Audits and Evidence · 17 min read
ISO 9001 Surveillance Audit: What Auditors Check and How to Prepare
An ISO 9001 surveillance audit is the visit your certification body makes between your first certificate and its renewal, to confirm your quality management system still works the way you said it does and is still improving. It is shorter than the certification audit and only samples the system, but it always checks the same core topics, and the companies that struggle with it are usually the ones that treated certification as the finish line. It is one of the audits our guide to document audit trails is built around, because so much of what the auditor samples comes back to whether your documents can prove what happened.
This guide is for the quality lead or operations manager at a small or mid-sized certified company who has a surveillance visit coming up and a day job alongside it. It covers when the visits happen, what every one of them checks, how an auditor samples your system, a checklist with the evidence for each area, and a 90-day plan.
Key takeaways
- A surveillance audit happens at least once every calendar year between certification and recertification, and the first one comes within 12 months of the certification decision.
- Every visit checks the same core topics: internal audits, management review, last visit’s findings, complaints, objectives, changes and improvement, plus a sample of your processes.
- Auditors trace a procedure from the approved version to the point of work and the people using it, which is where out-of-date copies and unannounced changes show up.
- ISO 9001:2026 was published in September 2026, but ISO 9001:2015 certificates stay valid through a three-year transition.
What is an ISO 9001 surveillance audit?
An ISO 9001 certificate lasts three years, and the certification body that issued it has to keep checking that it is still deserved. It does that with surveillance audits, which run at least once in each calendar year between the certification decision and the recertification audit, with the first one no more than 12 months after the decision. Those rules come from ISO/IEC 17021-1, the standard certification bodies are accredited against, so they apply whichever accredited body you use.
A surveillance visit is much shorter than the original certification audit. Accreditation rules on audit time generally put it at about a third of the time of the initial audit, which for most small and mid-sized companies means one or two days on site, and your certification body works out the exact figure from your headcount, sites and the complexity of what you do.
Sources: ISO/IEC 17021-1:2015, Conformity assessment, requirements for bodies providing audit and certification of management systems, IAF MD 5, determination of audit time of quality, environmental and occupational health and safety management systems
| Certification audit | Surveillance audit | Recertification audit | |
|---|---|---|---|
| When | Once, before the first certificate | In each year between certification and renewal | Before the three-year certificate expires |
| Coverage | The whole system, in two stages | A sample, plus a fixed set of topics every time | The whole system again, including whether the scope still fits |
| Typical length for a small company | The longest of the three | Usually one or two days on site | Longer than a surveillance visit, shorter than the first audit |
| What a major finding can do | Delay the certificate until it is fixed | Put the certificate at risk of suspension | Delay renewal until it is fixed |
What every surveillance audit has to cover
A surveillance audit isn’t a free-form sample. The rules for certification bodies list topics every visit must include, and the auditor then adds a sample of processes chosen from risk, past findings and the parts of the system not looked at recently.
Internal audits and management review. The auditor looks for evidence that your own checks are running: an internal audit program that covered what it planned to, and a management review where top management looked at how the system is performing and made decisions.
Last visit’s findings. Every nonconformity raised at the previous audit needs an action, a root cause and evidence that the action worked, and a finding closed on paper but still happening on the floor tends to come back as a bigger one.
Complaints, objectives and improvement. The auditor asks how customer complaints were handled, how you are doing against your quality objectives, and what you have improved since the last visit.
Operational control and changes. The auditor checks that processes still run the way your documents say, and asks what has changed in your people, sites, products or processes and how each change was managed.
Use of the certificate. It sounds minor, but the auditor will check that your certificate and the certification mark are used the way your certification body allows, on your website and in your proposals.
How auditors sample your system
Having been through ISO 9001 audits more than ten times, I’ve found that auditors spend far less time asking whether a procedure exists than asking when it was last reviewed, who has seen the current version and, depending on the procedure, whether the people using it have agreed to it. The way they get there is by following one procedure from the office to the floor and watching where the trail breaks.
The most common place it breaks is the copy at the point of work. A procedure was updated and approved in the office, but the printout taped beside the machine, the PDF in someone’s downloads or the link in an old email still shows the previous version, and the operator answers the auditor’s questions from that one. The second most common is step five, when the procedure changed but nobody can show that the people affected were told.
What auditors check under documented information
Clause 7.5 of ISO 9001 covers documented information, which is the standard’s term for the documents you maintain, such as procedures and policies, and the records you retain as evidence. Surveillance auditors don’t usually audit clause 7.5 as a topic on its own; they test it every time they ask for a document, so it is worth knowing what they are looking for.
- Identification: each document has a title, a reference and a version, so everyone knows which one they are looking at.
- Review and approval: a named person approved the document as fit for use before it was issued, and again after every change.
- Availability: the current version is where the work happens, when it is needed, and in a form people can use.
- Protection: documents can’t be changed by the wrong people, and records used as evidence can’t be quietly altered.
- Change control: you can show what changed between versions and when.
- Retention and disposition: records are kept as long as they need to be, and superseded documents are kept out of use.
- External documents: customer specifications, standards and supplier manuals you rely on are identified and controlled too.
