Skip to content 
Überwachungsaudit und Rezertifizierung
An ISO certificate on the wall says little if nobody checks whether the processes behind it are still being practiced. That is exactly what surveillance audits and recertification are for. Anyone choosing a service provider for data erasure or disposal should know what these terms mean and how to recognize a valid certificate.
In brief
Surveillance audits and recertification are the checks with which a certification body keeps an eye on a management system after initial certification. Surveillance audits take place at least once per calendar year; recertification renews the certificate after the three-year cycle. For customers, both show that standards such as ISO 9001 or ISO/IEC 27001 were not met just once but on an ongoing basis.
How the certification cycle works
Management systems according to ISO standards are audited by independent certification bodies. How these bodies must work is regulated by the standard ISO/IEC 17021-1. It sets a cycle of three years.
| Phase | When | What is audited |
|---|---|---|
| Initial certification | Year 0, in two stages | Documentation and full implementation of the management system |
| 1st surveillance audit | no later than 12 months after the certification decision | Selected areas, handling of earlier nonconformities, effectiveness |
| 2nd surveillance audit | in the following calendar year | Further areas, continual improvement |
| Recertification | before the certificate expires | The entire system; the result is a new certificate for three years |
A surveillance audit is shorter than a recertification and does not check every detail. Over the cycle, however, all essential areas are to be covered. If the body finds serious nonconformities, it can suspend or withdraw the certificate.
How to recognize a reliable certificate
- Validity: The certificate shows the issue date and expiry date. An expired certificate is no longer proof.
- Scope: It describes which sites and activities are certified. Does it match the service you are commissioning?
- Certification body: Reputable bodies are accredited for the respective standard, in Germany by the DAkkS. More on this in the entry Accreditation of certification bodies.
- Standard version: When a standard is revised, there are transition periods after which certificates must have been converted to the new version.
A list of further checking questions for selecting a service provider can be found in our guide Choosing an ITAD provider.
Distinction
An internal audit is carried out by the company itself and is part of every ISO management system. Surveillance audits and recertification, by contrast, are external audits by the certification body. A Data protection audit checks compliance with data protection law and is not tied to a certification cycle. For supplier audits, the rules agreed between customer and service provider apply.
Rule of thumb: Don't just ask "Are you certified?" but "Until when, for which scope and by whom?"
Surveillance audits at Second IT
Second IT is certified to ISO 9001, ISO 14001, ISO 45001 and ISO/IEC 27001 , as well as for data carrier destruction according to DIN 66399 (H-5) and as a certified waste management company under § 56 KrWG. The certificates are audited annually by independent testing bodies; at least three external audits take place per year. How Second IT organizes confidentiality and data protection can be read at Data secrecy and confidentiality.
Frequently asked questions about surveillance audits and recertification
How often do surveillance audits take place?
According to ISO/IEC 17021-1, at least once per calendar year, except in the year of recertification. The first surveillance audit must take place no later than twelve months after the certification decision.
What happens if recertification does not take place in time?
Then the certificate expires. For a limited time, the certification body can allow reinstatement if open points are resolved. Until then, the certificate is not valid proof.
How do I check whether a certificate is genuine and valid?
Pay attention to the expiry date, scope and issuing body. Many certification bodies offer an online lookup. If in doubt, ask the body directly using the certificate number.
Is a surveillance audit as extensive as a recertification?
No. A surveillance audit is shorter and does not check every detail. Over the cycle, however, all essential areas are to be covered. Recertification, by contrast, checks the entire system and ends with a new certificate for three years.
Can a certificate be suspended or withdrawn?
Yes. If the certification body finds serious nonconformities during an audit, it can suspend or withdraw the certificate. That is why, besides the expiry date, it is also worth asking whether the certificate is currently still valid.
Audited processes for erasure, destruction and disposal.
Send us your device list. You will receive your offer in 48 hours on average.