Year Three Is Not Just a Bigger Surveillance Audit

The assumption that catches people out

Most manufacturers who sail through year one and year two get a nasty surprise in year three. The audit takes longer, the questions feel different, and documents that passed without comment are suddenly being pulled apart. The usual explanation is bad luck or a difficult auditor. It rarely is.

The gap is almost always a misunderstanding of what recertification actually involves, and how it differs from the surveillance visits that preceded it.

What a surveillance audit is actually doing

A surveillance audit is a check that your system is still alive. The auditor is sampling. They will typically look at a subset of your processes, review a handful of corrective actions, confirm your internal audit programme is running, and check that management reviews are happening. It is not a full examination. It is closer to a pulse check.

That means a well-organised business can pass surveillance without the wider system being in great shape. You just need the right things in order for the areas being sampled on that particular day.

What changes at recertification

Recertification covers the entire scope. Every clause, every process, the full internal audit cycle for the three-year period. The auditor is not sampling. They are assessing whether your system has been effectively operated and genuinely improved over three years.

Three things tend to catch people out.

The improvement story. At recertification, the auditor wants to see a thread from your objectives three years ago to your results today. Not a list of completed actions, but evidence that you identified what needed to get better, did something about it, and measured whether it worked. If your quality objectives have been copy-pasted year on year with no real movement, that will surface.

The internal audit record. Surveillance visits might only examine one or two recent audits. Recertification looks at whether you actually completed a full audit programme across all processes and clauses over the full cycle. Gaps are common, especially on support functions that nobody finds interesting to audit.

Corrective action closure. Every nonconformity raised during the certification period should be properly closed, with root cause identified and effectiveness verified. Some companies close the paperwork but never check whether the fix actually worked. That shortcut tends to show up at year three.

How to prepare differently

The practical difference is in timing. Surveillance preparation is typically a few weeks of tidying. Recertification preparation should start at month eighteen to twenty-four of the cycle.

By month eighteen, you should be reviewing whether your objectives still mean anything and whether the data you have collected actually supports a decision. By month twenty-four, your internal audit plan should show coverage across the whole system, not just the easy areas.

The management review scheduled before recertification matters more than any other in the cycle. Auditors read management review minutes carefully at year three. They are checking whether the people running the business are actually using the management system as a tool, or treating it as a compliance exercise.

A useful exercise at month twenty-four is to walk through your system as if you were the auditor. For every process, ask: do we have evidence this ran continuously? Do we have records of problems being raised and resolved? Can we show this process has improved? If the answer to any of those is uncertain, you have found your preparation gap.

The mindset shift

Surveillance keeps the system ticking. Recertification tests whether the system has been worth having.

That is a different question, and it deserves a different kind of preparation. The companies that handle year three comfortably are usually the ones that have been using their management system throughout the cycle, not just in the run-up to visits.

If your current approach is mostly reactive, the waste analysis tool at https://losses.cadencestandard.com is a reasonable starting point for identifying where your processes are losing time and quality without obviously failing. The patterns it surfaces often map directly onto the areas that underperform at audit.

For teams that want a more structured route through the three-year cycle, the /six/ programme gives you a framework that builds the kind of continuous evidence trail recertification auditors are looking for, rather than treating audits as one-off events to prepare for and then forget.