Some enterprises assume that “having ISO certification” is the end of the matter: they put the certificate in a drawer and forget the schedule. In fact, an ISO certificate is not a one-time document valid forever. It is tied to a cycle, which includes required audits to keep it valid. If these audits are ignored, the certificate can be suspended just when it is needed for a tender or for a client.
Quick answer: under the general principles, an ISO certification cycle typically lasts 3 years, including the initial certification audit, surveillance audits in year 1 and year 2, and a recertification audit before the cycle ends. The audits, the granting, the surveillance and the recertification are carried out independently by the certification body (CB), which is different from the consultancy that builds the system.
What audits does the 3-year cycle include?
Under the general principles of ISO/IEC 17021-1, the standard that sets requirements for bodies auditing and certifying management systems, a typical certification cycle includes:
| Stage | What happens | When |
|---|---|---|
| Initial certification audit | Stage 1 audit (document review and readiness) and Stage 2 audit (on-site assessment) | Before the certificate is granted |
| Year 1 surveillance audit | Confirms the system is still operating; handles nonconformities (if any) | Within 12 months from the date of the certification decision |
| Year 2 surveillance audit | Similar to year 1; continues to monitor the system | The second year of the cycle |
| Recertification audit | Comprehensive re-audit of the system; decides whether to continue into a new cycle | Before the 3-year cycle ends |
A new cycle starts again from the beginning after recertification. The specific schedule (surveillance dates and recertification date) is set by the certification body in its contract with each client, and is usually counted from the date of the initial certification decision, not the date of signing the consulting contract or the date of filing the dossier.
Why you cannot “have ISO and then leave it”
A surveillance audit exists to confirm that the management system is still genuinely running, not just a dossier submitted once. Some consequences of missing the schedule:
- Surveillance audit not carried out on time: the certification body may suspend the certificate until the audit is carried out.
- Nonconformities not corrected within the period: similarly, this may lead to suspension or withdrawal of the certificate.
- Certificate suspended or withdrawn: it can no longer be used as evidence in tender dossiers, contracts, or with clients who require a valid ISO certificate, even if the enterprise still holds the paper copy issued earlier.
For this reason, the certification date, the expiry date and the surveillance audit dates should be entered in the enterprise’s work calendar, linked to a specific person in charge, rather than left to “do it when the certification body reminds us”.
Three roles that should not be merged: enterprise, consultant, certification body
Under the independence principle of ISO/IEC 17021-1, system consulting and audit-and-certification should be separated, to avoid a conflict of interest (where one party both helps the enterprise “pass” and audits the part it has helped to build):
- Enterprise: operates the management system for real, creates records, carries out internal audits, and holds management reviews on schedule.
- Consultant (if engaged): supports process development, training, and guidance on correcting nonconformities. It does not certify.
- Certification body (CB): audits independently, and decides on granting, surveillance, suspension, withdrawal or recertification. It operates once it has registered to carry out certification activities as prescribed.
If a firm both presents itself as a “full-service consultant” and promises to “issue the certificate itself” for a client it advises, without an independent audit by a separate CB, this is a sign to ask questions clearly before signing, because it does not follow the independence principle above.
A specific cycle example
An enterprise is granted its first ISO 9001 certificate in March. Under the general principles above, the 3-year cycle of this enterprise is typically arranged as follows:
| Time | What to do |
|---|---|
| March, year 1 | The certification decision is made after completing the Stage 1 and Stage 2 audits |
| Within 12 months afterwards (around March, year 2) | First surveillance audit |
| Around March, year 3 | Second surveillance audit |
| Before March, year 4 (before the 36 months end) | Recertification audit; a new 3-year cycle opens if the audit is passed |
If the enterprise misses the first surveillance audit (for example because of production pressure, or because the ISO contact person changes without handing over the schedule), the certification body may remind it, extend it on conditions, or suspend the certificate, depending on the degree of delay and the contract terms. This is why the surveillance schedule should be followed proactively by the enterprise, not only waiting for the certification body to remind it.
What to check before signing a certification contract
- Whether the certification body is registered to carry out certification activities as prescribed. For how to look this up, see the article How to check whether an ISO certificate is genuine or fake.
- Whether the expected certificate will be backed by an accreditation body, for example the Bureau of Accreditation (BoA) in Vietnam, or a foreign accreditation body that belongs to the IAF MLA mutual recognition arrangement. Export clients and multinational groups often accept only accredited certificates.
- Whether the contract clearly states the 3-year cycle schedule and the expected dates of the year 1 surveillance, year 2 surveillance and recertification, to avoid being notified only when the date arrives.
- If you are moving from ISO 9001:2015 to ISO 9001:2026, whether the certification body is ready to audit against the new edition, and whether the transition plan is included in the upcoming surveillance or recertification schedule. Avoid stacking both tasks (an expiring certificate and a version change) into the same urgent period.
