ISO 45001 Surveillance and Renewal: Keeping Safety Real After Certification Day

Your ISO 45001 certificate arrived, framed, and went up on the wall. That felt like the finish line. It was not. It was the starting line of a three-year cycle, and the certification body will be back — every year — to check whether the safety system on paper still matches the factory floor.

The short answer: an ISO 45001 certificate lasts three years, but it stays valid only if you pass a surveillance audit roughly every twelve months and a full recertification audit before it expires. Surveillance audits sample the system; recertification re-examines all of it. Miss a surveillance visit or leave a major nonconformity open, and the certificate can be suspended, then withdrawn.

I have watched owners treat year two like a formality and walk into a suspension they could have avoided with a month of preparation. This guide tells you what each visit covers, what findings mean, what suspension really costs, and how to plan recertification so it never becomes a crisis.

The three-year cycle, in plain words

Certification runs on a fixed rhythm set by ISO/IEC 17021-1, the standard that governs how certification bodies audit management systems. After the initial two-stage certification audit (Stage 1 documentation review, Stage 2 on-site audit), the cycle looks like this:

The rule behind the rhythm matters: surveillance audits must happen at least once a calendar year, except in recertification years, and the first one must fall no more than twelve months after the certification decision. A certification body can shift a date by weeks to fit seasons or shutdowns. It cannot quietly skip a year.

Think of it like a health checkup versus a full medical. Surveillance is the annual checkup — blood pressure, a few tests, a look at anything flagged last time. Recertification is the full workup before your policy renews. One keeps you honest between renewals; the other decides whether you get renewed at all.

What a surveillance audit actually checks

Surveillance audits are on-site audits, but they are not full system audits. ISO/IEC 17021-1 clause 9.6.2.2 lists the areas every surveillance visit must review. In plain language, the auditor always looks at:

• Internal audits and management review. Have you audited yourself since the last visit, and has top management actually reviewed the results and made decisions? A system nobody reviews is a system nobody runs.
• Actions on past nonconformities. Every finding from the last visit gets re-opened. The auditor checks not just that you fixed it, but that the fix worked.
• Complaints. Worker complaints, contractor complaints, regulator notices — and how each one was closed.
• Effectiveness against your objectives. Did you hit the safety targets you set, or did they sit on a slide all year?
• Progress on improvement. What actually got better since last year, with evidence.
• Continuing operational control. Are the day-to-day controls — permits, lockout, PPE discipline — still operating, or have they drifted?
• Changes. New machines, new sites, new contractors, new laws, new processes. Change is where old risk assessments go stale.
• Use of the certification mark. Are you using the certificate and logo only within the certified scope? Claiming certification for an uncertified site is a finding in itself.

Notice what is missing from that list: the auditor does not re-audit every clause every year. That is why a surveillance visit is shorter than Stage 2, and why a clean surveillance result is not proof that every corner of the system is sound. It is proof that the sampled parts held up.

What auditors recheck in safety, specifically

On top of the standard checklist, a 45001 surveillance visit samples the safety machinery itself. Expect the auditor to dig into at least these:

Hazard identification and risk assessment. Is the HIRA register current? New hazards get added when processes change; old ones get re-scored when incidents or near misses suggest the original score was optimistic. If your register still describes the plant as it was on certification day, that is a gap. Our HIRA guide walks through the method clause by clause.

Incidents and near misses. The auditor reads the incident log, then asks what changed because of it. A log full of entries with no corrective action behind them reads worse than a short log with real fixes. Clause 10.2 expects investigation, root cause, and action — not just a form filled in.

Legal register and compliance evaluation. New safety notifications, licence renewals, consent conditions — the register must track them, and clause 9.1.2 expects a periodic evaluation of whether you actually comply. A register nobody evaluates is decoration.

Worker consultation and participation. Clause 5.4 is not satisfied by a notice board. Auditors talk to workers. If the people on the floor cannot name the hazards of their own job or the last safety meeting, the system has a participation problem.

Emergency preparedness. Drills held, drill reports written, gaps closed. A fire drill that nobody debriefed teaches the auditor more than the drill itself.

Contractor control. Who was on site, what they were briefed on, who supervised them. Contractors are where many surveillance findings live, because the host company's controls often stop at its own payroll. If you run a warehouse or logistics operation, the contractor and traffic risks in our warehouses and logistics guide are exactly what gets sampled here.

Keep the documents checklist current between visits — policies, risk assessments, and the records auditors ask for — and most of this sampling becomes routine instead of a scramble.

Findings: observation, minor, major — and what each one costs you

Auditors raise three kinds of finding. Confusing them is expensive, because only one of them puts the certificate at immediate risk.

Two escalation rules catch people out. First, an unresolved minor does not stay minor: if the corrective action is unsatisfactory or missing at the next visit, the auditor re-issues it as a major. Second, a major at one site can put the whole multi-site certificate at risk, not just that site's scope. Treat every minor like a major in slow motion, and you will rarely meet a real one.

