What actually happens at your ISO surveillance audit, and why some Kenyan businesses lose their certificate
We get far more anxious phone calls about surveillance audits than we do about initial certification audits, and that surprises most clients when we point it out. The logic runs the other way for them: the first audit is the big unknown, the one with the most riding on it, so naturally it feels like the harder one. In practice, a surveillance audit is where the real discipline of a management system gets tested, because by then the novelty has worn off, the person who championed the certification may have moved roles, and the question an auditor is really asking is whether the system is still alive or whether it quietly stopped being used the week after the certificate arrived.
What a surveillance audit is actually checking for
Certification to ISO 9001, ISO 27001, ISO 22301, ISO 45001 or ISO 14001 isn't a one-time event. Certification bodies run annual surveillance audits in years one and two after the initial certification, with a full recertification audit in year three. A surveillance audit is narrower than the original audit, it doesn't re-examine every clause of the standard, but it specifically looks for evidence that the system has kept running: internal audits completed on schedule, management reviews actually held and minuted, corrective actions closed out rather than left open indefinitely, and any changes to the business, new locations, new services, staff turnover in key roles, properly reflected in the documented system rather than left stale.
Why businesses that pass the first audit comfortably still get flagged later
The pattern we see most often is what we'd call certification fatigue. In the run-up to the initial audit, there's usually a concentrated push: documentation gets written, training gets delivered, a mock audit gets run. Once the certificate is issued, that energy naturally drops off, and without someone actively maintaining the system, pieces of it start to lapse quietly. Internal audits get pushed back a quarter, then skipped. A corrective action from a minor nonconformity gets logged but never actually closed. A new branch opens and nobody updates the scope statement. None of these individually feels urgent in the moment, which is exactly why they accumulate, and a surveillance auditor's job is to find precisely that accumulation.
The nonconformities that actually sink surveillance audits
Internal audits that happened on paper but not in practice. A schedule that says quarterly internal audits occurred, with no evidence, findings, or follow-up attached, reads as worse than having no internal audit programme at all, because it suggests the records themselves can't be trusted.
Management review that's really just a meeting agenda item. The standard expects management review to genuinely evaluate the system's performance, risks, and opportunities for improvement, not a five-minute slot at the end of a general management meeting with no real content behind it.
Open corrective actions with no real deadline. A corrective action that's been open for over a year, with no root cause analysis and no closure date, is one of the fastest ways to turn a minor nonconformity from last year's audit into a major nonconformity this time.
Scope drift. If your certificate covers operations at a specific site or for specific services and the business has quietly expanded beyond that without updating the certification scope, the auditor will catch it, and it can delay the audit outcome while the scope gets formally revised.
A practical pre-surveillance checklist
Roughly six to eight weeks before a scheduled surveillance audit, it's worth running through this with whoever owns the management system internally:
1. Internal audit status. Have all scheduled internal audits for the period actually happened, with findings documented and corrective actions assigned?
2. Management review record. Is there a genuine, minuted management review covering performance data, audit results, and improvement actions, not just a brief mention in a general meeting?
3. Corrective action log. Are all open items from the last audit either closed with evidence, or actively being worked with a realistic deadline?
4. Document control. Have any process changes, new equipment, new suppliers, staff changes in key roles, been reflected in the current version of the relevant procedures?
5. Scope accuracy. Does the certificate's stated scope still match what the business actually does and where it operates?
6. Staff awareness. Would a frontline employee, picked at random, be able to explain their role in the management system if an auditor asked them directly?
What to do if you're already behind
If reading that checklist surfaced a few honest gaps, the worst move is to try to fabricate records in the week before the audit. Auditors see through backfilled paperwork quickly, and it tends to raise more suspicion than an honestly reported gap with a credible plan to close it. The better move is to flag the shortfall internally now, do the real work even if it's compressed, and be straightforward with the auditor about where you are. A well-handled minor nonconformity rarely threatens a certificate. A pattern of covered-up gaps does.
Keeping the system alive between audits
We work with a number of clients specifically on the maintenance side of certification, not just the initial push to get certified, because that's genuinely where most of the risk sits. If your surveillance audit is coming up and you'd rather find out where the gaps are now than have an auditor find them for you, it's worth a short conversation before the date is locked in.