Why ISO 27001 certification gets harder after year one

An ISO 27001 surveillance audit is a periodic assessment your certification body conducts in years one and two of the three-year cycle, verifying through sampled evidence that your ISMS still operates, still improves, and still matches the certified scope. Recertification in year three repeats that check across the entire system. This guide explains why auditor expectations escalate once the certificate is on the wall, what evidence each stage demands, and how to prepare without a twelve-month scramble.

The pattern is familiar to anyone who has sat through a second audit. The first one tested whether you had built something. Every audit after that tests whether you have been running it. That shift is small on paper and large in practice, and it catches out plenty of competent teams. The ISO Survey counted 83,016 valid ISO/IEC 27001 certifications globally in 2023, across 165 countries (International Organization for Standardization), and a meaningful share of those organizations are in the awkward middle years of their cycle right now.

Why the first certification audit sets a lower bar than what follows

The initial certification audit is generous in one specific way: it accepts intent backed by a credible plan. Everything after it asks for a track record instead.

What "existence vs. operation" means for your ISMS

At Stage 2, the auditor confirms that the management system exists, that it is implemented on audit day, and that your work plan for the coming year is realistic. Controls that went live recently can still pass, because nobody expects a twelve-month history from a system that is still new.

Auditors understand that a new ISMS has a short evidence history. That tolerance is deliberate, and it expires immediately.

From the first surveillance audit onward, the question changes from "does this exist?" to "has this been running, continuously, for the whole period your certificate covered?" Nothing can still be sitting in the work plan. The access review you designed must have happened on schedule. The incident process must have handled real incidents, or you must be able to explain credibly why none occurred. This is the core of maintaining ISO 27001 certification rather than simply achieving it.

How the evidence window shifts after certification

The most important shift: at the first certification audit, auditors accept a short evidence history. From the first surveillance audit on, they expect evidence across the full year for every recurring control.

That expansion applies to records that cannot be produced retroactively with any credibility. Management review minutes are dated. Access review exports are dated. Training completion records, vulnerability scan reports, backup restore tests and supplier assessments are all dated. From year two on, any month of the past year can be sampled.

Teams that pass comfortably treat the certificate date as the start of an evidence period, not the end of a project. Teams that struggle treat the later part of the year as the start of preparation, and by then missing access reviews are simply missing.

How does an ISO 27001 surveillance audit work, and what annual evidence do auditors review?

A surveillance audit is shorter than the initial certification audit and narrower in control coverage, but it is not lighter. The auditor arrives with a fixed agenda, a defined sample, and less time to be persuaded.

Mandatory topics every surveillance audit covers

Regardless of what else the audit program selects, certain items appear every single year. Expect the auditor to work through:

• Internal audit: the program, the reports produced since the last external visit, the findings raised, and the follow-up.

• Management review: real minutes with the required inputs and documented decisions, covering the full period.

• Corrective actions: evidence that findings from the previous audit were closed, with the underlying records rather than a status column.

• Changes to the ISMS: new sites, headcount growth, new cloud platforms, acquisitions, scope adjustments, and any change to the Statement of Applicability.

• Risk assessment currency: proof that the risk register and treatment plan moved when the business moved.

• Objectives and results: whether your stated security objectives were achieved, and what happened when they were not.

• Complaints and use of the certification mark: how customers raised security concerns, and how your website and tenders describe the certificate's scope.

These topics are the backbone of every visit because they reveal whether the system is genuinely governed. A team that can produce them calmly tends to produce everything else calmly too, which is one of the quieter habits of successfully certified companies.

How auditors sample controls, departments, and sites

Surveillance audits do not re-examine all 93 Annex A controls. The certification body works from a three-year audit program designed so that the whole Statement of Applicability, and the whole organization, gets covered across the cycle.

In practice that rotation is concrete. A typical plan might cover headquarters plus two sites in the first surveillance audit, then headquarters plus the remaining sites in the second. Departments rotate the same way: HR and engineering this year, customer success and IT next year. Recertification then returns to all sites, all departments, and the full control set.

There is a trap in that rotation. If you remediated precisely what Stage 2 sampled and left everything else untouched, you have engineered your own failure, because next year's sample deliberately leans toward what was not examined last time. The sample also follows change: a company that doubled headcount or migrated its core platform will find the auditor drawn straight to those areas. Understanding how an ISO 27001 auditor works makes this feel less arbitrary and more predictable.

What auditors expect from completed cycles

The expectation is completed cycles, not single instances. If your policy commits to quarterly management reviews, the auditor wants four sets of minutes, not one. If access reviews are semiannual, both are in scope. A review conducted shortly before the audit, with nothing behind it, reads as a finding rather than as evidence.

