Surveillance Audit

A surveillance audit is a periodic, on-site or remote assessment that a Certification Body (CB) conducts to verify that an organization continues to conform to the requirements of a management system standard after initial certification.

Expanded Explanation

1. Technical Function and Core Characteristics

A surveillance audit verifies ongoing conformity of a certified management system, such as information security, quality, or environmental management, to the applicable standard between full recertification audits. It checks that documented processes operate as implemented and that corrective actions remain effective.

Certification bodies plan surveillance audits at defined intervals, commonly annually or semiannually within a multi-year certification cycle. The audit typically samples processes, locations, and controls rather than reviewing the entire management system scope.

2. Enterprise Usage and Architectural Context

Enterprises use surveillance audits as a structured mechanism to demonstrate continual operation and maintenance of management system controls, policies, and procedures. In information security, audits review control implementation, risk treatment, monitoring, and incident management relative to standards such as ISO/IEC 27001.

From an architectural standpoint, surveillance audits test how governance structures, control frameworks, and supporting technologies function in practice. Auditors examine evidence such as logs, records, metrics, and management review outputs to determine whether the system remains suitable and effectively implemented.

3. Related or Adjacent Technologies

Surveillance audits relate to certification audits, internal audits, and recertification audits within Management System Certification (MSC) schemes. They also relate to compliance monitoring, continuous control monitoring, and Governance, Risk, and Compliance (GRC) tooling that provide evidence and reporting for audit activities.

Standards bodies define surveillance audits within broader conformity assessment frameworks, which also include initial certification, recertification, and special audits triggered by changes or concerns. Accreditation requirements for certification bodies specify how surveillance audits occur, including frequency, sampling, and competence of auditors.

4. Business and Operational Significance

Surveillance audits help organizations maintain certifications that customers, regulators, or partners require as part of contractual or regulatory compliance. Failure to maintain conformity identified during surveillance can lead to suspension or withdrawal of certification.

Operationally, surveillance audits provide external feedback on the performance of management systems and the status of corrective and preventive actions. They support risk management, policy enforcement, and oversight by boards, executive management, and external stakeholders.