ISO 27001 Recertification: What Year 3 Involves
ISO 27001 recertification is the full audit your certification body runs at the end of your three year certificate, and it must be completed before the existing certificate expires. Unlike a surveillance audit, which samples part of your information security management system, recertification reassesses the whole ISMS and asks whether it has stayed effective across the entire cycle. Plan it six months ahead, because the certificate cannot be backdated if you run out of time.
Most Australian organisations arrive at year three having treated years one and two as light touch. The surveillance audits were short, the findings were minor, and the ISMS quietly became a set of documents nobody has opened since certification. Recertification is where that catches up with you, because the auditor is no longer sampling. This guide covers what the audit examines, how to prepare, and what happens if the certificate lapses.
What happens in an ISO 27001 recertification audit?
An ISO 27001 recertification audit reassesses the entire information security management system against the standard, in the same way the original Stage 2 audit did, with one addition: the auditor also evaluates whether the ISMS has performed over the three years since certification. That means looking at trends rather than snapshots. Did risks get reviewed, did incidents get handled, did corrective actions actually close, and did management act on what the ISMS told them.
Expect the auditor to work through the management clauses, Clause 4 to Clause 10, and then sample Annex A controls across the full scope rather than the subset covered at the last surveillance visit. Expect questions that span the cycle: show me every internal audit since certification, show me the management reviews, show me the risk treatment decisions you changed and why. A recertification audit is typically longer than a surveillance audit and shorter than the original Stage 1 plus Stage 2 combination.
How is recertification different from a surveillance audit?
A surveillance audit samples; a recertification audit covers the whole management system and results in a new certificate. Surveillance audits happen in the years between certification decisions and are designed to confirm the ISMS is still operating. Recertification decides whether you keep certification at all. The practical difference for your team is preparation effort, document coverage and the consequences of a major nonconformity.
| Surveillance audit | Recertification audit | |
|---|---|---|
| When | Each year between certification decisions | Before the current three year certificate expires |
| Coverage | A sample of clauses and Annex A controls | The full ISMS and the whole certified scope |
| Evidence window | Mainly since the last visit | The full certification cycle |
| Outcome | Certificate continues | A new certificate is issued, or it is not |
| Typical duration | Shorter, often one day for a small scope | Longer, commonly close to the original Stage 2 |
| If a major nonconformity is raised | Certificate can be suspended if not closed | New certificate is withheld until it is closed |
If you have not been through the lighter version yet, our guide to the ISO 27001 surveillance audit in year two explains what the in between years look like.
When should you book the ISO 27001 recertification audit?
Book the ISO 27001 recertification audit so that the certification decision, not just the audit visit, lands before your current certificate expires. In practice that means agreeing dates with your certification body at least six months out, and holding the audit roughly two to three months before expiry. The gap matters because any nonconformity raised at the audit needs time for corrective action, evidence and review before the decision can be made.
Australian certification bodies are busiest from March to June, when both the financial year and a large share of certification cycles cluster. If your certificate expires in that window, book earlier than you think you need to. Check the expiry date on the certificate itself rather than relying on memory, because the three years run from the certification decision date, not from the day you started the project.
What evidence does a recertification auditor ask for?
A recertification auditor asks for evidence that the ISMS ran continuously, not evidence assembled in the fortnight before the audit. The giveaway is dates. Three internal audit reports all created in the same week, or a risk register whose last modified date is yesterday, tells the auditor exactly how the system has been managed. Gather the following across the full three years.
- Internal audit programme and reports covering the whole scope across the cycle, not the same two processes three times.
- Management review records with the required inputs and, critically, decisions and actions that came out of them.
- Risk assessments and the risk treatment plan, showing how risks were reviewed and what changed.
- The Statement of Applicability, current and consistent with the controls actually in place.
- Corrective actions from previous audits, with evidence they were verified as effective rather than simply marked closed.
- Security incident records and what the ISMS did in response.
- Supplier and change records if your scope, systems or third parties moved during the cycle.
