ISO 27001 Surveillance Audit: Why Year-One Certificates Collect Major Nonconformities

An ISO 27001 surveillance audit is the annual check your certification body performs in years one and two of the three-year certification cycle to confirm that your information security management system (ISMS) is still implemented, maintained, and improving. It is shorter than the initial Stage 2 audit, but it is not a formality: the auditor must review your internal audit, management review, and corrective actions every time, and a major nonconformity can put your certificate at risk.

Year one is when most organizations get caught out. The certification project ends, the consultant leaves, the team returns to its day jobs, and the ISMS quietly stops producing the records a surveillance auditor needs to see. This guide explains what the auditor will check, why year-one certificates collect major nonconformities, what happens if you get one, and how to prepare in the 90 days before your audit.

What is an ISO 27001 surveillance audit?

An ISO 27001 surveillance audit is a periodic, partial audit conducted by an accredited certification body between initial certification and recertification. Its purpose is to confirm that your ISMS continues to conform to ISO/IEC 27001:2022 and remains effective. It does not re-audit every requirement and every Annex A control each time, but over the three-year cycle the certification body's audit program must cover the full scope.

The certification cycle runs like this:

The rules for this cycle come from ISO/IEC 17021-1, the standard that governs certification bodies, and ISO/IEC 27006-1, which adds requirements specific to ISMS certification. Two timing rules matter most:

• Surveillance audits must be conducted at least once each calendar year, except in recertification years.
• The first surveillance audit following initial certification must take place no more than 12 months from the certification decision date.

That second rule is why your first surveillance audit often arrives sooner than people expect. It is counted from the certification decision, not from the date the certificate was framed and hung on the wall.

What does the auditor have to check at every surveillance audit?

At every surveillance audit, the certification body must review a defined set of core elements, regardless of which Annex A controls it samples that year. Under ISO/IEC 17021-1 (clause 9.6.2.2), each surveillance audit includes:

1. Internal audits and management review.
2. A review of actions taken on nonconformities identified during the previous audit.
3. The treatment of complaints.
4. The effectiveness of the management system in achieving its objectives and intended results.
5. Progress of planned activities aimed at continual improvement.
6. Continuing operational control.
7. A review of any changes.
8. Use of certification marks and any other references to certification.

Read that list carefully, because it explains most year-one findings. The first two items are exactly the activities that stop when the certification project ends. A surveillance auditor cannot skip them, and if the records do not exist, there is nothing to sample.

Why do year-one ISO 27001 certificates collect major nonconformities?

Year-one ISO 27001 certificates collect major nonconformities because certification tests whether the ISMS was built, while surveillance tests whether it kept running. In the months before Stage 2, the organization has a project team, a deadline, and often an external consultant driving every activity. After the certificate is issued, those drivers disappear.

The pattern is predictable:

• The project team disbands. The people who ran the ISMS return to engineering, IT, or operations. Nobody has ISMS duties written into their role.
• Scheduled activities have no owner. The internal audit and management review were done once, under project pressure. Nobody put the next ones on a calendar.
• The risk register freezes. The risk assessment was a certification deliverable. Nobody revisits it when the company launches a product, changes cloud providers, or adds an AI feature.
• Stage 2 findings drift. Minor nonconformities from the initial audit had corrective action plans accepted by the certification body. Implementation was promised before the next surveillance. Then the quarter got busy.
• Compliance platform alerts get ignored. Automated monitoring shows failing tests, but nobody is assigned to triage them.

None of this is negligence. It is what happens when a management system is treated as a project. The surveillance auditor's job is to find the gap between what your ISMS says should happen and what has actually happened since certification.

What counts as a major vs. a minor nonconformity?

A major nonconformity is a nonconformity that affects the capability of the management system to achieve its intended results. A minor nonconformity does not. That definition comes from ISO/IEC 17021-1, and certification bodies apply it with judgment, but the practical difference is clear: a major usually means a required element is missing or has broken down, while a minor usually means a requirement is in place but slipped in a specific instance.

