How do you make sure your certification stays valid between audit cycles?

Keeping a certification valid between audits comes down to one thing: treating governance as a continuous operational discipline, not a project you revisit when the auditor calls. Certifications lapse not because organisations fail their audits, but because they stop doing the work that earned the certificate in the first place. The sections below unpack the most common questions around certification continuity, from what actually causes drift to how you can spot risk before it becomes a finding. If you want to talk through your specific situation, feel free to get in touch with us and we will help you from there.

What actually causes certifications to lapse between audits?

Certifications lapse between audits because the controls, processes, and accountabilities that were in place during the initial audit gradually erode without anyone noticing. Staff leave, processes change, tools are replaced, and responsibilities shift. Each of these changes creates a gap between what your documentation says and what your organisation actually does. That gap is what auditors find.

The most common root causes of certification drift include:

• Staff turnover: When the person who owned a control leaves, that control often becomes unowned. No one picks it up formally, and it quietly stops functioning.
• Process changes without governance updates: A new supplier is onboarded, a system is migrated, or a workflow is redesigned. If the relevant risk assessments, contracts, and procedures are not updated to match, the documentation becomes fiction.
• Lack of internal audit rhythm: Many organisations treat internal audits as a pre-certification exercise rather than a standing practice. Without regular internal checks, drift goes undetected until the external auditor surfaces it.
• Management disengagement: Certifications are often driven by a project team or a compliance officer. Once the certificate is on the wall, management attention moves elsewhere. Governance without management ownership loses its teeth quickly.

The underlying pattern is always the same: governance is treated as an event rather than a system. Continuous governance exists precisely to prevent this pattern from taking hold.

What does ‘staying certified’ actually require on an ongoing basis?

Staying certified requires maintaining active, demonstrable conformance with the standard’s requirements at all times, not just during audit windows. For frameworks like ISO 27001, this means operating your information security management system continuously, reviewing it regularly, and being able to show evidence of that operation on any given day, not just when the auditor arrives.

In practical terms, ongoing certification requires:

• Operational controls that actually run: Access reviews, vulnerability scans, supplier assessments, and incident response procedures must be executed on their defined schedules, not staged for audits.
• A functioning management review cycle: Leadership must formally review the management system at defined intervals, with documented outputs. This is a hard requirement under most ISO standards, and a common finding when it is treated as a formality.
• Continuous risk management: The risk register must reflect the organisation’s current reality. Risks change as the business evolves, and a static risk register is a red flag for any experienced auditor.
• Corrective action follow-through: Nonconformities identified in internal audits or previous external audits must be closed out with evidence, not just noted and forgotten.

What staying certified does not require is perfection. Auditors understand that organisations encounter problems. What they look for is whether the management system detected the problem, responded appropriately, and improved as a result. That cycle of detection, response, and improvement is the heartbeat of a living governance system.

How do you keep evidence and documentation audit-ready year-round?

Keeping evidence and documentation audit-ready year-round means building evidence generation into your regular operations rather than assembling it retrospectively before an audit. When evidence is produced as a byproduct of how you actually work, it is always current, always accurate, and never a scramble to produce.

Make evidence generation part of normal operations

Every control in your management system should produce a natural output. An access review produces a log. A supplier assessment produces a completed questionnaire and a decision record. A management meeting produces minutes that reference the management system. If a control is running properly, the evidence exists automatically. If you find yourself creating evidence specifically for an audit, that is a signal the control is not genuinely embedded.

Maintain a living document register

Documentation that is not actively maintained becomes a liability. Policies, procedures, and risk assessments should have defined review dates, assigned owners, and a version history that reflects real updates. A document last reviewed two years ago tells an auditor that the system is not being actively managed, regardless of what the document says. Build document reviews into your annual governance calendar so they happen on schedule, not in a panic.

One practical approach is to align your internal documentation review cycle with your surveillance audit schedule, so that by the time the external auditor arrives, every document has been reviewed and updated within the preceding twelve months.

What’s the difference between a surveillance audit and a recertification audit?

