ISO 27001 Surveillance Audit Checklist (Years 2 and 3)

Most surveillance audit findings come from an ISMS that stopped running after the certificate arrived: the internal audit slipped, management review became an email, and last year's nonconformities were closed on paper but never checked. Once an organisation is certified to ISO/IEC 27001:2022, its certification body returns at least once a year for a surveillance audit, with the first visit no more than 12 months after the certification decision, and a recertification audit before the three-year certificate expires. This template gives [Organisation] eight numbered sections of checks to complete before each surveillance visit in years two and three of the cycle. It is for ISMS managers, GRC leads and control owners who already hold a certificate and want to keep it without a scramble.

This page covers keeping a certificate, not getting one. For Stage 1 and Stage 2 preparation, use the ISO 27001 Certification Readiness Checklist. If you are still deciding between schemes, see Cyber Essentials vs ISO 27001.

Key takeaways

Surveillance is not a lighter Stage 2. Every visit samples the same core: internal audit, management review, previous nonconformities, changes, complaints and use of the certification mark, plus a rotating slice of Annex A.
Dates are the first thing checked. An internal audit programme that skipped a planned audit, or a management review held after the audit window opened, is an easy finding.
Closure is not effectiveness. Auditors re-test last year's findings; a corrective action that did not stop recurrence becomes a new, more serious nonconformity.
The SoA and risk register must have moved. A year of change with an unchanged Statement of Applicability and risk assessment tells the auditor the ISMS is not reacting to change.
Missing a surveillance window has consequences. Certification bodies can suspend a certificate when the client does not allow surveillance at the required frequency, and suspension is publicly visible.

How to use this template

Replace text in square brackets, such as [Organisation], [ISMS manager], [Top management] and [Certification body], with your own terms.
Start the checklist 90 days before the surveillance date your certification body has confirmed. Sections 1 to 4 need lead time; sections 5 to 8 can run in parallel.
Mark each check Met, Partly met or Not met, record where the evidence lives, and assign an owner and due date to every gap. Anything Not met 30 days before the visit goes to [Top management].
Clause references refer to ISO/IEC 27001:2022 (with Amendment 1:2024). Confirm wording against your licensed copy; this template paraphrases.
Read your certification body's own process document: frequencies, response deadlines and tolerance periods below are drawn from published certification body procedures and can differ between bodies.

The three-year cycle at a glance

Event	Typical timing	What the auditor looks at
Certification decision (after Stage 2)	Year 1	The full ISMS against all requirements
Surveillance audit 1	No more than 12 months after the certification decision	Core ISMS processes, closure of Stage 2 findings, changes, a sample of Annex A controls
Surveillance audit 2	In the following calendar year	Core ISMS processes, closure of surveillance 1 findings, a different Annex A sample
Recertification audit	Before the certificate expires (certificates are normally valid for three years)	All requirements, plus the trend across both surveillance audits

Published procedures show what happens when deadlines slip: TÜV NORD CERT asks the client to report planned corrective actions within six weeks of the last audit day, or the audit is treated as not passed, and Schellman describes restoring an expired certificate within six months only if outstanding recertification activities are completed. Plan the surveillance date in your ISMS calendar a year ahead.

1. Internal audit completion (clause 9.2)

The internal audit programme (9.2.2) covers every ISMS clause and every in-scope Annex A theme across the three-year cycle, and the plan for this year was approved before the year began.
Every audit planned since the last certification body visit was performed. Any postponed audit has a recorded reason, a new date and approval from [ISMS manager].
Higher-risk areas and areas with previous findings were audited more often, and the programme says why (9.2.2 asks the programme to consider importance of the processes and results of previous audits).
Auditors were objective and impartial: no one audited their own work. Where an external party performed the audit, the contract and the auditor's competence evidence are on file.
Each audit has a report with scope, criteria, findings and evidence sampled, and the results were reported to relevant management.
Internal audit findings are in the same nonconformity log as external findings, not a separate spreadsheet.