Two escalation paths catch organizations by surprise:

• Repeated minors. A minor nonconformity that is not effectively corrected and appears again at the next audit can be raised as a major, because the corrective action process itself has failed.
• Many related minors. Several minor findings in the same area can indicate a systemic breakdown, which an auditor may grade as a major.

The nine most common year-one failure points

These are the areas where year-one surveillance audits most often find nonconformities. Each entry lists the ISO/IEC 27001:2022 clause, what the auditor asks, and the evidence that closes the question.

1. No management review in the past 12 months (Clause 9.3)

What the auditor asks: "Show me the most recent management review and its outputs."

Why it fails: The only management review was held before Stage 2. Clause 9.3 requires top management to review the ISMS at planned intervals, and the review must consider specific inputs, including the status of actions from previous reviews, changes in external and internal issues, changes in the needs and expectations of interested parties, feedback on information security performance, results of risk assessment, and opportunities for continual improvement.

Evidence that closes it: Minutes or a record showing the required inputs were considered, decisions on continual improvement opportunities and any needed changes to the ISMS, attendance by top management, and actions with owners.

2. Internal audit overdue or incomplete (Clause 9.2)

What the auditor asks: "Show me your internal audit program and the audits completed since certification."

Why it fails: The internal audit before Stage 2 was treated as a one-time event. Clause 9.2 requires an audit program at planned intervals, with audit criteria and scope defined for each audit, auditors selected to ensure objectivity and impartiality, and results reported to relevant management. Our ISO 27001 internal audit checklist covers what a complete program looks like.

Evidence that closes it: An audit program covering the full ISMS scope over a defined cycle, completed audit reports for the period, evidence of auditor objectivity, and findings fed into corrective action.

3. Risk register unchanged since initial certification (Clauses 6.1.2 and 8.2)

What the auditor asks: "When was the risk assessment last performed, and what has changed?"

Why it fails: Clause 8.2 requires information security risk assessments at planned intervals and when significant changes are proposed or occur. If the company has launched products, changed suppliers, moved infrastructure, or adopted AI tools, and the register still matches the Stage 2 version, the auditor will conclude the process is not operating.

Evidence that closes it: A dated reassessment, new or updated risks reflecting real changes, and updated risk treatment decisions under Clause 8.3.

4. Corrective actions from the last audit still open (Clause 10.2)

What the auditor asks: "Show me the status of the nonconformities raised at Stage 2."

Why it fails: The corrective action plan was accepted, but implementation stalled or was never checked for effectiveness. Clause 10.2 requires you to react to the nonconformity, evaluate the need to eliminate its causes, implement the action, and review the effectiveness of the corrective action taken. Reviewing a previous audit's nonconformities is a mandatory surveillance element, so this will be checked.

Evidence that closes it: Root cause analysis, implemented corrective actions, and evidence that the actions worked, such as subsequent records showing the issue has not recurred.

5. Statement of Applicability out of date (Clause 6.1.3)

What the auditor asks: "Does the SoA reflect your current controls and justifications?"

Why it fails: Controls marked as implemented are no longer operating, or new risks require controls the SoA does not include. ISO/IEC 27001:2022 Annex A contains 93 controls in four themes: organizational, people, physical, and technological.

Evidence that closes it: An SoA reviewed after the latest risk assessment, with inclusion and exclusion justifications that still hold.

6. Objectives not measured (Clauses 6.2 and 9.1)

What the auditor asks: "How are you performing against your information security objectives?"

Why it fails: Objectives were written for certification but never measured. Clause 6.2 requires objectives to be measurable where practicable and monitored. Clause 9.1 requires you to determine what is monitored and measured, when, and by whom, and to evaluate the results.

Evidence that closes it: Measurement results for each objective over the period, and evidence they were reviewed.

7. Competence and awareness records stale (Clauses 7.2 and 7.3)

What the auditor asks: "Show me training records for people who joined since certification."

Why it fails: Security awareness training happened as a batch before Stage 2. New hires since then never completed it.