A surveillance audit is a lighter, periodic check conducted between certification cycles to verify that the management system is still operating as intended. A recertification audit is a full reassessment of the entire management system conducted at the end of a certification cycle, typically every three years. Both matter for maintaining your certificate, but they differ significantly in scope and what they require from you.

Surveillance audits

Surveillance audits are usually conducted annually in years one and two of a three-year certification cycle. They are scoped to focus on specific areas of the management system rather than reviewing everything. Auditors will typically look at internal audit results, corrective actions, management review outputs, and a selection of operational controls. The goal is to confirm that the system is alive and functioning, not to re-examine every clause. A surveillance audit finding that is not addressed can result in suspension of the certificate.

Recertification audits

Recertification audits in year three are essentially a fresh certification assessment. The auditor will review the entire scope of the management system, including all clauses of the standard, the full risk register, and the organisation’s performance over the preceding three years. Organisations that have maintained genuine continuous governance throughout the cycle typically find recertification straightforward. Organisations that coasted between surveillance audits often discover that three years of accumulated drift is very difficult to address in the weeks before the audit.

Should you manage certification continuity in-house or with external support?

Whether to manage certification continuity in-house or with external support depends on whether your organisation has the dedicated capacity, certified expertise, and cross-domain knowledge to operate a management system continuously without it competing with other priorities. For many scale-ups and mid-market organisations, the honest answer is that it does not.

Managing certification continuity in-house works well when you have a dedicated governance function with qualified staff, clear role ownership across the business, and a management culture that actively supports the system. In that context, external support is a useful complement rather than a necessity.

External support becomes the more practical choice when governance expertise is concentrated in one or two individuals, when staff turnover creates continuity risk, or when the scope of your obligations spans multiple frameworks simultaneously. ISO 27001, GDPR, NIS2, and the EU AI Act each carry their own requirements, and managing them as separate workstreams is both inefficient and prone to gaps.

A hybrid model, where certified external expertise operates alongside your internal team, addresses the continuity risk directly. It removes the dependency on any single individual and ensures that governance keeps running even when internal priorities shift. Our Governance-as-a-Service model is built around exactly this principle: combining certified human expertise with structured tooling so that governance operates as a permanent organisational capability rather than a function that depends on whoever happens to be available.

How can you tell if your certification is at risk before the auditor does?

Your certification is at risk when the gap between your documented management system and your actual operations has grown wide enough that an auditor would identify it as a nonconformity. You can spot this risk yourself by looking for specific warning signs that consistently appear before audit findings do.

The clearest indicators that your certification may be at risk include:

• Overdue internal audits: If your internal audit schedule has slipped or internal audits are being conducted as a formality without genuine findings, you are flying blind.
• Unresolved corrective actions: Open corrective actions from previous audits that have not been closed out with evidence are a direct finding waiting to happen.
• Unowned controls: If you cannot immediately name the person responsible for each control in your framework, some of those controls are likely not running.
• Documentation that predates significant business changes: If your organisation has grown, restructured, or changed its technology stack since your last documentation review, your risk register and procedures may no longer reflect reality.
• No management review in the past twelve months: This is a mandatory requirement under most ISO standards and one of the first things an auditor checks.

The most reliable early warning system is a structured internal audit programme that runs independently of external audit pressure. When your internal audit process is genuinely functioning, it surfaces the same issues an external auditor would find, but with enough time to address them properly. Continuous governance means the internal audit cycle never stops, which means risk is visible and manageable rather than hidden until it becomes a finding.

If any of these warning signs look familiar, it is worth acting before the auditor’s visit rather than after. Contact us to find out how we can help you build the kind of continuous governance that keeps your certification secure between every audit cycle.

Related Articles

• How does a governance framework address AI-related risks?
• What happens when your entire compliance function depends on one overwhelmed person?
• What is a governance framework and what does it include?
• When should a scale-up start implementing governance?
• Why is getting a stable ISO 27001 baseline so hard in a fast-changing organization?