Continuing certification · Qatar
Surveillance Audits and the 3-Year ISO Certificate Cycle Explained
Receiving a certificate is not the end of the audit relationship. An ISO certificate surveillance audit is how a certification body confirms, during the life of the certificate, that the certified management system is still maintained and effective. This guide explains the typical three-year cycle, what surveillance is for, how recertification differs, and what can affect a certificate along the way.
About QAC Qatar. We are an independent ISO certification body: we audit, assess, certify, issue, surveil and renew certificates within our scopes, and we do not build or run management systems for clients, which keeps our audits impartial.
After Stage 1 and Stage 2: what the certificate means
Initial certification ends with an independent certification decision based on the evidence gathered in the two-stage audit, explained in our article on Stage 1 vs Stage 2 audits. If requirements are met, the certification body issues a certificate stating the standard, the scope of activities, the certified sites and the validity dates.
That certificate is a statement about a point in time, backed by a commitment to ongoing oversight. It shows that the system conformed when it was assessed and that the certification body will keep checking it through planned audits. It is not a permanent badge, and it does not continue automatically if those audits do not take place or if serious issues remain unresolved.
The typical 3-year certification cycle
Most accredited management-system certificates follow a three-year cycle. The exact programme is set by the certification body for each client, based on the standard, the scope, the number of sites and other organisation factors, but the high-level shape is usually the same:
| Phase | Audit activity | Purpose |
|---|---|---|
| Initial certification | Stage 1 and Stage 2 | Assess conformity and support the certification decision |
| During the cycle | Surveillance audits | Confirm the system is maintained and improving |
| Before expiry | Recertification audit | Reassess the whole system for a new cycle |
| Decision points | Certification review | Maintain, renew, restrict, suspend or withdraw |
Audit dates are planned in advance, but their timing and duration depend on the programme agreed with the certification body. Nothing in the cycle is guaranteed by date alone: each step depends on audits being carried out and findings being addressed.
What an ISO certificate surveillance audit is for
A surveillance audit checks that the certified system continues to conform to the standard and stays effective in practice. It is a sampling exercise, not a repeat of the full initial assessment. Over the cycle, auditors usually look at:
- Internal audits and management review, and what came out of them
- Actions taken on findings from previous audits
- Complaints, incidents and how they were handled
- Progress against objectives and the use of performance data
- Changes to processes, people, sites or scope
- Correct use of the certificate and any certification marks
Samples key processes to confirm ongoing conformity during the cycle.
Reassesses the full system before the certificate reaches its expiry date.
Findings may need closure before certification is maintained or renewed.
What happens between audits
Keeping the management system effective is the organisation’s responsibility every day of the cycle, not only in the weeks before an audit. That includes running internal audits, holding management reviews, dealing with nonconformities and keeping documented information up to date. If support is needed with that work, it should come from the organisation’s own team or an independent third party.
QAC Qatar’s role is limited to that of a certification body: we plan and carry out surveillance and recertification audits and take certification decisions. Buyers can rely on that separation when they verify an ISO certificate in Qatar, because the body checking the system is not the one that designed it.
Recertification vs surveillance
Recertification takes place before the certificate expires and looks at the system as a whole. Where surveillance samples selected areas, recertification reviews performance over the full cycle, confirms that the system still fits the organisation’s context and scope, and gathers the evidence for a decision on a new certificate.
Recertification should be planned early enough for any findings to be addressed before the expiry date. If it is not completed and decided in time, the certificate may lapse, and continuity cannot be assumed.
Changes that may affect the certificate
Certification covers a defined scope. Significant changes can affect whether that scope is still accurate, so organisations should notify the certification body promptly when they happen. Typical examples include:
- Adding, closing or relocating sites
- Changing products, services or activities within the scope
- Changes of legal name, ownership or organisational structure
- Major changes to key processes or the management system
- Serious incidents or regulatory issues relevant to the scope
The certification body then decides whether a special audit, a scope change or an updated certificate is needed. Early notification keeps the certificate accurate for customers and tender evaluators.
Suspension, withdrawal or expiry
A certificate can stop being valid in several ways. It may be suspended, for example if a surveillance audit cannot be held as planned or serious findings are not resolved. It may be withdrawn if the reasons for suspension are not dealt with, and it expires if recertification is not completed in time. The scope can also be reduced where only part of the system no longer conforms.
For buyers, this is why the dates on a paper certificate are not enough. Check current status with the issuing body, and confirm the issuer is a QGOS registered certification body with recognised accreditation.
Certification is maintained, not automatic
A certificate stays valid only while surveillance and recertification audits take place and the system continues to conform. No reputable certification body promises otherwise.
Frequently asked questions
How long is an ISO certificate valid?
Accredited management-system certificates are typically issued for a three-year cycle. Validity during that time depends on successful surveillance audits, and a new cycle depends on recertification.
Are surveillance audits every year?
Often, but not always. Frequency depends on the certification programme, the standard and the organisation, and is set out in the audit programme agreed with the certification body.
Is surveillance the same as Stage 2?
No. Stage 2 is part of initial certification and assesses the whole system. Surveillance samples selected processes during the cycle to confirm the system is maintained.
What if we miss a surveillance audit?
Contact the certification body as early as possible. A surveillance audit that does not take place within the required period can lead to suspension of the certificate.
Does QAC run our internal audits?
No. Internal audits are the organisation’s own responsibility. QAC Qatar performs independent certification audits only.
Request an audit quotation
Planning initial certification or continuing certification with QAC Qatar? Audit scope depends on your organisation’s size, sites and the standard(s) involved. Share those details and request an audit quotation, or read more on ISO certification in Qatar.