Evidence that closes it: Training completion records for the full population, including new joiners, and competence evidence for people in ISMS roles.

8. Changes made without planning (Clause 6.3)

What the auditor asks: "What significant changes affected the ISMS this year, and how were they planned?"

Why it fails: Clause 6.3, added in the 2022 revision, requires changes to the ISMS to be carried out in a planned manner. A reorganization, a new office, or a scope change that simply happened is hard to evidence.

Evidence that closes it: Records showing significant changes were identified, assessed, and planned, with ISMS documentation updated.

9. Climate change determination missing (Clauses 4.1 and 4.2)

What the auditor asks: "Have you determined whether climate change is a relevant issue?"

Why it fails: Amendment 1, published in February 2024, added a requirement to Clause 4.1 that the organization shall determine whether climate change is a relevant issue, and a note to Clause 4.2 that interested parties can have climate-related requirements. Organizations certified on templates written before the amendment may have no record of that determination. Accreditation guidance directs certification body audit teams to verify that the organization has addressed it (Standards Council of Canada).

Evidence that closes it: A documented determination in your context analysis, with a short rationale, whether the answer is that climate change is relevant or not.

Beyond these clause-level items, surveillance auditors sample Annex A controls. In year one, the controls that most often lack ongoing evidence are those that should produce records on a schedule: access rights reviews (5.18), supplier monitoring (5.22), backup testing (8.13), logging and monitoring (8.15 and 8.16), and technical vulnerability management (8.8).

What happens if you get a major nonconformity at a surveillance audit?

If you get a major nonconformity at a surveillance audit, you must correct it and implement corrective action within the deadline your certification body sets, and the certification body must verify the fix, sometimes through a special follow-up audit. If the major is not resolved on time, the certification body can suspend your certificate. If it is still not resolved during the suspension, the certificate can be withdrawn.

The sequence usually looks like this:

1. Finding raised. The auditor documents the major nonconformity in the report.
2. Response deadline. You submit correction, root cause analysis, and corrective action within the certification body's timeframe. Deadlines vary by certification body, and some publish deadlines of around 60 to 90 days for surveillance findings. Check your certification agreement for the exact terms.
3. Verification. The certification body reviews your evidence remotely or schedules a special audit to verify implementation and effectiveness.
4. Suspension, if not resolved. During suspension, the certification is temporarily invalid. Certification bodies commonly allow up to six months to resolve the issue, though the exact period depends on the certification body's procedures.
5. Withdrawal, if still not resolved. Once a certificate is withdrawn, there is no simple reinstatement. The route back is a new initial certification, including Stage 1 and Stage 2.

Missing the surveillance audit altogether can also lead to suspension. If your audit date slips because of scheduling, raise it with your certification body early.

Why does certificate suspension matter commercially?

Certificate suspension matters commercially because your customers and contracts rely on your certification being valid. Certification status is typically verifiable with the certification body or through certification registries, so a suspension can be discovered by anyone who checks.

The commercial consequences usually include:

• Contract exposure. Many enterprise contracts require the vendor to maintain ISO 27001 certification and to notify the customer of any change. Losing certification can be treated as a breach.
• Lost tenders. Public sector and regulated-industry tenders often require a valid certificate at submission.
• Marketing restrictions. During suspension, you generally cannot use the certification or the certification mark in sales materials or bids.
• Renewal friction. Customers' vendor risk teams may escalate your account at renewal.

Compared with those costs, preparing properly for surveillance is cheap.

90-day ISO 27001 surveillance audit readiness plan

Use this plan to prepare for your surveillance audit. Count backward from the audit date.

The order matters. The internal audit should come before the management review, because internal audit results are a required input to the review. A management review held before the internal audit leaves the auditor asking how top management considered results that did not yet exist.

How do you close corrective actions so the auditor accepts them?

You close corrective actions so the auditor accepts them by separating three things that are often blurred together: the correction, the root cause, and the corrective action, and then proving the corrective action worked.

