ISO 27001 Surveillance Audit Preparation Guide

Maintaining ISO 27001 certification requires evidence that your information security management system continues to operate effectively. An ISO 27001 surveillance audit examines that evidence between certification and recertification.

Your priority is demonstrating consistent operation: completed reviews, current risk decisions and effective corrective actions. Preparation becomes more manageable when these activities are part of normal business operations, supported by a clear audit timetable.

Key takeaways

• Anchor your preparation timetable to the certification decision date and scheduled surveillance visit.

• Prepare operational records alongside policies, with clear ownership and version control.

• Prioritise previous findings, internal audit coverage, management review and changes affecting information security risk.

When ISO 27001 surveillance audits happen

A surveillance audit is mandatory for maintaining accredited certification. It samples the ISMS during the certification cycle and gives the certification body evidence that it remains compliant and effective.

Annual surveillance and the decision-date clock

The first visit must take place within 12 months of the initial certification decision. The second commonly takes place around month 24.

These visits are often described as Years 2 and 3 when initial certification is labelled Year 1. Certification requirements also describe them as the first and second years following the certification decision.

Use month-based milestones to avoid ambiguity. Failure to allow required surveillance can lead to certificate suspension.

Recertification before expiry

A recertification audit takes place before the three-year certificate expires. It assesses continued conformity and ISMS effectiveness more comprehensively than a surveillance visit.

Recertification doesn't automatically repeat the initial Stage 1 audit and Stage 2 audit sequence. Significant changes to the organisation, its ISMS or its operating context can make a Stage 1 assessment necessary.

What the auditor samples

A surveillance audit examines selected parts of the ISMS. The sampling approach varies by certification body, audit programme, the organisation's risks, processes and changes.

Rotating controls and operational evidence

Sampling rotates across the certification cycle, but there's no universal percentage of Annex A controls examined each year. Previous findings and significant changes can attract repeat attention.

For access management, prepare approval records, leaver account removals, privileged-access reviews and resulting actions. These records allow an auditor to trace whether your documented process works.

Auditors also review internal audits, management review, previous non-conformities, complaints and ISMS effectiveness.

Multi-site sampling

Where site sampling is permitted, IAF MD 1's baseline annual surveillance calculation is 0.6 multiplied by the square root of eligible sites, rounded up.

For 25 eligible sites, that produces three surveillance sites. The initial-certification square-root calculation produces five.

This isn't a universal entitlement to reduced coverage. Eligibility, site differences, activities and information security risks affect the programme, and the sample can increase.

Prepare evidence that demonstrates control

Keep your ISMS aligned with the 2022 revision, rather than relying on legacy 2013 control references. ISO/IEC 27001:2022 contains 93 Annex A controls across four themes: organisational, people, physical and technological.

Governance and assurance records

Clause 9.2 requires internal audits at planned intervals. Prepare the audit programme, reports, scope, auditor impartiality records and tracked actions.

Clause 9.3 requires management review at planned intervals. Retain evidence of required inputs, decisions, resource needs and improvement actions. The review should reflect actual ISMS performance.

Present the most recent records alongside your planned schedule. ISO 27001 doesn't impose a universal 12-month age limit on every internal audit report or management review record.

Previous corrective actions need supporting evidence of implementation and effectiveness, not simply a status marked "closed".

Risk decisions and control operation

Prepare your current risk assessment, risk treatment plan and Statement of Applicability. The Statement of Applicability should explain necessary controls, their implementation status and reasons for including or excluding Annex A controls.

Show how changes have affected risk decisions. Relevant changes include new cloud services, acquisitions, suppliers, working arrangements and information assets.

Useful operational evidence includes access-review approvals, asset-register updates, vulnerability remediation records, training completion and incident exercise reports.

Each record should identify its date, owner and outcome. Where an action remains open, show responsibility, target completion and the associated risk decision.

Build preparation around the audit date

Assign an audit coordinator who manages the timetable, evidence index and interview arrangements. Control owners remain responsible for their processes and records.

For an audit scheduled on 16 February 2027, the following calendar provides a practical preparation sequence.

Timing	Preparation activity
October 2026	Allocate owners and review previous findings, organisational changes and outstanding actions.
November 2026	Assess internal audit coverage and collect evidence across the audit period.
December 2026	Complete outstanding governance activities and update risk treatment decisions.
5 January 2027	Run a mock audit or gap analysis, six weeks before the visit.
2 February 2027	Review remediation evidence and arrange access to records and interviewees.
16 February 2027	Present evidence and provide process owners for the scheduled audit sessions.