Missed audit? Suspension, then withdrawal

Suspension is the certification body's way of saying the certificate is temporarily invalid. The usual triggers are straightforward: you did not have the surveillance audit done on schedule, a major nonconformity stayed unresolved, or the system was found not to comply with the standard during surveillance. While suspended, you must stop using the certificate and the mark — in tenders, on letterheads, on the website. Bodies update their public registers, so a buyer checking your status will see it.

Withdrawal is the next step, and it is not automatic on day one. Certification-body procedures commonly give a window — many allow around 90 days from suspension to resolve the issue — after which, if the evidence is still unsatisfactory or the audit still has not happened, the certificate is withdrawn. Withdrawal means starting over: a fresh initial certification audit, not a continuation. The gap also shows up in tender pre-qualification, where a lapsed certificate is often a straight disqualification.

The cheapest suspension to avoid is the administrative one. Diaries slip, the person who handled the last audit leaves, the body's email goes to an inbox nobody checks. Put the surveillance due date in two calendars and confirm the date with the body at least three months ahead — bodies typically flag the due date a quarter in advance, and a confirmed date beats a chased one.

Recertification: the full audit at year three

Recertification is not a longer surveillance visit. It reassesses the entire management system against every clause of ISO 45001, at a depth comparable to the original Stage 2 audit — though it is usually run as a single-stage audit rather than two. It must be completed before the certificate expires. If it is not, the certificate lapses, and you lose certification status entirely.

Plan backwards from the expiry date. Certification bodies and consultants alike advise starting three to four months early, and the reason is practical: recertification can raise findings, and findings need closure time before the expiry date. A recertification audit in the final fortnight leaves no room for a major finding, a re-visit, or a technical review delay. Work to this timeline:

• Four months before expiry: run your internal audit and management review for the full cycle, and close the obvious gaps yourself.
• Three months before: confirm the recertification date with the body and share the updated HIRA register, legal register, and incident summary.
• Two months before: the audit itself, with time for corrective-action evidence afterwards.
• Before expiry: the body's technical review and the new certificate issued, starting a fresh three-year cycle.

One more point owners miss: recertification is the natural moment to change scope — add a site, add a process, drop a closed unit. Scope changes need verification, and doing them inside recertification is far cheaper than a separate special audit later.

What it costs to stay certified

Staying certified has two cost layers, and they are billed by different people. Our consultancy — preparing you for surveillance and recertification, closing findings, updating registers — is ₹9,999 for up to 25 employees and ₹19,999 for 26 to 100 employees, the same structure as initial certification. Certification-body fees are extra at actuals: the body charges for its audit days, and a surveillance visit costs fewer days than a full recertification audit. I will not quote a body fee band here, because it varies by scope, sites, headcount, and risk — any guide that prints one number for every company is guessing.

Budget honestly for the hidden third cost: your own people's time. An internal audit, a management review, and a day of hosting the auditor are real hours. Companies that treat those hours as part of the system pass quietly. Companies that treat them as an interruption fail loudly.

Five mistakes that turn a routine visit into a crisis

• Letting the internal audit lapse. No internal audit since the last visit is the single most common surveillance finding, and it is entirely self-inflicted.
• Closing findings on paper only. "Training done" with no attendance record, or a guard fitted with no photo and no verification, gets reopened — and escalated.
• Freezing the HIRA register. New machine, same old risk assessment. Auditors check the register against the floor, not against last year's audit report.
• Hiding incidents. An empty near-miss log in a busy plant does not impress an auditor. It tells them reporting is broken.
• Leaving recertification to the last month. One major finding in the final fortnight, and the expiry date does the rest.

If you are weighing ISO 45001 certification for the first time, the message of this guide is reassuring, not alarming: the cycle is predictable, the checklist is published, and every visit rewards the same habit — a system that is used between audits, not assembled before them. And if your certificate is already on the wall, check the expiry date today. The next visit is closer than it feels.

Want help getting surveillance-ready or planning recertification? Our team prepares the registers, runs the internal audit, and closes findings before the auditor arrives — and the compliance fee calculator gives you a quick sense of the recurring compliance costs around it.

Frequently asked questions

How often does an ISO 45001 surveillance audit happen?

At least once a calendar year, except in recertification years. The first surveillance audit must fall within twelve months of the certification decision, and later ones follow roughly annually until recertification.

Is a surveillance audit the same as a recertification audit?

No. Surveillance audits sample the system — mandatory areas plus selected clauses — while recertification re-examines every clause at a depth comparable to the original Stage 2 audit, and it must finish before the certificate expires.

What happens if I miss a surveillance audit?

The certification body can suspend the certificate, which means you must stop using it and the mark until the audit happens and any findings close. If the issue is not resolved within the body's window — commonly around 90 days — the certificate can be withdrawn, and you start over with a fresh initial audit.

How long do I get to close a minor nonconformity?

Within an agreed window set by the certification body, typically 30 to 90 days, with root cause and evidence of effectiveness. Leave it open to the next visit and it is usually re-issued as a major.

When should I start preparing for recertification?

Three to four months before expiry: internal audit and management review first, then the audit itself with time for corrective-action evidence and the body's technical review before the expiry date.