• Correction fixes the specific instance. Example: the overdue management review is held.
• Root cause explains why it happened. Example: no one was assigned to schedule management reviews after the certification project ended.
• Corrective action removes the cause. Example: the management review is added to the ISMS calendar as a recurring item with a named owner, and the ISMS manager's role description now includes it.
• Effectiveness proves the corrective action worked. Example: the next scheduled review happened on time.

Auditors also expect an extent analysis: did the same root cause affect anything else? If nobody owned the management review, did anybody own the internal audit program, or the risk reassessment? Answering that question before the auditor asks it is the difference between closing one finding and avoiding three.

Should you outsource your ISO 27001 internal audit?

You can outsource your ISO 27001 internal audit, and many small and mid-sized organizations do, because Clause 9.2 requires auditors who are objective and impartial, which is hard to achieve when the only person who knows the ISMS is the person who runs it. Outsourcing does not transfer responsibility. Your organization still owns the audit program, the follow-up, and the management review.

An outsourced internal auditor is most valuable when they run the program across the full cycle, rather than appearing two weeks before the external audit. That way, findings arrive early enough to fix.

Ledger Audits' Assurance Program is an annual program that covers outsourced ISO 27001 Clause 9.2 internal audits, a full annual audit program, management review support, and Stage 1, Stage 2, and surveillance preparation. It is built for organizations that want their ISMS to keep running between certification audits. Ask about the Assurance Program.

Related reading

• ISO 27001 Internal Audit Checklist: A Lead Auditor's Program
• ISO 27001 Certification Cost in 2026: The Full Three-Year Breakdown
• How to Choose a SOC 2 Auditor: 12 Checks Before You Sign
• SOC 2 Exceptions vs. a Qualified Opinion

Frequently asked questions

How often are ISO 27001 surveillance audits?

ISO 27001 surveillance audits take place at least once each calendar year in the two years between initial certification and recertification. Under ISO/IEC 17021-1, the first surveillance audit must occur no more than 12 months after the certification decision date. Some certification bodies schedule more frequent surveillance based on risk.

What does an ISO 27001 surveillance auditor check?

An ISO 27001 surveillance auditor must check internal audits and management review, actions taken on previous nonconformities, complaints, the effectiveness of the ISMS in achieving its objectives, continual improvement activities, operational control, changes, and use of certification marks. The auditor also samples a subset of Annex A controls.

Can you fail an ISO 27001 surveillance audit?

A surveillance audit does not produce a pass or fail grade, but a major nonconformity that is not corrected within the certification body's deadline can lead to suspension of your certificate, and continued failure can lead to withdrawal. Missing the surveillance audit entirely can also lead to suspension.

What is a major nonconformity in ISO 27001?

A major nonconformity is a nonconformity that affects the capability of the management system to achieve its intended results. In practice, it usually means a required element, such as management review or internal audit, is missing or has broken down systematically. A minor nonconformity is an isolated lapse that does not undermine the system as a whole.

What happens if my ISO 27001 certificate is suspended?

During suspension, your certification is temporarily invalid and you generally cannot use it in marketing or bids. You must resolve the issues that caused the suspension within the period your certification body allows. If you do not, the certificate can be withdrawn, and regaining certification requires a new Stage 1 and Stage 2 audit.

How long do I have to close a major nonconformity?

The deadline is set by your certification body and stated in your certification agreement. Some certification bodies publish deadlines of around 60 to 90 days for surveillance findings. The certification body must verify the correction and corrective action, sometimes through a special follow-up audit.

Do I need a management review before every surveillance audit?

Clause 9.3 requires management reviews at planned intervals, and management review is a mandatory element of every surveillance audit. Most organizations hold at least one management review per year, timed after the internal audit so that audit results can be considered as an input.

Does the ISO 27001 climate change amendment apply to my surveillance audit?

Yes. Amendment 1 to ISO/IEC 27001:2022, published in February 2024, requires organizations to determine whether climate change is a relevant issue (Clause 4.1) and notes that interested parties can have climate-related requirements (Clause 4.2). Certification bodies verify this during audits, so document your determination even if the conclusion is that climate change is not relevant.

---