Getting certified feels like the finish line. It is not. An ISO 27001 certificate runs for three years, and in between you are audited again, usually once a year, to show that the management system is still alive and not just a binder produced for the first audit.
What a surveillance audit is (and is not)
A surveillance audit is smaller than the certification audit. The auditor does not re-examine everything. They sample parts of your ISMS, follow up on earlier findings, and check that the system is being run as you said it would be.
What auditors look at in year one
- Closed actions. Every nonconformity and observation from the certification audit should have an owner, a fix and evidence that the fix worked.
- Internal audit and management review. Both must have actually happened since certification, with records. These two are the most common reasons for a finding.
- Changes. New systems, suppliers, offices, acquisitions or a change in scope. Auditors want to see that the risk assessment and Statement of Applicability were updated to match.
- Incidents and near misses. Not that you had none, but that you logged what happened, learned from it and acted.
- A sample of controls. Access reviews, backups, patching, supplier checks and training records, with dates that fall inside the year.
How to stay ready without a scramble
- Put the recurring tasks on a calendar with an owner: access reviews, internal audit, management review, supplier reviews, awareness training.
- Save evidence when the task is done, not when the audit is announced.
- Keep a running list of changes to systems, suppliers and scope so the risk assessment is updated as you go.
- Review open actions monthly. An action that is two months overdue becomes a finding.
- Do a short readiness check four to six weeks before the audit, and fix gaps while there is still time.
The mindset shift
In the first audit you prove the system exists. In every audit after that, you prove it keeps working. Teams that treat certification as a starting point, with small regular habits instead of one big push, find the second audit far calmer than the first.