Common misunderstandings about the certification cycle
- Thinking that “3-year certification” means nothing needs to be done until year three. In fact, two surveillance audits take place within those three years; it is not “silence until year three”.
- Taking the first-year certificate and using it for all three years without keeping the surveillance schedule. If the certificate is suspended mid-cycle, the paper issued earlier no longer reflects the current status, and a partner or tender party checking the certificate status will still see it as suspended.
- Waiting for the certification body to contact you before arranging surveillance. Some contracts place the responsibility for booking the schedule on the client; do not assume the certification body will always remind you in advance.
- Confusing extension of validity with recertification. Recertification is a substantive audit (not just a renewal procedure). It can identify nonconformities that must be corrected before a new cycle is granted, so it should be prepared for like an audit, not treated as “pay the fee and it’s done”.
- Changing certification body in the middle of a cycle without asking how it will be handled. A change of certification body usually requires review of the previous audit records and may affect the current cycle milestones; ask the new certification body how it will accept the previous records before deciding to change.
What Thái Tín supports
We receive the request and, together with the enterprise, review the current certification dates, cycle and scheduled surveillance and recertification audits (if the enterprise already holds a certificate), or set up a 3-year tracking schedule from the start if it does not yet have one. For enterprises that need an accredited certificate (BoA or a foreign accreditation body under IAF MLA) to meet export client requirements, we connect them with a suitable certification body and, where needed, a consultancy to prepare the system. The audits, and the decisions to grant, surveillance and recertify, are made independently by the certification body; we act as the coordinating point. See also ISO 9001 certification: what an enterprise needs to prepare, ISO certification scope and ISO, standards and certification services.
Questions and answers
How long is an ISO certificate valid?
Under the general principles of ISO/IEC 17021-1, the certification cycle for a management system is typically 3 years from the date the initial certification decision is made. Periodic surveillance audits take place within the cycle; at the end of the cycle, a recertification audit is carried out to continue into a new cycle. The specific schedule is set by the certification body in its contract with each client.
What is a surveillance audit, and is it mandatory?
A surveillance audit is a periodic audit within the certification cycle (typically in year 1 and year 2 of the 3-year cycle), to confirm that the management system is still operating and meets the requirements of the standard. It is a condition for the certificate to remain valid; failing to carry out a surveillance audit on time may lead to suspension of the certificate.
What happens if a surveillance or recertification audit is missed?
The certification body may suspend or withdraw the certificate if the enterprise does not carry out a surveillance audit on time, or does not correct nonconformities within the prescribed period. A suspended or withdrawn certificate can no longer be used as evidence in tender dossiers or with clients who require a valid ISO certificate.
Can an ISO consulting firm also certify the company?
No. Under the independence principle of ISO/IEC 17021-1, the body that audits and certifies must be independent of the consulting activity that builds the system for the same client. The consultant supports system development, training and corrective guidance; the certification body (CB) is the party that independently audits and decides on granting, surveillance and recertification.
How can you tell whether a certification body is authorised to operate in Vietnam?
A certification body operating in Vietnam is one that has registered to carry out certification activities as prescribed. If a tender dossier or a client requires an accredited certificate, the enterprise can ask the certification body which accreditation body has accredited it, for example the Bureau of Accreditation (BoA, Văn phòng Công nhận Chất lượng Quốc gia) in Vietnam, or a foreign accreditation body that belongs to the IAF MLA mutual recognition arrangement.
Legal basis · verification date
Verified 2 October 2026 · next review 29 December 2026. The content is general guidance and does not replace advice for a specific case.
- ISO/IEC 17021-1:2015 Conformity assessment: Requirements for bodies providing audit and certification of management systems, Part 1 (principles of the certification cycle, surveillance audits, recertification audits, and the independence between consultancy and certification) (iso.org/standard/61651.html). The 2015 edition is the current edition; no replacement had been issued as of 02/10/2026. This article uses the general principles and does not cite specific article numbers.
- ISO 9001:2026 Quality management systems: Requirements, published 16/9/2026, replacing ISO 9001:2015; a 3-year transition period applies, and ISO 9001:2015 certificates expire after 30/9/2029 according to notices from certification bodies (iso.org; dnv.com, accessed 29–30/9/2026).
- Law on Standards and Technical Regulations No. 68/2006/QH11 (Luật Tiêu chuẩn và quy chuẩn kỹ thuật), amended and supplemented by Law No. 70/2025/QH15 (in force 01/01/2026): a standard is a voluntary document for application, which differs from a mandatory technical regulation.
- boa.gov.vn, Functions and tasks page (accessed 30/9/2026): the Bureau of Accreditation (BoA, Văn phòng Công nhận Chất lượng Quốc gia) is a full member of APAC, ILAC and IAF, and signs MLA/MRA arrangements for the accreditation of certification bodies for management systems and products.
