Three years of records read together before renewal
  1. Home
  2. Certification
  3. Services
  4. Recertification.

Recertification.

The one audit in the cycle that looks at the system in its entirety — and the one with a deadline that cannot be extended.

What it involves

What actually happens.

  • The effectiveness of the management system in its entirety, not a sample of it
  • Internal and external changes across the whole cycle, and what they did to the system
  • Whether the certified scope is still relevant and applicable to the organisation as it is now
  • Demonstrated commitment to maintaining effectiveness and improving overall performance
  • Effectiveness against your objectives and the intended results of the management system
  • Review of every surveillance report from the cycle, read together rather than separately
  • Performance of the system over the most recent certification cycle as a whole
  • A Stage 1 where there have been significant changes to the system, the organisation or its context
  • Renewal decision by authorised personnel independent of the audit team
The normative basis

The rules this runs under.

The ruleWhat it requiresReference
It addresses the system in its entiretyRecertification confirms continued conformity and effectiveness of the management system as a whole, and the continued relevance and applicability of the scope. This is what surveillance does not do.ISO/IEC 17021-1:2015, 9.6.3.1.1 · 9.6.3.2.1
It reads the whole cycleThe audit includes review of previous surveillance reports and considers performance of the system over the most recent certification cycle.ISO/IEC 17021-1:2015, 9.6.3.1.3
A Stage 1 may be required againWhere there have been significant changes to the management system, to the organisation, or to the context in which it operates — including changes to legislation — recertification may need a Stage 1.ISO/IEC 17021-1:2015, 9.6.3.1.4
Major findings must close before expiryFor any major nonconformity, time limits are set, and correction and corrective action must be implemented and verified before the certification expires.ISO/IEC 17021-1:2015, 9.6.3.2.2
Validity is not extended to wait for youIf the audit is not completed, or a major nonconformity cannot be verified as corrected before the expiry date, recertification is not recommended and the validity of the certification is not extended.ISO/IEC 17021-1:2015, 9.6.3.2.4
The cycle anniversary is preservedWhere recertification completes before expiry, the new expiry date can be based on the existing one, so the cycle does not drift. The issue date is on or after the decision.ISO/IEC 17021-1:2015, 9.6.3.2.3
Restoration is possible for six monthsAfter expiry, certification can be restored within 6 months provided the outstanding recertification activities are completed. Beyond that, at least a Stage 2 is conducted. The expiry date is still based on the prior cycle.ISO/IEC 17021-1:2015, 9.6.3.2.5
Clause content is paraphrased rather than reproduced — ISO text is copyright. The clause numbers are given so you can check the wording in your own copy.
On your side

What you will be asked to produce.

  • Internal audit and management review records covering the whole cycle, not only the current year
  • Performance data across three years, so a trend can be read rather than a snapshot
  • A record of every significant change to the organisation, the system and the regulatory context since the last recertification
  • The current scope statement, checked against what the organisation actually does today
  • Evidence of the improvement actually achieved, not the improvement planned
  • Closure evidence for every nonconformity raised during the cycle
  • Complaints and their outcomes across the full cycle
The common failure

Where this goes wrong.

Recertification is scheduled too late. Because clause 9.6.3.2.4 prevents any extension of validity, and clause 9.6.3.2.2 requires major nonconformities to be verified as corrected before expiry, an audit held close to the expiry date leaves no room for a major finding. If one is raised, the certificate lapses. During the gap between expiry and a successful recertification decision the organisation is not certified and must not present itself as certified. Restoration within six months is possible, but it is a recovery route, not a plan. The second failure is a scope that quietly stopped describing the business three years ago — clause 9.6.3.2.1 tests exactly that.

Audit time

How the audit time is determined.

Recertification time is approximately two thirds of the audit time that would be required for a full initial certification audit, calculated on current client information rather than on the information from three years ago. Where the organisation has grown, the base figure grows with it. It is unlikely to be less than one audit day.

Reference: IAF MD 5:2023, Issue 4 Version 3, clause 6

The rest of the certification route

OverviewAll certification servicesThe cycleCertification processProgrammesStandards

Describe the claim — not the service.

Tell us what must be relied on, who will rely on it and by what date. We will confirm the correct programme, evidence requirement and responsible entity — or tell you it is outside our scope.

Start a pre-engagement reviewContact the right entity