Several records cause disproportionate trouble, and all are dated. Access reviews with leaver removals, where policy and reality diverge quietly over months. Training and awareness completion, especially for people who joined mid-year. And incident handling, including the lessons-learned step that teams skip when the incident turned out to be minor.

Why auditors press hardest here is not mysterious. Attacker timelines have shifted in ways that punish gaps: Mandiant found that global median attacker dwell time rose to 14 days in 2025, up from 11 days in the prior reporting period, while the median time between initial access and handoff to a secondary threat group fell from more than eight hours in 2022 to 22 seconds in 2025 (Mandiant, Google Cloud). Controls that lapse for a quarter are not a paperwork gap in that environment.

What do auditors expect from corrective actions and opportunities for improvement?

Previous findings are the first thing an auditor opens and the last thing they let go. A nonconformity that reappears is treated far more seriously than the original issue was.

Closing findings from the previous audit

Every minor nonconformity from Stage 2 or the last surveillance audit needs closure evidence, meaning the artifact itself. If the finding concerned access reviews, the auditor wants the access reviews, dated across the period, not a corrective action log entry marked complete.

Opportunities for improvement deserve the same discipline even though they carry no formal obligation. Auditors remember what they recommended. Returning a year later to find that none of their observations were considered, let alone actioned, signals a management system that absorbs input without responding to it. That impression colors the rest of the visit.

The practical rule: maintain one register that carries every nonconformity, observation and opportunity for improvement from both internal and external audits, with an owner, a decision, and a dated outcome. Where you decided not to act, record why. A documented, reasoned decline is defensible. Silence is not.

Demonstrating root-cause analysis, not just fixes

Correction and corrective action are different things, and auditors test the difference. Re-running the missed access review is a correction. Changing who owns it, automating the trigger, and adding it to the quarterly operating rhythm so it cannot be forgotten is corrective action.

Expect to be asked what caused it, what systemic change prevents recurrence, and how you verified that the change worked. The effectiveness-verification piece is where most teams thin out. Effectiveness verification means evidence from after the fix, showing the process holding over time.

Human-factor findings need particular care, because the cause is rarely ignorance. Proofpoint reported that 68% of employees said they knowingly took actions that put their organization at risk (Proofpoint). "We delivered more training" is a weak root cause response when awareness was never the constraint.

How does continual improvement change auditor expectations over the cycle?

Clause 10 is where the escalation is steepest. Improvement is the one requirement that cannot be satisfied the same way twice.

From documented plans to measurable outcomes

In year one, a documented improvement plan with owners and dates is acceptable, because there is no history to measure against. By the first surveillance audit, that plan is the baseline you will be measured on. By recertification, the auditor is reading three years of objectives and asking what actually changed.

Set objectives that produce measurable results. Mean time to revoke access for leavers. Percentage of critical vulnerabilities patched within policy. Phishing simulation failure rate by department. Supplier assessments completed before contract signature. Each gives you a trend line, and a trend line is the most persuasive improvement evidence there is, including when it moves the wrong way and you can show what you did about it.

Measurement remains the weak point across the market. PwC found that only 2% of executives said their company had implemented cyber resilience actions across all areas surveyed, and only 15% of organizations measured the financial impact of cyber risks to a significant extent (PwC). An ISMS that quantifies its own performance already stands out in the room.

Using management review outputs as improvement evidence

Management review is where improvement becomes auditable. The minutes are your primary improvement trail, provided they contain decisions rather than attendance.

Strong minutes record what leadership was shown, what they concluded, and what they changed: budget approved for a logging upgrade, a risk acceptance revisited after an incident, a policy revised because the documented process no longer matched practice, an objective adjusted because the original target proved unrealistic. Each entry is a thread the auditor can pull, following it into the risk register, the treatment plan and the control evidence.

Weak minutes record that the ISMS was discussed and all was well. That tells an auditor nothing, and it leaves clause 10 with no supporting record.

What is different about the recertification audit in year three?

Recertification is a full reassessment of the entire ISMS, conducted before the certificate expires. Treat it as the initial audit with three years of history attached.

Scope and depth compared to surveillance audits

Where surveillance audits sample, recertification covers everything: all sites, all departments in scope, the full applicable control set, and the complete documentation stack. Audit time sits well above a surveillance visit, scaled to your current headcount and complexity rather than the headcount you had three years ago.

That last point surprises people. A company that grew substantially during the cycle is audited at its current size, with the audit days and fee that implies. Controls that were proportionate earlier in the cycle frequently are not later on, and auditors look specifically for that mismatch.

