Keep the certificate your customers buy on.
An ISO 9001, 14001 or 45001 certificate runs on a three-year cycle with surveillance audits in between, and around it sit internal audits, management reviews, corrective actions and the certificates you collect from suppliers. ExpiryEdge gives each of those a date, an owner and a reminder, and collects supplier certificates by link.
Last updated · ExpiryEdge editorial team
For quality managers, compliance coordinators and operations directors
Certificate cycle, audits and CAPA due dates in one place
Reminders sized for audit lead times
Supplier certificates collected by link, no login
Evidence ready for the auditor and for customers
Quick answer
ISO management system certificates are valid for three years. The certification body runs surveillance audits at least once a calendar year in between - the first within 12 months of the certification decision - and the recertification audit, including verification of any major nonconformity corrections, must be completed before the certificate expires. ExpiryEdge holds each of these dates with an owner, reminds early enough to book the auditor, and tracks internal audits, corrective actions and supplier certificates alongside.
How certificates get put at risk
The first surveillance slips
Year one is busy. The first surveillance audit must fall within 12 months of the certification decision, and if it cannot be done in time the certificate can be suspended.
Recertification starts too late
If the recertification audit and the verification of major nonconformity corrections are not completed before expiry, the certificate cannot simply be extended.
CAPAs drift past their dates
Corrective actions from the last audit have due dates in someone's notebook. The auditor will ask about every one of them.
Supplier certificates expire unseen
Your approved supplier list says "ISO 9001 certified". Nobody has checked whether that certificate is still current, or still covers the right scope.
A new version to transition to
ISO 9001:2026 was published in September 2026. Certified organisations will need a transition audit within the period their certification body sets.
The quality manager is the system
All the dates live with one person. When they are on leave or move on, the cycle has no owner.
The ISO certification cycle and the dates around it
How accredited certification of ISO 9001, ISO 14001, ISO 45001 and ISO 50001 is timed under ISO/IEC 17021-1, plus the IATF 16949 rules many automotive suppliers work to. Your certification body's contract sets the exact dates.
| Event | Timing | What happens if it is missed | Basis |
|---|---|---|---|
| Certificate validity | 3 years from the certification decision | A new initial certification may be needed | ISO/IEC 17021-1 |
| First surveillance audit | Within 12 months of the certification decision | Certificate can be suspended | ISO/IEC 17021-1 cl. 9.1.3.3 |
| Further surveillance audits | At least once per calendar year, except recertification years | Certificate can be suspended | ISO/IEC 17021-1 |
| Recertification audit | Completed, with major NC corrections verified, before expiry | Certificate cannot be extended | ISO/IEC 17021-1 cl. 9.6.3.2.4 |
| Restoring an expired certificate | Within 6 months of expiry if outstanding activities are completed | At least a stage 2 audit after that; expiry stays tied to the old cycle | ISO/IEC 17021-1 cl. 9.6.3.2.5 |
| IATF 16949 surveillance audit | Within -3 / +3 months of the anniversary audit date | Certificate withdrawn within 7 days | IATF Rules, 6th edition |
| IATF 16949 recertification | Within -3 / +0 months of the due date | Certificate lapses | IATF Rules, 6th edition |
| ISO 9001:2026 transition | Published 16 Sep 2026; certification bodies state a transition to 30 Sep 2029 | Certificates to the old version lose validity at the end of transition | ISO; LRQA, DQS |
Three years, every date owned
Certification, surveillance and recertification sit on one timeline, with internal audits, management review, corrective actions and supplier certificates tracked alongside.
From a date in the quality manager's head to a cycle with owners
Surveillance and recertification as dated records
Add each certificate with its certification decision date and expiry, then the surveillance and recertification audits as records of their own. Set the first reminder early enough to agree dates with your certification body - six months ahead for recertification is common - and assign a backup owner so the cycle never depends on one person.
One record per certificate and per audit
Longer lead times for recertification
Owner, backup and escalation
Internal audits, management review and corrective actions
Your internal audit programme, management review and each corrective action from the last external audit become records with due dates and owners. Attach a checklist where the work has steps - root cause, action, effectiveness check - and require evidence on each step, so the auditor sees what was done and when.
CAPA due dates with owners
Checklists with photo, signature and timestamp
Overdue items escalate automatically
Collect and track supplier certificates by link
Send each supplier a request link for their current ISO certificate, scope and any declarations you need, such as REACH or RoHS. They upload without an account, and ExpiryEdge follows up until it arrives. If the scope or company name is wrong, reject that item and the same link asks again. The certificate expiry date drives the next request.
No-login request link per supplier
Automatic follow-up until complete
Next request triggered by expiry
Evidence the auditor can follow
Export the status of every certificate, audit, corrective action and supplier certificate, with documents and the history of reminders and completions, as CSV, PDF or XLSX. The same export answers customer questionnaires that ask about your certification and your supplier controls.
Export by certificate, site or supplier
Every reminder and completion timestamped
History stays when people change roles
Reminders where your team works
Quality and operations teams get reminders by email, Slack or Microsoft Teams; production leads on the floor by SMS or WhatsApp.
ExpiryEdge vs a spreadsheet vs a full QMS / CAQ suite
| ExpiryEdge | Spreadsheet | QMS / CAQ suite | |
|---|---|---|---|
| Live in a day, no implementation project | |||
| Reminders by email, SMS, WhatsApp, Teams | Varies | ||
| Suppliers upload certificates without an account | Rarely | ||
| Reject and re-request a single document | |||
| Checklists with photo and signature evidence | |||
| Also licences, permits, inspections and contracts | Manual | Partly | |
| Timestamped audit trail | |||
| Document control and SPC |
Within 12 months of the certification decision, under ISO/IEC 17021-1. After that, surveillance audits take place at least once each calendar year outside recertification years. If a surveillance audit cannot be carried out in time, the certification body can suspend the certificate. Record the decision date in ExpiryEdge and set reminders far enough ahead to agree the audit date.
If the recertification audit is not completed, or major nonconformity corrections are not verified, before expiry, the certificate cannot be extended. It can be restored within six months of expiry if the outstanding activities are completed; after that at least a stage 2 audit is needed. The expiry date stays tied to the previous cycle. Starting recertification six months ahead avoids this.
ISO 9001:2026 was published on 16 September 2026, and certification bodies such as LRQA state a transition period to 30 September 2029. Confirm the exact deadline and your transition audit date with your certification body, then track both in ExpiryEdge with an owner.
Keep each supplier certificate as a record with its expiry date and scope, and request a new copy before it runs out. In ExpiryEdge you send the supplier a request link; they upload without an account, ExpiryEdge follows up automatically, and you can reject a certificate with the wrong scope or company name and ask for just that again. The expiry date of the new certificate sets the next request.
Give each corrective action a record with a due date and an owner, and attach a checklist for root cause, action and effectiveness check. ExpiryEdge reminds the owner, escalates overdue actions to the quality manager and timestamps each completed step, so you can show the auditor what was done and when.
No. ExpiryEdge does not do document control, inspection planning or statistical process control. It makes sure every certification date, audit, corrective action and supplier certificate has an owner, is acted on in time and leaves evidence. Smaller manufacturers often use it on its own; larger ones run it beside a QMS.
Every certificate date, audit and CAPA with an owner
Add your certificates and audit dates, send the first supplier certificate request. Free 14-day trial, no credit card.