Here’s the thing most businesses don’t fully grasp until they’re living it: ISO and R2v3 certification isn’t a finish line. It’s the start of a cycle. The certificate you worked months to earn is valid for three years — but that validity depends entirely on what you do in the years between audits. Pass the certification audit, then let the system quietly go dormant, and your surveillance auditor will find exactly that: a system that ran for the certification and then stopped.
So what actually happens after you’re certified? This walks through the real three-year cycle, the moment most systems start to drift, and what it takes to keep your certificate from becoming a liability instead of an asset.
The Three-Year Certification Cycle, Explained
Almost every ISO management system standard — 9001, 14001, 45001, 50001 — and R2v3 runs on the same three-year rhythm. Once your certification body issues the certificate, the clock starts:
Year 0 — Certification. You pass your Stage 1 and Stage 2 audits, the certification body’s independent reviewer confirms it, and your three-year certificate is issued.
Year 1 — First surveillance audit. Within 12 months of your certification decision, your certification body comes back for a surveillance audit. It’s much shorter than your original audit — typically around a third of the time — and it samples across your system rather than examining every element. The point is to confirm you’re still actually running the system, not just that you ran it once to get certified.
Year 2 — Second surveillance audit. Another surveillance visit, same purpose. Across the two surveillance audits, your certification body plans coverage so that all elements of your standard get looked at over the full cycle. Nothing stays permanently unexamined.
Year 3 — Recertification audit. Before your certificate expires, you undergo a recertification audit. This one is more thorough — closer in scope to your original Stage 2 — because it asks a bigger question than the surveillance audits do: has this system been effective across the entire three years, and is it still appropriate for how the business operates now? Pass it, and a new three-year certificate is issued. The cycle starts over.
One detail worth knowing: the new certificate can’t take effect before the recertification decision, and its expiry date follows on from your previous cycle. And surveillance audits aren’t optional — miss one without a valid reason and your certification can be suspended or withdrawn.
What Auditors Are Actually Checking Between Years
Surveillance audits aren’t a formality. The auditor is looking for evidence that your management system is live — that the things the standard requires are happening on an ongoing basis, not reconstructed in a panic the week before the visit. In practice, that means they want to see:
- Internal audits that actually happened across the period, covering your scope.
- Management reviews with real inputs and real outputs — the clause that gets skipped most and cited most.
- Corrective actions that were followed through to root cause and verified effective, not closed with a quick fix and forgotten.
- Document control that’s current — master list up to date, obsolete documents withdrawn, records retrievable when someone asks.
- Evidence the system reflects reality — that it’s changed as your business changed, not frozen at the state it was in on certification day.
Here’s the part that catches people: by the time you reach recertification, auditors expect a continuous three-year trail of this activity. A gap — say, an internal audit program that lapsed after year one — isn’t a small note. It can be a major finding, because it shows the system wasn’t actually operating for a chunk of the cycle. We dig into this pattern in why ISO 9001 certifications fail after year one.
The Moment Systems Start to Drift
This is the real story, and it’s almost always the same. The months leading up to certification are intense — documentation gets written, processes get tightened, everyone’s paying attention. Then the certificate arrives, the pressure lifts, and attention goes back to the actual business. The quarterly review slips to annual. The internal audit gets pushed. The person who built and understood the system gets pulled onto other work — or leaves entirely, taking the reasoning behind the system out the door with them.
None of this looks like a problem at the time. The business runs fine. The certificate’s still on the wall. But the system behind the certificate is quietly decaying, and the surveillance audit is where that decay surfaces — usually as findings you now have to scramble to close, sometimes as a suspension risk if enough has lapsed.
The drift isn’t a sign of a bad company. It’s the default. Maintaining a management system is recurring, scheduled work that competes with everything else on everyone’s plate, and without someone clearly owning it, it loses that competition almost every time.
What “Maintaining the System” Actually Requires
Keeping a certificate healthy across a three-year cycle comes down to a handful of recurring tasks that need to happen on a schedule decided in advance — not in the fortnight before an audit:
- An internal audit program planned and run across your full scope every year, with findings written the way a registrar writes them. This also has to be independent — which is where small organizations hit a wall, because the person who understands a process is usually the person running it, and they can’t objectively audit their own work.
- Management review done properly — agenda set, inputs assembled, meeting facilitated, outputs recorded in a form an auditor will accept.
- Corrective action tracking that carries findings through to root cause, action, completion, and a documented effectiveness review.
- Document control upkeep so the system on paper matches the work on the floor.
- Surveillance audit preparation — a pre-audit review ahead of each visit so nothing gets discovered on the day.
- Transition support when your standard is revised. This one’s live right now: both ISO 9001 and ISO 14001 were revised in 2026, which means transition work is a standing task for a lot of certified organizations, not a hypothetical. See our guides to the ISO 9001:2026 transition and the ISO 14001:2026 transition.
Do all of that consistently and the audits stop being events you brace for. They become confirmations of work that already happened.
Who Ends Up Struggling With This
In our experience, the organizations that run into trouble after certification tend to fall into a few recognizable situations: the system was built for certification and then quietly became nobody’s job; the quality manager who understood it moved on; the company is small enough that genuine audit independence is impossible internally; or there are multiple standards to keep current at once and keeping pace has become more than anyone has time for.
If any of those sound familiar, it’s not a failure — it’s the normal gravity of running a business. It just means the maintenance work needs an owner, whether that’s a dedicated internal role or outside help.
The Bottom Line
Certification earns you the certificate. Maintenance is what keeps it worth having. The businesses that get real, lasting value from certification are the ones that treat the three years between audits as the actual work — a steady rhythm of internal audits, management reviews, corrective actions, and document upkeep — rather than a quiet stretch punctuated by annual panic.
Think of it this way: a certificate backed by a genuinely maintained system is an asset you can put in front of clients with confidence. A certificate backed by a system that’s been coasting is a liability waiting for a surveillance auditor to find it. The difference between the two isn’t the audit. It’s what you do in the months nobody’s watching.
Quick answers
How long is an ISO certificate valid? Three years from the date of issue — but validity depends on passing annual surveillance audits during the cycle. A certificate can be suspended or withdrawn if the system isn’t maintained.
What’s the difference between a surveillance audit and recertification? Surveillance audits are lighter annual checks (years one and two) that sample your system. Recertification, at the end of year three, is a full review of the entire system across the whole cycle, and it renews your certificate for another three years.
What happens if I let the system lapse after certification? The gaps surface at your next surveillance audit as findings you’ll have to correct — and a significant lapse, like an internal audit program that stopped, can be a major finding or even put your certification at risk.
Do surveillance audits really matter, or is only recertification serious? They matter. Missing one without valid reason can lead to suspension or withdrawal, and auditors expect a continuous trail of activity across all three years by the time recertification comes around.
Who should own management system maintenance? Someone clearly accountable for it — an internal role with the time and independence to do it, or an outside partner. The common failure is that no one owns it and the work quietly stops.
If your system has been drifting since certification — or it was built for the audit and quietly became nobody’s job — our Management System Maintenance Program handles the recurring work: internal audits, management review, corrective actions, and surveillance prep, on a schedule set in advance. Book a free readiness call to talk it through.