Timing matters as much as scope. Start recertification well before expiry so there is room for corrective action. If the certificate lapses before the certification decision, you lose certified status, and explaining a gap to a procurement team mid-tender is a conversation worth avoiding.

Evaluating three years of ISMS performance

Recertification auditors read patterns, not snapshots. They look at whether the same nonconformity surfaced in two consecutive audits, whether the risk register tracked genuine change in the threat landscape, and whether the system matured or merely persisted.

The threat side of that assessment has moved considerably within a single cycle. Microsoft reported that 78% of observed attack techniques against critical infrastructure used cloud identity abuse (Microsoft). A risk assessment whose identity and cloud entries read identically to an earlier version is not current, whatever its revision date says.

Common recertification pitfalls

Several failures recur. One is treating recertification as a formality because two surveillance audits went smoothly, forgetting that those audits sampled only part of the controls between them. Another is documentation drift: policies describing a toolchain you retired, an org chart with departed owners, a scope statement that predates two new offices. A further pitfall is failing to show how the ISMS adapted, which is the specific thing recertification exists to test.

Another, less discussed, is untested resilience. Sophos reported that 56% of ransomware attacks succeeded in encrypting data (Sophos). An incident response plan with no exercise record and a backup strategy with no restore test are hard to defend across a three-year lookback.

How to build a year-round evidence pipeline instead of a pre-audit scramble

The structural problem is well known. Certification is a project with a budget and an owner. The project ends, the owner returns to their day job, and the system quietly loses its operator until someone notices the surveillance date.

Aligning control evidence collection with operational cadences

Map every recurring control to a rhythm the business already has, then make the artifact a byproduct of the work rather than a separate task.

1. On a regular cadence: update the incident log, confirm onboarding and offboarding completion, check security training status for new joiners.

2. On your review cadence: run and export formal user access reviews, refresh the asset inventory, review vulnerability scan results against patch SLAs.

3. When material change occurs: review the risk assessment against actual change, reassess critical suppliers, revisit the Statement of Applicability.

4. As part of formal governance: complete the internal audit, hold the formal management review, run an incident response exercise, test disaster recovery, review policies.

Assign a named owner with real capacity to each item. The ISMS does not need a large team, but it does need someone whose calendar reflects it.

What compliance automation platforms actually automate

Automation helps with a narrow but valuable slice: pulling technical evidence from systems you already run, timestamping it, tracking recurring task completion, and flagging drift before the audit window opens. Secfix, the compliance automation platform, connects to cloud providers, identity providers and device management tools so that access records, configuration states and endpoint posture accumulate continuously.

What no platform does for you is the judgment work. Management review decisions, root-cause analysis, risk treatment choices and scope definition remain human. The useful mental model is that automation removes the reconstruction effort, not the governance effort. Evidence that assembles itself is worth more at audit than evidence prepared for the occasion, because the dates hold up.

Keeping the Statement of Applicability and risk treatment plan current

These two documents are where drift becomes visible fastest. The Statement of Applicability needs version history showing when a control's status or justification changed and why. The risk treatment plan needs entries that correspond to real decisions made during the period, linked to the risks they address.

Trigger an update whenever something material happens rather than waiting for the annual review: a new processing location, a significant supplier, a platform migration, a notable incident, a regulatory change. Reactive risk management is not just a compliance preference. The UK Department for Science, Innovation and Technology reported that 43% of UK businesses identified a cyber security breach or attack in the previous 12 months, that 38% experienced phishing attacks, and that 69% of businesses hit by a breach or attack described phishing as their most disruptive type (UK Department for Science, Innovation and Technology). Most organizations will have something real to feed into the register during a three-year cycle.

How to choose and work with your certification body across the three-year cycle

You are not buying one audit. You are entering a three-year relationship with a fee structure, an audit program and a specific lead auditor.

What accreditation means for certificate credibility

Verify that the certification body holds accreditation from a recognized national accreditation body: DAkkS in Germany, UKAS in the United Kingdom, Cofrac in France, Accredia in Italy, ANAB in the United States. Accreditation is what gives the certificate recognition through the IAF multilateral arrangement, and it is the first thing a sophisticated enterprise procurement team checks.

An unaccredited certificate costs less and buys less. In regulated supply chains, it can be rejected outright, which means repeating the entire exercise with an accredited body.

Evaluating audit pricing across the full cycle

Compare total three-year cost, not the initial quote. That means Stage 1 plus Stage 2, two surveillance audits, recertification, certificate fees, travel, and any extra audit time triggered by growth or scope change.

