On this page
- What the ISO 9001 surveillance audit requirement is, and why it exists
- Key stages of an ISO 9001 surveillance audit
- Evaluating mandatory clauses and evidence during surveillance
- Practical audit scenario and common finding resolution
- Example
- Before your audit
- Questions people ask
- What is the main purpose of an ISO 9001 audit during surveillance?
- What documents must be available during an ISO 9001 audit?
- How often must an organisation conduct an internal ISO 9001 audit?
- What happens if an auditor finds a nonconformity during a surveillance audit?
- Reference documents
The short version
- An ISO 9001 audit during surveillance checks if the quality management system remains effectively implemented, maintained, and compliant.
- External auditors evaluate internal audit results under Clause 9.2 and top management review outputs under Clause 9.3.
- Organisations must demonstrate that nonconformities trigger root cause analysis and corrective actions under Subclause 10.2.1.
- Retained documented information provides mandatory evidence that operational processes run as planned under Clause 8.1.
What the ISO 9001 surveillance audit requirement is, and why it exists
An ISO 9001 audit during surveillance is a systematic evaluation that assesses whether an organisation continues to conform to ISO 9001 standard requirements after achieving initial certification. This audit process verifies that the quality management system remains effectively implemented, maintained, and aligned with strategic organizational objectives. Certification bodies conduct these audits at planned intervals between recertification cycles to verify ongoing system performance.
The fundamental rationale behind surveillance auditing rests on performance evaluation and continual improvement. Under Clause 9.2 and Clause 9.3, organisations must regularly inspect internal processes and review quality management system outputs. Surveillance audits verify that top management actively maintains leadership and commitment under Subclause 5.1.1 while ensuring processes consistently satisfy customer, statutory, and regulatory demands under Clause 1.2.
Ongoing evaluation prevents operational drift and ensures that risk-based thinking remains embedded in daily workflows. Under Subclause 6.1.2, organisations must integrate risk control actions into system processes and evaluate their operational effectiveness. Without periodic external verification, quality objectives under Clause 6.2 and operational controls under Clause 8.1 risk becoming static, reducing the system's ability to deliver conforming products and services.
Important: Top management must participate directly during audit reviews to demonstrate ongoing leadership and accountability under Subclause 5.1.1.
Key stages of an ISO 9001 surveillance audit
Executing a surveillance audit requires external auditors to examine process controls, inspect performance records, and interview personnel systematically across selected standard clauses. Quality managers and compliance leads must guide internal teams through each stage of the audit sequence.
- Opening meeting and scope review: The auditor reviews the audit plan, confirms system boundaries under Clause 4.3, and evaluates changes in internal or external issues under Clause 4.1.
- Evaluation of performance evaluation processes: The auditor examines internal audit results under Clause 9.2, customer perception metrics under Subclause 9.1.2, and management review outputs under Subclause 9.3.3.
- Operational sampling and evidence collection: The auditor observes operational activities under Clause 8.1, reviews staff competence records under Clause 7.2, and assesses external provider controls under Subclause 8.4.1.
- Assessment of nonconformities and corrective actions: The auditor verifies whether previous nonconformities were properly controlled, analysed for root causes, and resolved through corrective actions under Subclause 10.2.1.
- Closing meeting and audit findings report: The auditor presents formal observations, highlights improvement opportunities under Clause 10.1, and recommends continued certification status.
Tip: Prepare process owners to present evidence directly using actual operational records rather than relying on memorized procedure manuals.