The two areas that most often produce findings at recertification are internal audit coverage and management review. Both are management clause requirements, so a gap there is harder to argue down than a technical control gap. Our guides on running an internal audit that adds value and what ISO 27001 documentation is actually mandatory cover both in detail.
What happens if your ISO 27001 certificate expires?
If an ISO 27001 certificate expires before the recertification decision is made, the organisation is no longer certified from the expiry date, and certification bodies cannot backdate a certificate to cover the gap. That gap becomes visible in exactly the places you do not want it: customer security reviews, tender responses, insurance renewals and public certification registers. Some certification bodies can restore certification within a limited period after expiry if the outstanding recertification activities are completed, and others require the full initial audit sequence again. Ask your certification body for its specific rule in writing, because this varies.
The commercial consequence is usually worse than the audit cost. A lapsed certificate means answering “no” to a question you have answered “yes” to for three years, and the explanation never fits neatly into a procurement form. This is the main argument for treating the recertification date as a board level deadline rather than an IT task.
How should you prepare in the six months before recertification?
Six months is enough time to fix a neglected ISMS, and it is roughly the minimum if your internal audit programme has gaps. Work backwards from the audit date rather than forwards from today, because several of the required activities have to happen in sequence and some need evidence of operating over a period.
One practical tip: run a gap review against the current version of the standard before you run your final internal audit, not after. That ordering means the internal audit confirms your fixes rather than discovering the gaps, and it gives the auditor a clean corrective action trail to look at. An ISO 27001 gap analysis is the usual way to do this.
Does the move to ISO 27001:2022 affect recertification?
ISO/IEC 27001:2022 is the version organisations certify against today, so a recertification audit is conducted against the 2022 text and its restructured Annex A. Organisations that certified against the older 2013 version during their last cycle will have transitioned already or will be assessed against 2022 at recertification, which means the Statement of Applicability must reflect the 2022 control set and numbering rather than the old one.
The practical task is usually documentation rather than technology. Most organisations already operate the controls; what is missing is a Statement of Applicability, risk treatment plan and policy set that use the current structure. Our explainer on ISO 27001:2022, the version you certify against sets out what changed.
Common questions
How long does ISO 27001 certification last?
An accredited ISO 27001 certificate lasts three years from the certification decision, provided the organisation passes its surveillance audits in the intervening years. The certificate itself states the issue date and the expiry date, and those are the dates customers and auditors check. Certification is not permanent and does not renew automatically: a recertification audit has to be completed and a new decision made before the expiry date.
Does ISO 27001 certification expire?
Yes. ISO 27001 certification expires at the end of the three year cycle and must be renewed through a recertification audit. It can also end earlier: a certification body can suspend or withdraw certification if a major nonconformity is not resolved, if surveillance audits are not held, or if the organisation stops meeting the requirements for its certified scope. Expiry is the common case, and it is entirely avoidable with scheduling.
What is the ISO 27001 renewal period?
The renewal period is the three year certification cycle: Stage 1 and Stage 2 audits leading to certification, a surveillance audit in each of the two following years, then a recertification audit before expiry that starts the cycle again. Plan the recertification audit two to three months before the expiry date so there is room to close any nonconformity before the certification decision is due.
How do I check whether an ISO 27001 certificate is current?
Check three things on the certificate: the expiry date, the certified scope, and the accreditation mark of the body that issued it. The scope matters as much as the date, because a certificate can be current but cover a different part of the business to the one you are buying from. In Australia and New Zealand you can confirm a certification body’s accreditation through JAS-ANZ, the joint accreditation system for the two countries.
Getting ready for year three
Recertification goes smoothly when the ISMS has been used rather than stored. If yours has drifted, the fix is a honest gap review, a real internal audit and a management review that makes decisions, in that order, with enough time before the audit date for the evidence to look like what it is.
Siege Cyber helps Australian organisations prepare for recertification without rebuilding the whole management system. Our ISO 27001 services cover gap analysis, internal audit and audit support, and we can work to your certification body’s dates. Get in touch with your certificate expiry date and we will tell you what needs to happen between now and then.