The ISO/IEC 17011 accreditation cycle and how to schedule it
The ISO/IEC 17011 accreditation cycle explained for planners: the five year limit, the two year on-site rule, risk-based programmes and how to schedule them.
Key takeaways
- The cycle is capped at five years from the accreditation decision, even when a CAB is suspended.
- The two year limit between on-site assessments is the constraint that most often shapes the calendar.
- The assessment programme is risk-based, so the number and timing of visits can differ between CABs.
- Witnessing and scope coverage run on top of the visit calendar and need their own tracking.
Under ISO/IEC 17011:2017, an accreditation cycle must not be longer than five years, and reassessment must be completed before the cycle ends. Within the cycle, the accreditation body runs a risk-based assessment programme, and the time between consecutive on-site assessments should not exceed two years unless the body determines on-site assessment is not applicable, for example after a force majeure event.
What is the ISO/IEC 17011 accreditation cycle?
The ISO/IEC 17011 accreditation cycle is the period over which an accreditation body assesses a conformity assessment body (CAB) across its whole scope before reassessing it. ISO/IEC 17011:2017, clause 7.9.1, says a cycle shall not be longer than five years. The ILAC/IAF FAQs on the standard explain that the cycle begins at or after the date of the decision to grant accreditation, or the decision after reassessment, and that reassessment has to be completed before the cycle ends.
For an accreditation body with hundreds of certification bodies, inspection bodies and laboratories, each on its own cycle, those rules become a scheduling problem: every CAB needs a programme of activities that fits the limits, covers the scope and matches assessors to technical areas. This article covers the 2017 edition; check whether a newer edition applies when you read it.
How does an accreditation cycle run?
Each cycle follows the same loop. The programme set at the start is reviewed after each activity, because findings, scope extensions and changes at the CAB shift the risk picture.
- Decisiongrant or reaccreditation starts the cycle
- Programmerisk-based plan of activities
- Surveillanceon-site, office and witnessing
- Scope changesextensions and reductions assessed
- Reassessmentcompleted before the cycle ends
The ILAC/IAF FAQs also note that the five year limit applies whatever the CAB's status: a suspension does not stretch the cycle. Decisions should be taken without undue delay after assessment.
What does the two year on-site rule mean for scheduling?
Clause 7.9.3 sets the constraint planners feel most. The ILAC/IAF FAQs summarise it: the time between consecutive on-site assessments shall not exceed two years, unless the accreditation body determines that on-site assessment is not applicable. The FAQs give force majeure, health or security crises and virtual sites as examples, and say remote techniques must then achieve the same objectives.
The limit counts from the last on-site assessment, not from the anniversary of accreditation. If an on-site visit slips by three months, the next on-site window moves with it, and the whole remaining cycle has less room. Many accreditation bodies run annual surveillance by policy, which gives a buffer inside the two year limit. Plan to your own published rules as well as the standard.
| Year | Activity | On-site gap check |
|---|---|---|
| 0 | Initial assessment and accreditation decision | Cycle starts at the decision |
| 1 | Surveillance on-site, one witness | Within 2 years of the initial on-site visit |
| 2 | Office review and witnessing only | Next on-site due by the end of year 3 |
| 3 | Surveillance on-site, scope extension | Within 2 years of year 1 |
| 4 to 5 | Reassessment on-site, completed before the cycle ends | Within 2 years of year 3; new cycle from the decision |
Build the programme with a margin: if the year 3 visit slips, the year 1 date still sets the latest date for the next on-site assessment.
How risk shapes the assessment programme
Clause 7.9.2 expects each CAB's programme to reflect risk. In practice that means more frequent or longer activities for CABs with a wide or complex scope, previous significant findings, many sites or recent changes, and lighter programmes for stable, narrow scopes. The ILAC/IAF FAQs accept that the first risk-based programmes may rest on assumptions that are refined as evidence builds up.
For planners, risk turns into variables: the number of on-site days, the number of witnesses, the sampling of sites and technical areas, and the assessor mix. Record the reason for each programme decision so assessors, reviewers and peer evaluators can follow it.
MythISO/IEC 17011 requires annual surveillance.
RealityThe standard sets a five year cycle and a two year maximum between on-site assessments. Annual surveillance is common accreditation body policy.
MythRemote assessment can replace on-site assessment when convenient.
RealityThe ILAC/IAF FAQs limit it to situations such as force majeure, crises or virtual sites, and require the same objectives to be met.
MythA suspended CAB's cycle pauses until it is reinstated.
RealityThe five year limit applies regardless of the CAB's accreditation status.
What sits on top of the ISO/IEC 17011 accreditation cycle?
Scheme and sector documents add coverage rules that run inside the cycle. For management system certification bodies, IAF MD 17 sets witnessing by technical cluster and critical code. For laboratories, ILAC P9 requires the accreditation body to take proficiency testing performance into account when planning assessments. For inspection bodies, ILAC P15 applies ISO/IEC 17020, and transitions such as ISO/IEC 17020:2026 add assessments that UKAS, for example, runs at scheduled annual visits.
Each adds a tracker: witnessing coverage, method coverage, transition status. Keep them in the same system as the visit calendar so one change updates all of them. See witness assessment planning, ISO/IEC 17025 assessment scheduling and ISO/IEC 17020 inspection body requirements.
How should an accreditation body schedule the cycle?
Plan at two horizons. A five year programme per CAB sets the shape; a rolling 6 to 12 month plan across all CABs books the dates, assessors and travel.
- Load every CAB's cycleDecision date, cycle end, last on-site date and next latest on-site date.
- Set the programmeRisk-based activities per year, with witnessing and scope coverage targets.
- Pull the rolling horizonAll activities due in the next 6 to 12 months, sorted by latest date.
- Match assessorsLead assessor and technical assessors competent for the scope, with no conflicts.
- Agree dates with CABsOffer windows early; for witnesses, request the CAB's forward programme.
- Re-plan on changeWhen a visit moves, recalculate the next on-site limit and the reassessment date.
Assessor competence tracking works like a competence matrix, and conflicts follow the logic in impartiality and conflict of interest checks.
Where does scheduling software help?
The hard part is scale: many CABs, overlapping cycles, the two year on-site constraint, scope coverage, witnessing and a limited pool of technical assessors. A scheduling engine can hold each cycle's limits as constraints, propose the rolling plan and show the knock-on effect before a visit is moved. ScheduleAI supports accreditation bodies this way, with planners approving every change. See how constraint-based scheduling works.
ScheduleAI is the audit scheduling software certification bodies use to plan ISO programmes from stage 1 to recertification.
ScheduleAI holds each CAB's cycle end, on-site limits and coverage targets as constraints, proposes a rolling assessment plan with competent assessors, and shows the effect of any moved visit before planners approve it.
Book a demo Estimate your savingsQuestions
How long is an ISO/IEC 17011 accreditation cycle?
No longer than five years, starting at or after the accreditation or reaccreditation decision. Reassessment must be completed before the cycle ends.
How often must on-site assessments take place?
ISO/IEC 17011:2017 clause 7.9.3 says the time between consecutive on-site assessments shall not exceed two years unless the accreditation body determines on-site assessment is not applicable.
Does ISO/IEC 17011 require annual surveillance?
No. Many accreditation bodies choose annual surveillance, but the standard sets the five year cycle and the two year on-site limit.
Can the cycle be extended if a CAB is suspended?
No. The ILAC/IAF FAQs confirm the five year limit applies regardless of the CAB's status.
How do witnessing requirements fit into the cycle?
They are planned inside it. For management system certification bodies, IAF MD 17 sets cluster and critical code coverage; see witness assessment planning.