A recertification audit is the full-scope reassessment your certification body runs at the end of each three-year cycle to confirm your organization still meets a standard such as ISO 9001. It replaces the lighter surveillance audit that happens in years one and two, and it tests whether your management system has actually been running and improving across the cycle, not just tidied up the week before the auditor arrives.1International Accreditation Service. ISO/IEC 17021-1:2015 Section 9 Process Requirements Pass it and you keep your certified status for another three years. Miss it, or fail it badly, and you can lose the certificate entirely.
How the Three-Year Cycle Works
The clock starts on the date of your initial certification decision. Years one and two bring a surveillance audit covering a subset of the standard. Year three brings the recertification audit, which covers the full scope.1International Accreditation Service. ISO/IEC 17021-1:2015 Section 9 Process Requirements Each new three-year cycle begins from the recertification decision, not from the date the physical certificate is reissued, so delaying the audit does not buy you extra time on the next cycle.
The audit itself is shorter than your original certification audit. International guidance sets it at roughly two-thirds of the time a full initial audit of the same organization would require, with a one-day floor.2International Accreditation Forum. IAF MD 5 Issue 4 Version 2 – Duration of QMS and EMS Audits Your auditor recalculates the duration based on your current headcount, site count, and any changes in complexity since the last cycle.
Most registrars recommend scheduling the audit at least three months before your certificate expires. That buffer is not conservative padding. If the auditor finds a major problem, you need enough time to fix it and have the fix verified before the expiry date passes.
What to Prepare Before the Auditor Arrives
The auditor is looking for proof that the system has been alive for three years. A clean binder assembled last month does not demonstrate that. Pull these records together early:
- Internal audit reports, including both the findings your own team raised and the corrective actions that followed.
- Management review minutes showing that senior leadership actually reviewed system performance, allocated resources, and made decisions. Perfunctory or missing reviews draw immediate scrutiny.
- A current scope statement listing the business units, locations, and processes under certification, updated for anything that changed since the last audit.
- Corrective action records from previous surveillance audits and internal reviews, with root cause analysis and evidence that the fixes worked.
- Incident and deviation logs organized so the auditor can trace any event from detection through resolution.
Your certification body will also send a pre-audit questionnaire asking for updated employee counts, site locations, and significant operational or technical changes. The auditor uses this to calibrate the audit plan and time, so accuracy matters.
If you have grown substantially, added new facilities, or materially changed your processes since the last cycle, the certification body may add a Stage 1 review before the recertification audit itself. It is not routine, but it happens when the auditor needs to reassess whether the existing audit plan still fits.1International Accreditation Service. ISO/IEC 17021-1:2015 Section 9 Process Requirements
What Happens During the Audit
The audit opens with a short procedural meeting where the lead auditor confirms scope, walks through the schedule, and verifies that the right people will be available for interviews.
The core of the audit mixes document review, process observation, and employee interviews. The auditor is checking alignment: does what your documentation says should happen match what actually happens on the floor? Staff across departments answer questions about their daily work. The point is not to test their knowledge of the standard. It is to see whether real practices match written procedures. An operator describing a workflow that contradicts the documented process is a red flag the auditor will follow.
Auditors sample rather than check every record. They pick a representative set of transactions, projects, or client files and go deep. If the audit runs remotely, secure screen-sharing lets the auditor observe system configurations and digital records in real time. Across all of it, the audit has to address the effectiveness of your entire management system, your commitment to maintaining and improving it, and whether it is achieving its intended results.1International Accreditation Service. ISO/IEC 17021-1:2015 Section 9 Process Requirements
A closing meeting wraps the audit. The auditor presents findings, tells you whether renewal will be recommended, and if not, what stands in the way.
How Findings Are Classified
Findings come in three categories, and the category determines what happens next.
A major nonconformity means a required part of your system is failing or missing entirely. Examples include situations where a product or service could fail to meet regulatory or customer requirements, where management reviews or internal audits are not happening, or where a known problem keeps recurring without being addressed. A major nonconformity blocks the recertification recommendation. The auditor cannot sign off until you have implemented a fix and shown it works, and the correction must be completed before your existing certificate expires.1International Accreditation Service. ISO/IEC 17021-1:2015 Section 9 Process Requirements
A minor nonconformity is an isolated lapse that does not threaten the system as a whole: a single uncalibrated instrument, a missing training record, an invoice error. Minor findings do not block recertification, but you will need to submit a corrective action plan. Response windows vary by certification body, but 60 to 90 days is common.
