ISO Certificate Renewal and Recertification: What to Expect

An ISO certificate expires, and before it does you have to show again that your management system exists, works and still matches the standard. If you kept records during the cycle, this takes less effort than the first certification. Most of the work is gathering evidence, not starting over.

What renewal, recertification and surveillance mean

• Renewal is the everyday word for extending your certificate so that it does not lapse.
• Recertification is the formal term on the classic route with an on-site audit by a certification body. At the end of a certification cycle, the whole management system is examined again.
• Surveillance means the shorter checks between initial certification and recertification. They confirm that you keep the system running.

Search results for "ISO certificate renewal" mix all three. Which one applies to you depends on the type of certificate you hold.

How the cycle works on the classic route with an on-site audit by a certification body

A certificate on this route runs for a fixed cycle, commonly three years. The certification body comes back for surveillance audits during that time. Before the cycle ends, a recertification audit covers the whole system again, and a pass starts a new cycle.

Details differ between certification bodies and standards. Exact dates and conditions are in your contract and on your certificate, so read those rather than a general article.

Two points hold almost everywhere:

1. Plan and book the audit before the expiry date. A gap between expiry and the next certificate can cause trouble with customers.
2. Close open findings from earlier audits. A nonconformity nobody handled will come back.

What changes when your certificate rests on a self-assessment

A Zertify certificate is issued by G6 Agency AG under licence from SICE (Swiss Institute of Certification and Education) on the basis of a self-assessment. SICE reviews every assessment before the certificate is issued. There is no auditor on site and no audit calendar.

The principle is the same as on the classic route: a certificate states where you stood at one point in time, and that statement has to be refreshed. You check again that your processes, documents and responsibilities match the standard. The certificate is valid for three years and is confirmed every year with a short online re-audit. It works as a yearly subscription. The first year costs the full price, each following year a lower yearly fee, and you can cancel at any time for the end of the year.

What to prepare before renewal

Start the day after you receive the certificate. If you only look at the system when the expiry date is near, you will find gaps with little time left to close them.

Keep evidence as you go

Standards built on the high level structure ask for the same kinds of proof. Documented information under clause 7 Support is the base. An assessment looks at records: what you did, when, and who decided it.

For a small business, useful evidence includes:

• minutes of a short management review
• a record of an internal check of your processes
• a list of complaints, incidents or errors and what you did about them
• training or briefing notes for new staff
• updated process descriptions or policies, with dates

Review the system under clauses 9 and 10

Clause 9 Performance evaluation covers monitoring, internal audit and management review. Clause 10 Improvement covers how you react to problems and how you improve. A renewal usually succeeds or fails on these two. A system that never measured anything and never changed anything looks dormant.

You need no heavy tooling. For a small team, a yearly internal check with a one page report and a one hour management review can be enough, provided you act on the results.

Revisit context and risks under clauses 4 and 6

New services, customers, suppliers, staff or legal duties change your business. Clause 4 Context of the organization and clause 6 Planning ask you to understand those changes and plan for them. Reread your earlier answers before renewal and check whether they are still true.

Watch for revised standards

When a standard is revised, the publisher usually sets a transition period for existing certificates. ISO/IEC 27001, for example, was revised in 2022. If your standard has a newer edition, find out which edition your renewal refers to and whether your documents need updates. Our standards overview lists the standards we work with.

Renewal checklist

Work through this list about three months before the certificate expires. For an audited certificate, start earlier and book the auditor first.

• Find the expiry date and the renewal terms on your certificate and contract.
• Confirm which edition of the standard applies.
• Name one person who owns the renewal.
• Collect the records from the past cycle: reviews, internal checks, incidents, training.
• Check that all earlier findings or open actions are closed.
• Reread your scope. Does it still describe what you actually do?
• Update policies, process descriptions and role lists that no longer match reality.
• Run an internal check and hold a management review if you have not done so this year.
• Note any new legal, customer or contract requirements.
• Check whether any customer, tender or regulator now demands a certificate based on an on-site audit by a certification body.
• Start the renewal process early enough to leave a safety margin.

When the classic route with an on-site audit by a certification body is the better choice

A self-assessment certificate suits many small businesses. It shows customers and partners that you have thought through your processes and documented them, and it is quick and affordable.

Some requirements it cannot meet. Choose the classic route with an on-site audit by a certification body when:

• a tender explicitly requires a certificate based on an on-site audit
• a customer contract names an on-site audit by a certification body as a condition
• a regulator or supervisory body demands it
• your sector expects independent on-site audits

In any of these cases a self-assessment will not satisfy the requirement, however carefully you complete it. Ask whoever sets the requirement what exactly they accept, and do it before you spend money on either route.

Some businesses hold both: a certificate based on an on-site audit where it is demanded, and a self-assessment certificate for other standards where it is not. The guide on ISO certification cost helps you compare the likely spend.

How Zertify handles renewal

You answer questions about your management system online. If you pass and pay, the certificate is issued within 4 hours.

Renewal follows the same logic. Each year a short online re-audit confirms the certificate: you look at your system again, answer honestly and receive an updated certificate if the assessment is passed. It stays short because the evidence work happens inside your business during the year, not in a separate audit project.

Three pages help you plan:

• The standards page shows which standards are available.
• The pricing page shows what a certificate costs.
• You can start the assessment at any time to see where your system stands.

Tell your own customers plainly what the certificate is: a self-assessment certificate that anyone can verify publicly on zertify.ch. Described that way, it holds up when someone asks.

Common mistakes at renewal

Waiting for the last month. A system ignored for two years cannot be repaired in two weeks. Spread the work over the cycle.

Copying last time's answers. Your business has changed, and the answers should show it.

Treating the certificate as the goal. It is a by-product of a system that helps you run the business. If the system exists only on paper, that shows.

Forgetting the scope. If you added a service or a site, the certificate may not cover it. Update the scope or adjust what you claim to customers.

Using the wrong type of certificate. Check what your customer or tender actually requires. This mistake costs the most because it comes to light late.

A simple yearly rhythm

Four fixed dates a year make renewal nearly routine.

1. Quarter one: review scope, context and risks. Note changes.
2. Quarter two: run the internal check of your processes.
3. Quarter three: hold the management review and close open actions.
4. Quarter four: collect evidence and start the renewal, well before expiry.

The same rhythm works for an audited and for a self-assessed certificate.

In short

On the classic route with an on-site audit by a certification body, renewal means a recertification audit at the end of the cycle, with surveillance in between. With a self-assessment certificate, it means an honest second look at your own system. Either way, keep records all year, review under clauses 9 and 10, and find out early whether anyone requires an on-site audit by a certification body.