Certification is treated as a finish line and it is not one. It is the start of a three-year cycle: certification, surveillance, surveillance, recertification, repeat. The second audit catches far more teams out than the first, for a reason that is entirely predictable — the first audit tests whether you built it, and the second tests whether you kept doing it.

How the cycle actually works

Your certificate is valid for three years, conditional on passing surveillance. Miss one and the certificate can be suspended or withdrawn — which is materially worse than never having had it, because customers have it on file and will notice.

When	What happens	Effort
Year 0	Stage 1 (documentation) then Stage 2 (implementation). Certificate issued.	Full audit
Year 1	First surveillance audit. A sample of the ISMS, plus everything you promised to fix.	~1/3 of initial
Year 2	Second surveillance audit. A different sample.	~1/3 of initial
Year 3	Recertification. The whole management system again, though usually lighter than the original.	~2/3 of initial

Surveillance is sampled rather than comprehensive, but the sample is not random. Auditors return to what they flagged last time, what changed since, and the clauses most systems neglect.

The six things always checked

Whatever else varies, these appear at effectively every surveillance audit. They are also the six most likely to have quietly lapsed.

Internal audit (clause 9.2). Did you run one this year, by someone independent of the area audited, against a plan? "We were busy" is a major non-conformity.
Management review (clause 9.3). An actual meeting, with leadership present, covering the required inputs, producing decisions, minuted. Missing minutes is one of the most common findings there is.
Corrective actions. Every non-conformity from last time, closed with evidence of root cause — not just the symptom patched.
The risk assessment. Reviewed and updated, reflecting what changed this year. An unchanged register twelve months on tells the auditor nobody looked at it.
Access reviews. The most-sampled Annex A control anywhere. Expect them to pick a period and ask for that review, with the reviewer named and leavers actually removed.
Supplier management. Your list, your tiering, your reassessments — particularly if you added anything significant.

Major, minor, and observation

Findings come in three weights, and the difference is worth understanding before you are told which one you have.

Observation — an improvement suggestion. No action strictly required, but ignored observations have a habit of returning as minors.

Minor non-conformity — a single lapse in an otherwise working system. One leaver not deprovisioned. You submit a corrective action plan, usually within 30 days, and close it by the next audit. Most organisations collect a few. They are not a crisis.

Major non-conformity — an absent or systemically broken requirement. No internal audit at all. No management review in the cycle. A control claimed in the Statement of Applicability that does not exist. Majors block certification or suspend it, must be closed on a short clock, and often require the auditor to return.

The most common route to a major is the calendar. Not a technical failure — simply that the internal audit and management review never happened, because certification was in October, everyone exhaled, and nobody scheduled anything until the auditor emailed eleven months later. Book both within a week of getting certified.

Changes you must tell your certification body about

Certificates are issued against a defined scope. Change the scope materially without saying so and the certificate may not cover what you are now claiming it covers.

Significant headcount change. Audit duration is driven by people in scope; a jump from 40 to 120 changes the day count.
New sites, or a new country of operation.
A major change of cloud provider or hosting architecture.
Acquisitions, or a new product line inside the scope boundary.
A change of certified scope itself — adding a business unit, or narrowing one.
Serious incidents. Many certification bodies require notification of significant security incidents; check your agreement rather than assuming.

The rhythm that makes this boring

Teams that find surveillance painless are not working harder. They have spread the same work across the year instead of compressing it into the fortnight beforehand.

A workable annual shape: access reviews quarterly, with the evidence retained as it is produced. Risk register reviewed each quarter alongside them. Internal audit around month seven, so findings have time to close before the auditor arrives. Management review quarterly, or at minimum twice a year. Supplier reassessments on a rolling basis rather than all at once.

Everything above is evidence you would produce anyway. The only difference is whether it is captured continuously or reconstructed under time pressure.

What the auditor actually asks

Surveillance is largely conducted through interviews, and control owners are often more nervous than they need to be. The questions are predictable, and they are not trick questions.

An auditor sampling access control will typically ask the control owner to describe what they do, then ask to see it happen. So: “walk me through how someone gets access to production”, then “show me the last person who joined”, then “show me someone who left”. They are testing whether the described process and the observed reality match.

The failure mode is not ignorance. It is a control owner who recites the policy rather than describing their actual job — because the policy says something aspirational that nobody does. If the real process differs from the written one, fix the document before the audit rather than coaching someone to read it aloud.

Expect sampling, not exhaustive review. An auditor might take five leavers from the year, or three change requests, or two months of access reviews.
Expect the sample to include the awkward period — the month you were busy, or the fortnight around a reorganisation.
Expect them to follow a thread. One weak answer becomes three more questions; a clear one closes the topic.
"I do not know, but I can find out and show you this afternoon" is a perfectly good answer. Guessing is not.
Expect at least one question about something that changed since last year. Have a short list of changes ready.

What surveillance costs

Budget for it at the point of certification, not when the invoice arrives. A surveillance audit runs at roughly a third of the initial audit duration, so for a company of 20–100 people that is typically two to three audit days, or around £2,500–£5,000 a year at prevailing UK rates. Recertification in year three is closer to two-thirds of the original, so £5,000–£9,000.

Add internal time: a well-run year costs perhaps eight to twelve days of internal effort spread across quarterly activities, plus two or three days around the audit itself. A badly-run year costs three weeks of panic in one block, which is the same work at a worse exchange rate.

Standard revisions and transition periods

Standards get revised, and when they do, certificate holders get a transition window — typically around three years — to move to the new version. The 2013 to 2022 transition is the recent example, and the pattern is worth knowing because it will happen again.

What a transition involves: re-mapping your Statement of Applicability to the new control structure, addressing any genuinely new controls, updating your risk treatment, and being audited against the new version at a surveillance or recertification visit. It is real work but it is not a re-implementation.

The mistake to avoid is leaving it to the final surveillance audit of the window. Certification bodies get congested near a transition deadline, and a body that cannot schedule you in time is not a defence — your certificate simply lapses. Move at your second surveillance audit, not your last.

Changing certification body

It happens — cost, service quality, or an auditor who does not understand your sector. It is permitted and reasonably common, but the mechanics matter.

A transfer is possible mid-cycle. The new body reviews your existing certificate, the last audit reports and any open non-conformities, then continues the cycle rather than restarting it.
Open major non-conformities block a transfer. Close them first.
Your certificate must be current and accredited. A lapsed certificate means a new initial audit, at full cost.
Time it at a surveillance point rather than mid-year, so you are not paying two bodies in the same cycle.
Expect the new body to want more evidence in the first audit than an incumbent would. They are taking on your certificate and their accreditation is on the line.

The week before

Re-read last year’s report and confirm every finding is genuinely closed, with evidence attached.
Check your Statement of Applicability still matches reality — controls you dropped, and any you added.
Confirm the internal audit report and management review minutes exist as documents, with dates and attendees.
Spot-check your own access review for the most recent period, as the auditor would. Look for leavers.
Have the document set ready: scope, SoA, risk register and treatment plan, policies, incident log, training records, supplier register.
Brief whoever will be interviewed. Control owners should be able to describe what they do without reading the policy aloud.

One final point that auditors make repeatedly and teams rarely believe: they are not trying to catch you out. A minor non-conformity honestly raised and properly closed demonstrates a working management system. Concealment, discovered, is far more damaging than the finding it was hiding.

ISO 27001 Surveillance Audits: Keeping the Certificate After Year One