The main benefit of starting early is time to correct weaknesses and demonstrate that corrections work.

Centralise evidence in a version-controlled repository. Use an index that connects each requirement or control to its owner and supporting records. Restrict access to sensitive material.

Our ISO 27001 audit-readiness support includes independent internal audits and gap analysis, with practical support to address identified weaknesses.

Maintain a monthly, quarterly and annual rhythm

An ISO 27001 surveillance audit is easier to prepare for when evidence accumulates throughout the year. Set frequencies according to risk, requirements and your documented commitments.

Monthly activities can include reviewing overdue actions, asset changes, incidents and vulnerability remediation. Account removals should follow the required leaver process rather than wait for a monthly review.

Quarterly activities can include access reviews, supplier monitoring and risk discussions where these intervals suit your organisation. Record decisions and follow-up actions, including reviews where no changes are required.

Annual planning can cover management review, internal audit coverage, training refreshes and incident-response exercises. Significant business changes may require earlier reassessment.

  A documented quarterly access-review requirement creates an auditable commitment. Three completed reviews won't compensate for a missing fourth review.  

Keep process owners informed about their responsibilities. Evidence collection should support control operation without becoming a separate administrative project.

Handle findings with clear corrective action

Surveillance findings identify where requirements haven't been met. Findings may require corrective actions in line with their classification and the audit report.

Common weaknesses to address early

Recurring weaknesses include missing management review, incomplete internal audit coverage and risk assessments that haven't reflected business changes.

Access reviews also attract findings when their frequency or coverage doesn't match policy. Incident-response arrangements can be weak where staff haven't exercised them or recorded lessons.

Test these areas during preparation. For incident response, retain the exercise scenario, participants, decisions, identified weaknesses and resulting actions. A policy document alone doesn't demonstrate operational readiness.

Minor and major non-conformities

A minor non-conformity generally concerns a failure that doesn't undermine the management system's overall ability to achieve intended results. It still requires correction and corrective action.

A major non-conformity affects that ability and can put certification at risk, including suspension or withdrawal.

Corrective actions should be based on root cause analysis and demonstrate implementation and effectiveness. Fixing one missing record may leave the underlying process failure unresolved.

The audit report sets the applicable response and closure deadlines. Record these as controlled actions, distinguishing plan submission, implementation evidence and effectiveness assessment where required.

Budget for the assessment and remediation

Surveillance costs depend on audit duration, organisational complexity, scope, sites and the certification body's charging structure.

Your budget should separate certification-body fees, travel, internal preparation time and any additional assessment needed to close findings. A shorter visit can still require substantial coordination across security, HR, IT and leadership.

Maintain resources for remediation as well as the audit itself. Delayed corrective actions can create further assessment work and certificate risk.

What surveillance status means for customers

A certificate maintained through surveillance remains part of the same certification cycle. A surveillance year doesn't automatically provide weaker assurance, although the latest visit examines a narrower sample than recertification.

For high-risk onboarding, certification should sit alongside service-specific due diligence. With software suppliers, ISO 27001 certification context matters because the certified boundary must cover the service and information handling relevant to the relationship.

Review certificate scope, relevant locations, current status and unresolved findings. Ask for proportionate evidence covering access management, incident response and protection of sensitive information.

Our guidance on assessing supplier ISO certifications explains how certification supports broader supplier assessment. A certificate supports risk decisions; it doesn't replace them.

Frequently asked questions

What does an ISO surveillance audit mean?

It's a periodic assessment by a certification body, such as the British Standards Institution, to assess continuing conformity after certification.

How does surveillance differ from recertification?

Surveillance samples selected parts of the ISMS between certification decisions. Recertification assesses continued conformity and effectiveness before renewal for another three-year cycle.

What is the purpose of a surveillance audit?

Its purpose is to assess whether the certified management system remains effective, addresses changes and continues to meet applicable requirements.

What is an IMS surveillance audit?

IMS means integrated management system. Its surveillance audit can assess several standards together, such as information security, quality and environmental management, within the certified scope.

Maintain readiness throughout the certification cycle

Effective preparation connects current risk decisions, completed governance activities and reliable operational records. Clear ownership helps your organisation address weaknesses before they become certification problems.

We support organisations with practical ISMS maintenance, independent internal audits and surveillance preparation tailored to their business.

If you would like to find out more information or require any of our services please Contact Us and complete our contact form.