An opportunity for improvement is a suggestion, not an obligation. It carries no impact on your certification status. Experienced teams still take them seriously because today’s suggestion often becomes next year’s minor finding if ignored.
Fixing Findings on Time
Major nonconformities demand immediate action. Most certification bodies require a root cause analysis and corrective action plan within 30 days, followed by a follow-up visit to verify the fix is actually in place. If you cannot resolve a major finding before your certificate expires, recertification will not be recommended.
Minor findings allow more room. You typically have 60 to 90 days to submit a root cause analysis, describe the corrective action, and either implement it or commit to a firm timeline. Verification usually happens at the next surveillance audit rather than requiring a separate visit. Confirm the exact deadlines with your registrar at the closing meeting, since they differ.
Treating corrective actions as paperwork is where teams get into trouble. Submitting a plan without doing the work creates a compounding problem: the same finding resurfaces next cycle, and the auditor may upgrade a repeat minor to a major once a pattern is visible.
What Happens If You Fail or Let the Certificate Lapse
If you do not complete recertification before your certificate expires, your certification body cannot extend it. You lose certified status. Contracts that required active certification may be breached. Prospective clients screening for certified vendors will pass you over. Internal discipline around the management system tends to erode once external accountability disappears.
There is a limited recovery window. If outstanding recertification activities are completed within six months of the expiry date, the certification body can restore your certification without forcing a full initial audit. Miss that six-month window and you will need at least a Stage 2 audit, the most intensive phase of initial certification.1International Accreditation Service. ISO/IEC 17021-1:2015 Section 9 Process Requirements The new certificate’s expiry still runs from the old cycle, so delay costs you time on the next one.
When problems go beyond individual findings, the certification body can suspend your certificate. Suspension strips your right to claim certified status while giving you a window to resolve the underlying issues. Common triggers are persistent major nonconformities, refusal to allow audits at required intervals, and failure to pay certification fees. Suspension typically lasts no more than six months. Resolve the issues inside that window and the certificate is restored. Miss it and the certificate is withdrawn, which puts you back through initial certification to regain it.3DNV. Procedure for Suspension and Withdrawal of Certificate
Federal contractors face additional exposure. Under the Cybersecurity Maturity Model Certification program, a contracting officer cannot award a contract, exercise an option, or extend performance if the contractor lacks a current certification at the required level. An expired CMMC status mid-contract triggers standard contractual remedies and makes you ineligible for future awards at that level until you recertify.4Federal Register. Cybersecurity Maturity Model Certification (CMMC) Program Misrepresenting compliance status to the government can also trigger False Claims Act liability well beyond the lost contract.
Disputing a Finding
If you believe a finding is wrong or the auditor misunderstood your system, start with the certification body that conducted the audit. Most registrars have an internal review process where a different team evaluates whether the original finding was justified.
If that does not resolve it, you can escalate to the accreditation body that oversees the registrar. In the United States, the ANSI National Accreditation Board handles appeals of accreditation decisions. Appeals must be submitted within 30 calendar days of the decision using ANAB’s official appeal form. An independent subgroup of the ANAB Accreditation Panel investigates, and unless you waive the hearing, the appeal proceeds to a formal remote hearing conducted in English.5ANSI National Accreditation Board. Appeal Processing
The original decision stays in effect while the appeal is pending. If your certificate was suspended or renewal denied, that status does not change during the appeal. If the panel upholds your appeal, the decision goes back to the original decision-maker for reconsideration. If the panel rules against you, that is final; ANAB will not accept a second appeal on the same decision.5ANSI National Accreditation Board. Appeal Processing
What Recertification Costs
The direct cost depends on the standard, your organization’s size, and how many sites fall under scope. For ISO 9001, recertification audit fees for small to midsize organizations commonly fall between $2,000 and $8,000. SOC 2 Type 2 operates on an annual rather than three-year renewal cycle and runs significantly higher: $12,000 to $20,000 for smaller companies and $30,000 to $100,000 or more for large enterprises with complex environments.
The audit fee is only part of the total. Between recertification cycles, you pay for annual surveillance audits, which are smaller but not free. Many certification bodies also charge annual administrative or maintenance fees. Add staff time spent preparing documentation, sitting for interviews, and implementing corrective actions. Outside consultants, if you use them, bill at hourly rates that vary with the standard and the engagement.
The most expensive recertification is one that fails. A failed audit means additional follow-up visits, expedited corrective actions, and potentially restarting parts of the process. Keeping the system active throughout the three years is almost always cheaper than remediating a bad result at the end of them.