Audit days are calculated from accreditation rules based on people in scope, sites, and complexity, so quotes for the same organization should land in a similar range. A quote far below the others usually means fewer days, a narrower scope reading, or no accreditation. Ask for multiple proposals, request the day calculation behind each, and confirm how growth affects pricing mid-cycle. Fold the result into your broader ISO 27001 budget planning alongside tooling and internal time, which typically dwarf the audit fee itself.

Building a productive auditor relationship

Continuity is an asset. An auditor who has seen your ISMS for three years spends less time on context and more on substance, and recertification runs faster as a result.

Be straightforward about gaps. Experienced auditors recognize a managed weakness with an owner and a date, and they respect it more than a polished surface. Send requested evidence before the deadline, keep the auditor informed of significant changes as they happen rather than at the next visit, and act on their observations. Switching bodies is sometimes right, for coverage, sector expertise or cost, but it resets that accumulated context, so time the move for the start of a cycle rather than the month before recertification.

Where the real work sits after year one

The certificate is a three-year commitment to operate a system, documented continuously, verified annually by someone who will ask for records from nine months ago. Year one proves you built it. Years two and three prove you run it, improve it, and adjust it when the business and the threat landscape move. Teams that internalize that distinction early find surveillance audits uneventful, which is exactly what they should be.

Key takeaways

• Switch your evidence practice to a rolling twelve-month record the week your certificate is issued, rather than when the surveillance audit is scheduled.

• Close every nonconformity and formally decide on every opportunity for improvement before the next audit, with documented root causes and post-fix verification.

• Set security objectives that produce a number you can trend, so clause 10 has measurable outcomes rather than intentions.

• Book recertification well before certificate expiry and resource it like a full audit of all sites, departments and controls.

• Choose your certification body on accreditation and total three-year cost, and name one person with real capacity to own the ISMS between audits.

Frequently asked questions

How long is an ISO 27001 certificate valid?

Three years from the certification decision date, conditional on completing surveillance audits on schedule. The first surveillance audit usually takes place within 12 months of the certification decision; your certification body confirms the exact date. The second follows roughly 12 months later, and recertification must be decided before the certificate expires.

What happens if I skip a surveillance audit?

Your certificate is suspended. Accreditation rules require the certification body to suspend certification when a client does not permit surveillance audits at the required frequency, and a suspended certificate is temporarily invalid, meaning you must stop presenting it to customers and in tenders. Resolve the issue and it is restored. Leave it unresolved past the body's deadline and certification is withdrawn or the scope reduced.

Is recertification a full audit?

Yes. Recertification reassesses the complete ISMS: all mandatory clauses, the full applicable control set, every in-scope site and department, and the whole documentation stack. It also evaluates performance across the preceding three years, including recurring findings and whether the system matured. Audit time is substantially higher than a surveillance audit, though usually somewhat below the original Stage 1 plus Stage 2 total.

What evidence do I need for the surveillance audit?

Everything covering the period since the last visit: internal audit reports and follow-up, management review minutes with decisions, the corrective action log with closure evidence for prior findings, the current risk assessment and treatment plan, the Statement of Applicability with version history, a change log covering people, sites, suppliers and systems, security objectives with results, plus dated control records such as access reviews, leaver removals, training completion, vulnerability scans, backup restore tests, supplier assessments and the incident log.

How far back do auditors look for evidence?

At the initial certification audit, the history is usually short and your certification body sets the window. From the first surveillance audit onward, expect evidence across the full year since the previous visit, with continuous records for every recurring control. An auditor can legitimately ask for a record from nine months ago and expect you to be ready to produce it.

How much do surveillance audits cost compared with initial certification?

Surveillance audits are shorter than the initial audit, and recertification takes longer than a surveillance audit; your certification body calculates the exact audit time. Because fees follow audit days, surveillance costs scale accordingly, and you pay it twice across the cycle. Growth in headcount or scope increases audit days mid-cycle, so budget for the organization you expect to be, not the one you certified.

Can we change our ISMS scope between audits?

Yes, but you must notify the certification body without delay when significant changes occur, including new sites, major acquisitions, substantial headcount growth or changes to the certified scope. The body may add audit time or require an additional visit. Unannounced scope changes discovered during a surveillance audit tend to produce findings and schedule disruption.

Should I switch certification bodies before recertification?

Only with a clear reason: missing accreditation, poor geographic coverage for your sites, no sector expertise, or costs that are genuinely out of line once you compare day calculations rather than headline quotes. A new body loses three years of accumulated context and will scrutinize your history more closely, so switching at the start of a new cycle is easier than switching immediately before recertification.