The way most companies meet all of that is a written document control procedure, which our separate guide walks through section by section, and the way you keep evidence for the right length of time is a records retention schedule. If you want to see how the same requirements map onto a tool, our post on running ISO 9001 document control in AllyMatter goes through it screen by screen.
Source: ISO 9001:2015, Quality management systems, requirements, clause 7.5 Documented information
Internal audit and management review: the two records that set the tone
Auditors read your internal audit reports and your management review record early in the visit, because they show whether the system checks itself. If those two are thin, the auditor expects to find problems elsewhere and samples harder, and if they are honest and specific, the rest of the day usually goes more smoothly.
Internal audit. A small company doesn’t need an elaborate program, but it does need a plan that covers every process over a sensible cycle, audits carried out by someone who doesn’t audit their own work, and findings that lead to action. An internal audit report that finds nothing year after year is often read as an audit that didn’t look.
Management review. The standard lists what management review has to consider, including the status of earlier actions, changes in internal and external issues, customer feedback, performance against objectives, audit results and the adequacy of resources, and it expects decisions to come out of it. A one-page record that covers every input and names actions with owners beats a long set of minutes that never decides anything.
Both reviews will usually lead to changes in your procedures, and those changes are exactly what the auditor will trace next, so make sure each one went through approval, reached the people it affects and was acknowledged before the visit.
ISO 9001 surveillance audit checklist
Use this checklist in the month before the visit. Each row is a question the auditor is likely to ask, with the evidence that answers it, and the rows follow the topics every surveillance audit has to cover, plus the document checks that come up in every process sample.
| Area | What the auditor will ask | Evidence to have ready |
|---|---|---|
| Changes since the last visit | What has changed in your people, sites, products, processes or scope? | A short list of the changes and how each one was planned and controlled |
| Last visit’s findings | What did you do about the nonconformities raised last time? | Each finding with its root cause, the action taken and proof the action worked |
| Internal audits | Has this year’s internal audit program run as planned? | The audit program, completed audit reports and the findings they raised |
| Management review | Has top management reviewed the system since the last visit? | A record covering the required inputs, the decisions made and the actions that followed |
| Quality objectives | Are you meeting your objectives, and what are you doing where you aren’t? | Current figures against each objective and the actions taken on any that are behind |
| Customer complaints | How were complaints handled since the last visit? | The complaint log, the investigation of each one and what changed as a result |
| Operational control | Does this process run the way its procedure says? | The procedure, the records it produces and people who can explain both |
| Documented information | Is everyone working from the current approved version? | Approval records, version history and the copy in use at the point of work |
| Communication of changes | Did the people affected know about the last change to this procedure? | A named acknowledgment or training record for the new version |
| Continual improvement | What have you improved since the last visit? | Improvement actions and the results they produced |
| Use of the certificate | Are the certificate and the certification mark used correctly? | Your website, proposals and letterhead, checked against your certification body’s rules |
A 90-day plan for your surveillance audit
The best preparation is a system that runs all year, but a little structure in the three months before the visit catches what has slipped while there is still time to fix it properly rather than paper over it.
90 days out. Confirm the dates and the audit plan with your certification body, list everything that has changed since the last visit, and check where each of last visit’s findings stands.
60 days out. Finish any internal audits still due, hold management review if it hasn’t happened this year, and work through every procedure whose review date has passed. A procedure that needs no changes still gets re-approved, because the re-approval is the record that someone reviewed it and judged it still valid.
30 days out. Walk two processes yourself the way the auditor will, from the approved procedure to the point of work, and check that the people affected by any recent change were told and acknowledged it.
The week before. Gather the records the auditor will ask for into one place, brief the people likely to be interviewed without scripting them, and arrange a guide and a room for each day.
Common findings at surveillance audits
The same handful of findings comes up again and again at small and mid-sized companies, and most of them are document problems rather than quality problems.
An old version in use. The approved procedure says one thing and the copy at the point of work says another, which usually means printed or downloaded copies were never withdrawn when the procedure changed.
A change nobody was told about. The procedure was updated and approved, but the people doing the work can’t say what changed, and there is no record that they received the new version.
Reviews that didn’t happen. Your own procedure promises a yearly review, and several documents are well past it with no record of anyone looking at them.
Approval by email. Someone approved the change in a reply that is now buried in an inbox, so you can’t show who approved which version or when.
Corrective actions that fixed the symptom. Last visit’s finding was closed by fixing the one instance the auditor found, without asking why it happened, so it happens again.
Management review without decisions. The meeting happened and the inputs were discussed, but the record shows no decisions, no actions and no owners.
ISO 9001:2024 amendment and ISO 9001:2026: what changes for your next visit
Two changes to the standard affect surveillance audits in the next few years. The first is the 2024 amendment to ISO 9001:2015, which added a requirement to consider whether climate change is a relevant issue for your quality management system and whether your interested parties have climate-related requirements. Auditors already ask about it, and for most companies the answer is a short, honest record of the decision either way.