For the method itself, see ISMS Internal Audit and Management Review and the Internal Audit for Cybersecurity Guide.

2. Management review held (clause 9.3)

A management review was held since the last visit, with [Top management] present, and minutes or a decision record exist (9.3 requires documented evidence of the results).
The record shows each required input was considered, including: status of actions from previous reviews; changes in external and internal issues; changes in the needs and expectations of interested parties; nonconformities and corrective actions; monitoring and measurement results; audit results; fulfilment of objectives; feedback from interested parties; risk assessment results and status of the risk treatment plan; and opportunities for continual improvement.
The outputs contain decisions, not only "noted": changes to the ISMS, resource decisions and improvement actions, each with an owner and date.
The review took place after the internal audit cycle completed, so audit results were an input.
Actions from the previous review are closed or carried forward with a reason.

3. Nonconformity closure (clause 10.2)

Check	Evidence the auditor asks for	Status
Every finding from the last external audit has a correction, a root cause and a corrective action	Nonconformity log with cause analysis per finding	[Met / Partly / Not met]
The action plan was sent to [Certification body] within its deadline	Email or portal submission with date	[ ]
Each corrective action is implemented, with dated evidence	Change tickets, updated documents, configuration exports	[ ]
Internal audit findings, incidents and complaints follow the same process	Log entries from all sources, not only external audit	[ ]
Observations and opportunities for improvement have a recorded decision	Accepted with action, or declined with reason	[ ]
Other locations or systems with the same weakness were checked (10.2 asks whether similar nonconformities exist or could occur)	Extent-of-condition note per finding	[ ]

4. Corrective action effectiveness (clause 10.2)

Each closed corrective action has an effectiveness review, dated at least one operating cycle after implementation, by someone other than the person who implemented it.
The review tests the outcome, not the activity. Example: a finding on leavers keeping access is effective when a sample of [25] leavers since the fix all had access removed within [1 working day], not when the procedure was updated.
No nonconformity recurred in the same area. A repeat finding is reopened, its root cause analysis redone, and [Top management] is told.
Where a corrective action changed the ISMS (a new procedure, a new control), the risk register and SoA were updated to match (10.2 calls for changes to the ISMS if necessary).

5. Statement of Applicability currency (clause 6.1.3)

The SoA has a version and approval date within the last 12 months, or a recorded review that confirmed no change was needed.
Controls marked "planned" a year ago are now implemented, or have a revised date and a risk owner's acceptance.
New services, cloud platforms, suppliers, AI tools and acquisitions since the last visit are reflected in control justifications.
Every exclusion still has a justification that holds today. Exclusions of access control controls (5.15, 5.18) and supplier controls (5.19 to 5.23) deserve a second look after any change in outsourcing.
The SoA version referenced on the certificate or in the certification body's records is the current one.

Use the ISO 27001 Statement of Applicability Template if the SoA needs rebuilding rather than updating.

6. Risk assessment refresh (clauses 6.1.2, 8.2 and 8.3)

A risk assessment was performed at the planned interval and after significant changes (8.2), and the results are retained.
Significant changes since the last visit are listed, each with a reassessment or a recorded decision that no reassessment was needed: reorganisations, new products, cloud migrations, new suppliers, major incidents.
Risks now include identities that did not exist a year ago: new service accounts, cloud roles, API keys, OAuth integrations and AI agents. See the Service Account Inventory Template.
Risk treatment plan items due in the period are complete or re-approved, and residual risks were re-accepted by named risk owners (8.3).
The Risk Register Template fields, such as last review date and owner, are populated for every open risk.

7. Objectives measured (clauses 6.2 and 9.1)

Each information security objective has a current measured value, a target and a date, and the results were reported to management review.
Monitoring and measurement (9.1) states what is measured, how, when, by whom and when the results are analysed, and the records exist for the period.
Objectives that were met are replaced or raised; objectives that were missed have an action.
At least one objective measures operational outcomes, for example patch timeliness or access review completion, not only training completion.

