Recertification audit timing: how to stop certificates lapsing
When to schedule a recertification audit so certificates never lapse: ISO/IEC 17021-1 expiry rules, the 6-month restoration window and a planning timeline.
A recertification audit must be planned and conducted early enough to renew certification before the expiry date, in the third year of the cycle. Under ISO/IEC 17021-1:2015, if the audit is not completed, or corrections and corrective actions for any major nonconformity are not verified before expiry, recertification is not recommended. Certification can be restored within 6 months of expiry; after that, at least a stage 2 is needed.
Key takeaways
- The recertification audit sits in the third year and must leave time to close major nonconformities before expiry.
- If everything is completed before expiry, the new cycle's expiry date can run on from the existing one.
- After expiry, the certificate can be restored within 6 months if the outstanding activities are completed; after that, at least a stage 2 audit is needed.
- Recertification audit time is about two thirds of a freshly calculated initial audit, so client data must be refreshed first.
When should a recertification audit take place?
A recertification audit takes place in the third year of the certification cycle, before the certificate expires. ISO/IEC 17021-1:2015 clause 9.6.3.1.1 says it should be planned and conducted in due time to enable timely renewal before the expiry date. The standard sets no fixed number of weeks. Your procedure has to decide how early is early enough.
The real deadline is earlier than the expiry date. Before expiry, the certification body must complete the audit, verify corrections and corrective actions for any major nonconformity and take the recertification decision. Each of those steps takes time, and the client controls some of it.
What happens if the recertification audit is late?
Clause 9.6.3.2.4 is blunt. If the certification body has not completed the recertification audit, or cannot verify the implementation of corrections and corrective actions for any major nonconformity before the expiry date, recertification shall not be recommended. The certificate lapses on its expiry date.
Clause 9.6.3.2.5 gives a way back. Following expiration, the certification body can restore certification within 6 months, provided the outstanding recertification activities are completed. Otherwise, at least a stage 2 audit must be conducted. European co-operation for Accreditation guidance confirms that once 6 months have passed without completing all recertification activities, including the decision, the client is treated as new, though a stage 1 is not required.
| Completed | Certificate status | Next cycle |
|---|---|---|
| Before expiry, majors verified | Continuous | Expiry can be based on the existing expiry date (9.6.3.2.3) |
| After expiry, within 6 months | Lapsed, then restored | Outstanding activities completed; the client had a gap without valid certification |
| More than 6 months after expiry | Lapsed | At least a stage 2 audit before certification (9.6.3.2.5) |
Restoration is a safety net. Between expiry and restoration the client has no valid certificate, and that gap can cost them tenders and customer approvals. Clients remember who let it happen.
How far ahead should you schedule a recertification audit?
Work back from expiry. Allow for the time the client needs to answer a major nonconformity, the time the auditor needs to verify it (sometimes a follow-up visit), and the time for the certification decision. One published certification body procedure plans the recertification audit 90 to 120 days before expiry for exactly this reason. Choose your own figure, write it into your procedure and plan to it.
- 1Planned recertification audit
- 2Latest date that leaves time for majors
- 3Certificate expiry
- 4End of 6-month restoration window
The latest safe date depends on your own closure times. If your procedure gives clients a set period to correct a major nonconformity, add your verification and decision time and subtract the total from the expiry date.
A recertification audit planning timeline
This is a practical timeline for a single client, working back from an expiry date. The months are suggestions to adapt to your procedure and sector.
- Expiry minus 9 monthsRefresh client dataConfirm headcount, sites, shifts, scope and any significant changes. Recalculate audit time.
- Expiry minus 7 monthsDecide the audit shapeCheck whether significant changes need a stage 1 element and whether the auditor team needs to rotate.
- Expiry minus 6 monthsAgree the dateOffer dates in the target band. Book the team and any technical expert.
- Expiry minus 3 to 4 monthsRecertification auditReview previous surveillance reports and the system's performance over the whole cycle.
- Before expiryClose and decideVerify corrections and corrective actions for majors; take the recertification decision.
- Up to 6 months after expiryRestoration onlyComplete the outstanding activities, or plan at least a stage 2 after that point.
How long is a recertification audit?
For QMS, EMS and OH&S, IAF MD 5:2023 says recertification audit time should be calculated on the updated information about the client and is normally about two thirds of the time an initial audit (stage 1 plus stage 2) would need if it were carried out at the time of recertification. The anchor is the organisation as it is today.
Example: a client certified with 200 effective personnel now has 320. The recalculated initial time moves from the 176 to 275 band (9 days in Table QMS 1) to the 276 to 425 band (10 days). After the same documented adjustments, two thirds of the new figure is the basis for the recertification audit. See IAF MD 5 audit time for the full method.
For multi-site clients, the recertification sample returns to the square root of the number of sites, or 0.8 times it where the system has proved effective. See IAF MD 1 multi-site sampling.
Common recertification audit mistakes
MythThe recertification audit can be booked in the expiry month.
RealityOnly if no major nonconformity is raised. Any major must be corrected and verified before expiry, or recertification is not recommended.
MythRecertification time is two thirds of the original initial audit.
RealityIt is about two thirds of an initial audit calculated on the client's current information.
MythA lapsed certificate always means starting again with stage 1.
RealityWithin 6 months, outstanding activities can restore it. After that, at least a stage 2 is needed, without a stage 1.
Recertification also brings a new team decision. Check auditor rotation rules before reusing the same lead auditor for another cycle.
How to keep recertification audits on track across a programme
At programme level, lapses come from the same few causes: expiry dates held in a spreadsheet nobody sorts, client data not refreshed, and date requests accepted without checking the effect on the closure time. A short control list fixes most of them.
- ✓Expiry date stored on every client and every standard
- ✓Latest safe audit date calculated from your closure times
- ✓Client data refresh triggered months before the audit
- ✓Recertification time recalculated, not copied from the last cycle
- ✓Date requests checked against the latest safe date before acceptance
- ✓Monthly report of recertifications not yet booked inside their target band
Our guide to audit due date tracking covers the reporting side, and surveillance audit frequency covers the two years before recertification.
See how ScheduleAI's audit scheduling software applies these rules across a whole programme in minutes.
ScheduleAI plans each recertification audit inside a window that ends before the certificate expiry date, and flags any client date request that would leave too little time to close nonconformities, for the planner to decide.
Book a demo Estimate your savingsQuestions
When is a recertification audit due?
In the third year of the certification cycle, planned early enough to renew certification before the expiry date, including time to verify corrective action on any major nonconformity.
What happens if a certificate expires before recertification?
Recertification is not recommended and the certificate lapses. It can be restored within 6 months of expiry if the outstanding activities are completed; after that, at least a stage 2 audit is needed.
Does a restored certificate keep the same cycle?
The client still has a gap without valid certification between expiry and restoration. Check ISO/IEC 17021-1 clause 9.6.3.2.5 and your accreditation body's guidance for how certificate dates are set.
How long is a recertification audit?
For QMS, EMS and OH&S, about two thirds of the initial audit time recalculated on the client's current information, under IAF MD 5:2023.
Does a recertification audit need a stage 1?
Not normally. ISO/IEC 17021-1 says a stage 1 may be needed where there have been significant changes to the management system or its context. See stage 1 vs stage 2 audits.