A recertification audit is an assessment through which, at the end of the three-year certification cycle, the validity of the certificate is renewed for a further period. It is neither a formality nor an automatic extension – auditors assess the system as a whole, similarly to the initial certification, although usually to a lesser extent, since they already know its history from the surveillance audits. They focus on the effectiveness of the system across the whole cycle: the development of risks, the results of internal audits, incidents that were handled, changes in scope, and whether the company responded to changes in its environment. Recertification is a separate, chargeable service that needs to be budgeted for, and it must be scheduled with enough lead time before the certificate expires so that no gap arises between certificates. After it, a new cycle begins with its own surveillance audits.
See also: Surveillance Audit, Certification audit, ISO/IEC 42001.