The Security Metrics and KPIs Programme Guide covers how to choose measures that survive audit sampling.

8. Annex A sample evidence

Certification bodies sample a different set of Annex A controls each visit so that all applicable controls are covered over the cycle. Ask [Certification body] which areas are planned, then check evidence for the full period since the last visit, not just the last month.

Control (ISO/IEC 27001:2022 Annex A)	Evidence for the period	Common gap
5.15 Access control, 5.18 Access rights	Completed access reviews for human and non-human accounts, joiner, mover and leaver tickets	Reviews done but revocations never actioned
5.19 to 5.22 Supplier security	Supplier assessments and monitoring records for new and renewed suppliers	New SaaS suppliers onboarded outside the process
5.24 to 5.27 Incident management	Incident log, post-incident reviews, lessons fed into risk assessment	Incidents closed with no lessons learned record
5.30 ICT readiness for business continuity	Continuity or recovery test results from the period	Test planned but not run
8.8 Management of technical vulnerabilities	Scan coverage and remediation against stated timescales	Exceptions with no expiry
8.13 Information backup	Restore test records	Backups monitored but never restored
8.15 Logging, 8.16 Monitoring activities	Log source coverage and alert handling records	New systems not onboarded to logging
8.32 Change management	Sample of changes with approval and testing evidence	Emergency changes never retrospectively approved

The certification body will also ask about changes to scope, structure or key personnel, complaints received, and how the certification mark and certificate are used in marketing. Have a one-page summary ready for each. For access review method, see the Access Review Checklist.

Implementation guidance

Day minus 90: confirm the audit date and planned sample with [Certification body]; export the nonconformity log and assign owners for any open item.
Day minus 75: complete any outstanding internal audits and run effectiveness reviews on closed corrective actions (sections 1 and 4).
Day minus 60: refresh the risk assessment and SoA for changes in the period (sections 5 and 6).
Day minus 45: hold management review with all inputs, including this year's internal audit results and objective measurements (sections 2 and 7).
Day minus 30: walk the Annex A sample with each control owner and pull evidence covering the whole period (section 8). Track requests in the Audit Evidence Request Tracker Template.
Day minus 7: brief interviewees, confirm access for auditors, and prepare the change, complaint and mark-use summaries.
After the visit: log every finding, send the action plan within the certification body's deadline, and schedule effectiveness reviews before the next visit.

Organisations with continuous controls monitoring can run sections 7 and 8 from dashboards rather than evidence hunts. See Continuous Compliance vs Point-in-Time Audits.

Framework alignment

Checklist section	NIST CSF 2.0	NIST SP 800-53 Rev. 5
1. Internal audit	ID.IM-01 Improvements are identified from evaluations	CA-2 Control Assessments
2. Management review	GV.OV-01, GV.OV-02, GV.OV-03	PM-6 Measures of Performance
3 and 4. Nonconformities and corrective action	ID.IM-01, ID.IM-02	CA-5 Plan of Action and Milestones
6. Risk assessment refresh	GV.OV-02	RA-3 Risk Assessment
7 and 8. Measurement and control evidence	GV.OV-03	CA-7 Continuous Monitoring

Common failure patterns

The ISMS calendar lives in one person's head. When the ISMS manager leaves, the internal audit and management review dates are missed. Put both in a shared calendar with a deputy.
Management review held the week before the audit. Inputs are thin and outputs are generic. Hold it early enough for its actions to start.
Corrective actions closed by updating a document. The procedure changed, the behaviour did not, and the same finding returns at the next visit.
Scope drift. New sites, products or cloud tenants are used in sales claims about certification but were never assessed or reported to the certification body.
Evidence only for the last month. Auditors sample the whole period; a run of recent access reviews after eleven quiet months is a finding.

ISO 27001 Surveillance Audit Checklist: What Auditors Check in Years 2 and 3