clause 9.6.3.2.2 requires time limits for correction and corrective action to be defined, and the actions completed, prior to the expiration of certification. This is stricter than surveillance, where the standard sets no equivalent clause-level deadline. A major raised four weeks before expiry is a genuine emergency.
Activities not completed in time. Under clause 9.6.3.2.4, if recertification activities are not successfully completed before the expiry date, recertification shall not be recommended and the certification shall not be extended. Your certificate simply lapses. There is no grace period written into the standard.
Lapsed, then recovered. Clause 9.6.3.2.5 gives one route back: following expiration, the certification body can restore certification within six months provided the outstanding recertification activities are completed. Miss that six-month window and at least a stage 2 audit must be conducted — you are most of the way back to certifying from scratch. Where certification is restored, the effective date is on or after the recertification decision and the expiry date is based on the prior certification cycle.
Suspension. Clause 9.6.5.2 lists refusing to allow surveillance or recertification audits at the required frequencies as a trigger for suspension, alongside failing to meet certification requirements and a voluntary request. Under suspension the certification is temporarily invalid (9.6.5.3). Resolve the issue and it is restored; fail to resolve it and the result is withdrawal or a reduction in scope (9.6.5.4, 9.6.5.5). The standard notes that in most cases suspension would not exceed six months.
Preparation for an ISO 9001 recertification audit is not the same as preparation for surveillance, because the question is about effectiveness rather than operation. A workable sequence, starting six months out:
If the document side is the gap, the ISO 9001 Toolkit ships 84 editable templates already aligned to ISO 9001:2026 — the policies, procedures, registers and records an ISO 9001 recertification audit asks for — for $89. It saves rebuilding a document set from scratch six weeks before an audit.
Is an ISO 9001 recertification audit the same as an initial certification audit?
No. It is normally about two-thirds of the audit time of a fresh initial audit and does not usually include a stage 1 — though clause 9.6.3.1.3 allows one where changes to the system, the organization or the legislation have been significant.
Can an ISO 9001 recertification audit be done remotely?
Not entirely. Clause 9.6.3.2.1 requires the recertification audit to include an on-site audit. A bundled ISO 9001:2026 transition audit may be conducted remotely under IAF MD 4 if the certification body can demonstrate its objectives are met, but that does not remove the on-site requirement for recertification itself.
What if my certificate expires before the decision is made?
Certification is not extended (9.6.3.2.4). The certification body can restore it within six months of expiry if the outstanding activities are completed; after that, at least a stage 2 audit is required (9.6.3.2.5).
Do I lose calendar time by recertifying early?
No. Where recertification is completed before the existing expiry date, clause 9.6.3.2.3 allows the new certificate’s expiry to be based on the old one, so your cycle anniversary holds.
Does the ISO 9001:2026 transition add audit days to an ISO 9001 recertification audit?
Possibly. The certification body must assess and justify any additional time under 17021-1 and MD 5, considering how much your system changed and whether the transition audit is bundled with an annual audit. Bundling it into the ISO 9001 recertification audit is usually the cheaper option.
An ISO 9001 recertification audit happens in year three of every cycle, before your certificate expires, and it is a full test of whether the system still delivers results. Budget roughly two-thirds of what a fresh initial audit would cost at your current size, not two-thirds of your original bill. Close your surveillance findings first. And if your audit falls in 2027 or 2028, decide now whether the ISO 9001:2026 transition audit rides along with it — because declining the new edition caps your certificate at 30 September 2029 regardless of what the renewal says.
For the wider picture, start with our complete guide to ISO 9001, and read the accreditation rules first-hand in Global ACI’s transition requirements for ISO 9001:2026 and IAF MD 5 Issue 4.
November 1, 2026
October 31, 2026
October 31, 2026
October 30, 2026
October 30, 2026