Key takeaways
- 1Certification decision. After the Stage 2 audit, the findings are reviewed by a CAS technical reviewer who was not involved in the audit. The three-year cycle begins with the certification decision.
- 2Surveillance, years one and two. At least once each calendar year except the recertification year; the first no later than 12 months after the certification decision (ISO/IEC 17021-1, clause 9.1.3.3).
- 3Recertification, year three. Before the certificate expires; the new cycle begins with the recertification decision (ISO/IEC 17021-1, clause 9.1.3.2).
Short answer: a CAS ISO certificate is valid for three years. A surveillance audit in each of the first two years keeps it valid, and a recertification audit in the third year, before the expiry date, leads to the recertification decision that renews it for a new cycle.
The three-year cycle
- Certification decision. After the Stage 2 audit, the findings are reviewed by a CAS technical reviewer who was not involved in the audit. The three-year cycle begins with the certification decision.
- Surveillance, years one and two. At least once each calendar year except the recertification year; the first no later than 12 months after the certification decision (ISO/IEC 17021-1, clause 9.1.3.3).
- Recertification, year three. Before the certificate expires; the new cycle begins with the recertification decision (ISO/IEC 17021-1, clause 9.1.3.2).
What a surveillance audit checks
A surveillance audit is shorter and targeted. It verifies that your management system continues to meet the requirements of the standard and that previously identified nonconformities have been addressed. For ISO 9001, 14001 and 45001, each surveillance year is about one third of the initial audit time, and recertification about two thirds of the time an initial audit would need at that point (Global ACI TECH-3-004, formerly IAF MD 5).
Renewing on time, and late
When recertification activities are successfully completed before the expiry date, the new certificate's expiry date can be based on that of the existing certificate, and its issue date is on or after the recertification decision (ISO/IEC 17021-1, clause 9.6.3.2.3). If the recertification audit is not completed, or the implementation of corrections and corrective actions for any major nonconformity cannot be verified, before the expiry date, the certification is not extended (clause 9.6.3.2.4).
After expiry, a certification body can restore certification within six months if the outstanding recertification activities are completed; otherwise at least a Stage 2 audit is conducted. The restored certificate's expiry date is based on the prior certification cycle (clause 9.6.3.2.5).
When a certificate stops being valid early
- Suspension. For example when the certified client does not allow surveillance or recertification audits at the required frequency (ISO/IEC 17021-1, clause 9.6.5.2). Under suspension the certification is temporarily invalid (clause 9.6.5.3), and under CAS's certification rules the certificate and the certification mark must not be used.
- A new edition of the standard. A certificate to ISO 9001:2015 is valid until 30 September 2029 at the latest, and one to ISO 14001:2015 until 30 April 2029, whatever expiry date it prints (Global ACI-TECH-3-TR 2029-09-30 (M) and 2029-04-30 (M)).
Check the dates on a certificate
Every CAS certificate carries a QR code for online verification. Enter the certificate number on our verification page to confirm its issue and expiry dates. The full lifecycle of a CAS certificate is set out in our certification rules.
CAS Conformity Assessment Services — EGAC-accredited certification body, CAB No. 012418. EGAC accreditation covers ISO 9001, 14001, 45001, 22000, 50001 and 22301 only, and IAF MLA recognition covers the same list except ISO 22301.
Read next