Evaluating mandatory clauses and evidence during surveillance
Auditors select specific operational areas and standard clauses during each surveillance visit to confirm ongoing compliance. Organisations must maintain documented information to support process operations and retain documented information to prove processes run as planned.
| Requirement | What the auditor checks | Evidence to have ready |
|---|---|---|
| Clause 4.1 & Clause 4.2 Organisational context | How the business tracks internal issues, external issues, and interested party expectations | Updated context registers, strategic reviews, and interested party requirements logs |
| Subclause 6.1.2 Risk and opportunity actions | Whether planned actions address operational risks and evaluate mitigation effectiveness | Risk assessment matrices, mitigation plans, and risk review meeting records |
| Clause 7.1.5 Monitoring and measuring resources | Traceability and calibration status of equipment used to verify product or service conformity | Calibration certificates, verification logs, and equipment identification tags |
| Clause 8.1 & Clause 8.5 Operational control and service provision | Implementation of planned process criteria, output identification, and product preservation | Process control plans, batch traceability records, and release sign-offs |
| Subclause 8.7.2 & Subclause 10.2.2 Nonconformities and corrective action | Documentation of nonconforming outputs, root cause analysis, and corrective action review | Nonconformity reports, root cause logs, and corrective action effectiveness files |
| Clause 9.2 & Clause 9.3 Internal audit and management review | Execution of internal audit programmes and management evaluation at planned intervals | Internal audit schedules, audit reports, and signed management review minutes |
Common finding: Organisations frequently fail to update risk registers under Clause 6.1 after operational changes occur, resulting in major nonconformities during surveillance visits.
Practical audit scenario and common finding resolution
Example
During an ISO 9001 surveillance audit at an engineering component plant, the external auditor evaluated Subclause 8.4.1 regarding externally provided processes, products, and services. The auditor noticed that the purchasing department procured critical raw materials from a new external provider without performing an evaluation against established selection criteria. Furthermore, the organisation retained no documented information demonstrating supplier re-evaluation as required by Subclause 8.4.1. The compliance lead logged a nonconformity under Subclause 10.2.1, performed a root cause analysis that revealed inadequate purchasing software controls, and introduced mandatory sign-off workflows. When the auditor returned to verify corrective action effectiveness, the organisation demonstrated complete supplier evaluation records and updated procurement logs.
Note: Organisations may adjust the frequency and scope of internal audits based on process importance, operational changes, and previous audit results under Subclause 9.2.2.
Before your audit
- Verify that internal audit programmes are completed and reported to relevant management under Clause 9.2.
- Confirm that top management review outputs are documented and actioned under Clause 9.3.
- Check that nonconformity records include root cause evaluations and corrective action reviews under Subclause 10.2.1.
- Ensure measuring equipment calibration records are updated and traceable under Subclause 7.1.5.2.
- Inspect competence records and training evidence for operational personnel under Clause 7.2.
- Confirm external provider evaluation and re-evaluation records are retained under Subclause 8.4.1.
- Review quality policy awareness and quality objective progress metrics across relevant functions under Clause 6.2.
- Retain documented information verifying that product and service releases meet acceptance criteria under Subclause 8.6.
Questions people ask
What is the main purpose of an ISO 9001 audit during surveillance?
An ISO 9001 audit during surveillance verifies that an organisation maintains its quality management system effectively between recertification cycles. The auditor evaluates ongoing compliance with standard requirements, process performance, and corrective action effectiveness.
What documents must be available during an ISO 9001 audit?
Organisations must maintain documented information defining the system scope, quality policy, and quality objectives. They must also retain records of internal audits, management reviews, supplier evaluations, equipment calibration, competence, and nonconformities.
How often must an organisation conduct an internal ISO 9001 audit?
Under Subclause 9.2.2, organisations must conduct internal audits at planned intervals defined within their audit programme. The schedule must consider the importance of the processes concerned, operational changes, and the results of previous audits.
What happens if an auditor finds a nonconformity during a surveillance audit?
When a nonconformity occurs, the organisation must react under Subclause 10.2.1 by taking action to control and correct it. Compliance leads must evaluate the need to eliminate root causes, implement corrective actions, and retain documented evidence of their effectiveness.
Reference documents
- ISO 9001:2015 Quality management systems — Requirements
Manage this work in 4Auditee
Keep audit plans, problems, corrective actions and document versions in one place. See the records behind each change and decision.
Book a demo