The ISO Certification Cycle Explained: Surveillance Audits, Recertification and the Dates In Between
Most quality managers know their ISO certificate lasts three years. Far fewer have the dates inside that cycle written down anywhere except the certification body’s audit plan. That’s where it goes wrong. Let a surveillance audit slip past its window, or finish recertification a week after the certificate expired, and a manufacturer can lose its certificate. Customer approvals that took years to win can go with it.
This guide covers the cycle for ISO 9001, ISO 14001, ISO 45001, ISO 50001 and similar management system standards. You’ll see the rules your certification body works to, and the internal dates you need to hit before each audit.
3 years
validity of a management system certificate
12 months
latest point for the first surveillance audit after the certification decision
6 months
window after expiry in which certification can be restored
The three-year cycle
Certification bodies accredited to ISO/IEC 17021-1 all run the same three-year cycle. It starts with the certification decision after your initial audit (stage 1 and stage 2). You then get a surveillance audit at least once each calendar year, except in the year you recertify. The first one must happen no later than 12 months after the certification decision. Last comes the recertification audit, which has to finish before the certificate expires. If you don’t let a surveillance audit happen on time, the certification body suspends your certificate.
A typical certification cycle
| Point in the cycle | What happens | Rule |
|---|---|---|
| Year 0 | Initial certification audit, certification decision, certificate issued | 3-year validity |
| Year 1 | First surveillance audit | No later than 12 months after the certification decision |
| Year 2 | Second surveillance audit | At least once per calendar year |
| Year 3 | Recertification audit | Completed, with major nonconformities verified, before expiry |
| Up to 6 months after expiry | Restoration possible | If outstanding activities are completed; otherwise at least a stage 2 audit |
Finish recertification before the expiry date
Your certification body can’t just extend the certificate if you run late. That applies when the recertification audit isn’t complete by the expiry date, or when it hasn’t verified your fixes for major nonconformities by then. It can restore certification within six months of expiry once you finish the outstanding work. But the new expiry date still follows the old cycle, so you don’t win back the lost time. Wait longer than six months and you’ll need at least a stage 2 audit.
The gap between expiry and restoration is where the damage happens. Customer portals, tender forms and supplier approval checks all read the date on the certificate. Even a lapse of a few weeks can make a customer requalify you as a supplier, though your certificate comes back later.
⚠️Book your recertification audit early enough to close a major nonconformity and have your certification body check the fix before the expiry date. Counting back from expiry, that usually means holding the audit three months or more before it.
Automotive: IATF 16949 is stricter
IATF 16949 runs tighter windows. Under the IATF Rules, 6th edition (in force since 1 January 2025), each surveillance audit must fall within three months either side of the anniversary of the last day of your initial or recertification audit. Recertification must land in the three months before that date, with no slack after it. Miss a surveillance audit and your certificate is withdrawn within seven days. You get 15 calendar days to respond to a major nonconformity.
2026: new editions and transition deadlines
Two big standards changed this year. ISO 14001:2026 came out on 15 April 2026 and ISO 9001:2026 on 16 September 2026. Certification bodies have set transition periods; LRQA, for one, gives 30 September 2029 as the end of the ISO 9001 transition. Check the exact deadline with your own certification body, and put the transition audit in your plan as a dated item of its own. One more change: on 1 January 2026 the International Accreditation Forum and ILAC combined into Global Accreditation Cooperation Incorporated. If your procedures still mention "IAF mandatory documents", they may need a refresh.
The internal dates behind each audit
Your auditor looks at what you did between visits. So the dates that make or break a surveillance audit are your own:
Dates to track inside the certification cycle
- ✓
Internal audit programme: every process audited within the planned cycle
- ✓
Management review: held and minuted before the external audit
- ✓
Corrective actions: each with a due date and an effectiveness check
- ✓
Calibration of measuring equipment: due dates set by the organisation under clause 7.1.5
- ✓
Supplier certificates: ISO certificates and declarations of key suppliers still in date
- ✓
Training and competence records: refreshers due for qualified roles
- ✓
Legal compliance evaluation for ISO 14001 and ISO 45001 systems
Calibration needs its own mention. ISO 9001 doesn’t set calibration intervals. You set them, and you must show that you calibrated or checked each gauge, meter and scale at those intervals against traceable standards. Auditors sample the calibration register on almost every visit. An overdue gauge on the shop floor is one of the most common minor nonconformities. Our calibration tracking page shows how to run that register.
💡 Pro Tip
Keep the certification body’s audit dates, your internal audit plan and your corrective action due dates in one system. Spread them across three places, and the corrective action you meant to close before the surveillance audit will still be open on the day.
Planning the year backwards from the audit date
The surest way to arrive ready is to count back from the audit date and give each internal step its own deadline. The spacing depends on your size and your certification body, but a mid-sized manufacturer often works to something like this:
Working back from the external audit (typical practice)
| Weeks before audit | Milestone | Owner |
|---|---|---|
| 16-12 | Audit date confirmed with the certification body; audit plan received | Quality manager |
| 12 | All internal audits in the programme completed and reported | Internal auditors |
| 8 | Management review held and minuted | Managing director |
| 6 | Calibration register checked; overdue equipment calibrated or withdrawn | Metrology / production |
| 4 | Corrective actions from the last audit closed and effectiveness verified | Action owners |
| 2 | Supplier certificates and training records spot-checked | Purchasing / HR |
For a recertification audit, leave room for a major nonconformity. You’ll need time to fix it, time for the certification body to check the fix, and time for it to make the certification decision. All of that has to happen before the expiry date. That’s why most firms book recertification well ahead of the anniversary, not in its last few weeks.
Supplier certificates: the other side of the cycle
Each certified supplier runs its own cycle. If a key supplier’s certificate lapses, your buyers should spot it before your auditor or customer does. Check that each certificate comes from an accredited certification body (look for the accreditation mark). Then log its expiry date with a reminder to ask for the renewed copy.
Running the cycle in ExpiryEdge
In ExpiryEdge, each certificate, audit window, management review, corrective action and calibration due date becomes a record with an owner. Reminders go out at 90, 60, 30 and 7 days, or on a schedule you pick. When you complete a recurring item, it rolls forward to the next date. Suppliers upload renewed certificates through a link, with no account needed. If one sends a certificate with the wrong scope, you can reject it and ask for just that item again. When the auditor arrives, you export the timestamped history in a few clicks. See ISO certification tracking for the full set-up.
ℹ️ExpiryEdge isn’t a quality management system or a CAQ suite. It doesn’t hold your procedures or run your audits. It makes sure every date in your certification cycle has an owner and gets met, with evidence to show for it.
Frequently asked questions
No later than 12 months after the certification decision. That's the rule in ISO/IEC 17021-1, and the clock starts on the day of the decision, not the last day of the audit. If you don't let the audit happen in time, your certification body will suspend the certificate.
The certificate cannot be extended. Certification can be restored within six months of expiry if the outstanding activities are completed, with the expiry date tied to the previous cycle. After six months, at least a stage 2 audit is required.
ISO 9001:2026 was published on 16 September 2026. LRQA has announced a transition period ending 30 September 2029; confirm the deadline that applies with your own certification body.
No. Clause 7.1.5 says you must calibrate or verify measuring equipment at set intervals, or before use, against traceable standards. But you pick the intervals yourself. What the auditor wants to see is proof that you kept to them.
