After you are certified, the certification body returns for follow-up audits to confirm the ISMS still operates. These are usually called surveillance audits and are commonly annual, with a larger recertification audit at the end of the certificate cycle. Confirm the exact schedule in your certification contract.
What surveillance audits usually cover
A surveillance audit normally samples part of the system rather than re-testing everything. Typical focus areas are the internal audit and management review since the last visit, corrective actions from earlier findings, changes to scope or the business, and a rotating set of controls.
Because the sample rotates, you cannot prepare for one control only. Everything in your Statement of Applicability can be asked about at some point in the cycle.
Why teams stumble
The most common pattern is a burst of work before certification followed by a quiet year. When the auditor returns, the internal audit is late, the risk register has not changed, and the management review has no minutes.
A second pattern is that the business changed and the ISMS did not. A new product, a new cloud region or an acquisition can all change scope. Tell the certification body and update your documents before the visit, not during it.
A yearly calendar that works
Put the recurring items on a shared calendar with owners.
- Quarter one: refresh the risk assessment after reviewing the past year's changes.
- Quarter two: run the internal audit on a planned portion of the controls.
- Quarter three: management review, using the audit results as an input.
- Quarter four: close open corrective actions and prepare the evidence index for the visit.
Adjust to your own audit dates. The point is that nothing is first attempted the week before the auditor arrives.
Recertification
The recertification audit looks at the whole system again, with attention to how it performed over the cycle. Keep a running log of improvements and incidents. It makes the conversation easier and shows the ISMS is alive.
Changes that deserve a note to your auditor
Some events change what the auditor should look at. A new product line, a move to a different cloud provider, a merger, a major incident or a change of the person who owns the ISMS can all matter. Keep a change log of such events during the year and bring it to the visit. It shows the ISMS reacts to the business.
Keeping the ISMS light
A common complaint is that the ISMS becomes a paperwork machine once the certificate is on the wall. Cut documents nobody uses. Merge small procedures. Move recurring evidence into tools so that it collects itself. A lighter system is easier to keep current, and a current system is easier to audit.
Use the visit as feedback. Ask the auditor which areas looked strongest and which looked fragile. Put the fragile ones into next year's internal audit plan.
Quick check
Do we have to notify the certification body of changes?
Your contract and the certification body's rules say. Significant changes to scope, location or ownership are usually worth raising early.
Last reviewed: 19 October 2026.