The second is ISO 9001:2026, published on 16 September 2026. It brings the climate amendment into the main text, asks top management to promote a quality culture and ethical behavior, separates the actions for risks from the actions for opportunities, and strengthens how changes to the system are planned. Certificates to ISO 9001:2015 stay valid through a three-year transition that ends around September 2029, and certification bodies have published slightly different end dates, so ask yours when it plans to audit you against the new edition and whether that can happen at a scheduled visit.
None of that changes the core of a surveillance visit, which is still about whether your documents are current, approved and in front of the right people, and whether your own checks are working. Our sister site, Policy and Compliance, follows what standards like ISO 9001 require as they change.
Sources: ISO 9001:2015/Amd 1:2024, climate action changes, ISO 9001:2026 transition notices from DNV and TÜV SÜD, read October 2026
How AllyMatter keeps procedures audit-ready between visits
We built AllyMatter for the part of an ISO 9001 system that auditors sample hardest, which is your procedures, policies and work instructions: whether they are approved, current, in front of the right people and acknowledged, with a record that proves it without a weekend of digging.
Approval before anyone uses it. Every procedure runs through an approval workflow with up to four steps in order, a rejection has to come with a reason, and the document is locked while it is being reviewed, so what approvers sign off is exactly what goes out.
Only the approved version reaches people. Drafts never reach the floor, every earlier version is kept, and version compare shows every word removed and added between any two versions, which answers the auditor’s “what did version 3 change?” in seconds.
Changes reach the right people, with proof. Tags for teams, sites and roles decide who receives each procedure, each person acknowledges the new version while signed in, and automatic reminders follow up with anyone who hasn’t, so the record shows by name who has confirmed the change.
Reviews that come round on their own. Each procedure carries a review date, fixed or repeating, and a review alert appears on it when the date arrives until it is re-approved, so overdue reviews don’t wait for the auditor to find them.
Evidence you can hand over. Each procedure’s audit trail records approvals, rejections, versions, sends and acknowledgments by name, filters by date range and person, and exports as a PDF or CSV.
AllyMatter doesn’t replace your internal audit program or your management review, which stay with the people who run them; it makes sure the procedures those reviews change are approved, current and acknowledged, with the evidence ready when the auditor asks. On yearly plans, migration is on us: we’ll move your procedures from SharePoint, Google Drive, Confluence or Notion, usually within a week and often sooner.
Start your 30-day free trial of AllyMatter. No credit card to start, and a 30-day money-back guarantee if you subscribe and change your mind. Free migration.
Three scenarios
If you were certified in the last year and your first surveillance visit is coming, start with last visit’s findings and the internal audit program, because those are the two places a first surveillance audit most often finds that the system stopped running after the certificate arrived.
If you have been certified for a while and the visits have become routine, walk two processes yourself from the approved procedure to the point of work, because routine is when old copies and unannounced changes build up.
If your company has grown, added a site or changed what it makes since the last visit, put the list of changes at the top of your preparation, since the auditor will, and make sure the procedures those changes touched were updated, approved and acknowledged.
Questions about ISO 9001 surveillance audits
How often is an ISO 9001 surveillance audit?
At least once in every calendar year between certification and recertification, and the first one has to take place within 12 months of the certification decision. With a three-year certificate that usually means two surveillance visits, then a recertification audit in the third year.
How long does an ISO 9001 surveillance audit take?
For a small or mid-sized company it is usually one or two days on site. Accreditation rules on audit time generally put a surveillance visit at about a third of the time of the initial certification audit, and your certification body sets the exact figure from your headcount, sites and complexity.
Does a surveillance audit cover every clause of ISO 9001?
No. Each visit covers a fixed set of topics, such as internal audits, management review, complaints, objectives, changes and last visit’s findings, plus a sample of processes. Across the three-year cycle the auditor plans to cover the whole system, so a process skipped this year may be the focus of the next visit.
Can you fail an ISO 9001 surveillance audit?
There is no pass or fail grade, but findings have consequences. Minor nonconformities need a corrective action plan that is checked at the next visit, while a major nonconformity, such as a requirement that isn’t being met at all, can put your certificate at risk of suspension if it isn’t fixed in the time your certification body allows.
What documents should I have ready for a surveillance audit?
Your scope, quality policy and objectives, the current approved version of each procedure in the sample, the internal audit program and reports, the latest management review record, the complaint log, records of corrective actions on last visit’s findings, and proof that people affected by recent changes were told about them.
Is a surveillance audit the same as a recertification audit?
No. A surveillance audit samples the system to confirm it still works and is improving, while a recertification audit reviews the whole system again before the certificate expires, including whether the scope is still right.
Does ISO 9001:2026 change my next surveillance audit?
Not straight away. ISO 9001:2026 was published in September 2026 with a three-year transition, so certificates to ISO 9001:2015 remain valid until about September 2029. Your certification body will agree with you when to audit against the new edition, so ask them at your next visit.
A surveillance audit rewards the company whose documents keep up with its work, so the most useful preparation is a system where every change is approved, sent to the right people and acknowledged as part of normal work rather than in the week before the visit.
Start your 30-day free trial of AllyMatter. No credit card to start, and a 30-day money-back guarantee if you subscribe and change your mind. Free migration.