Section twenty-one provides information about what will happen during surveillance audits and recertification audits. So when we look at the audit program management, we have arrived at the last phase, which is six beyond the initial audit. So there are three activities or three tasks that need to happen then So, first of all, you need to conduct audit follow-up activities, you need to conduct surveillance audits, and of course, you need to plan and conduct recertification audits. So let's take a deeper dive First of all, based on the audit conclusions, of course, an auditor might need to conduct an audit follow-up before the audit T is recommended for certification. So during that audit follow-up, an auditor evaluates again the effectiveness of all the corrections and corrective actions. So that usually happens when a major nonconformity has been uh written during uh the stage two of an audit. So that follow-up uh activity uh should also of course be uh planned carefully um and in detail just in the same way as you've done in a stage one and in a stage two. So during that stage two audit, you will have a look at the non-conformity report that the auditee has submitted and you will check if the implementation was successfully. So usually the audit follow-up is conducted between four to twelve weeks after the initial audit, so that the auditee is really giving time to implement the corrective actions. And the conduct is of the audit is usually done within a day. It might even be shorter, depending on what it actually is So that audit follow-up, and one thing to remember is when you have a major uh non-conformity, usually a special audit or an audit follow-up uh will be uh scheduled So again, we will be reviewing there, of course, the effectiveness of the implementation. And of course, again, the clients shall be informed of the result of the review. and uh the verification so you will also um be informed if there is such a follow-up audit and after that follow-up audit you will also get the feedback or you need to give the feedback to the client that um he that the client will be um uh Proposed for certification. So an alternative to audit follow-up can also be, of course, an internal audit and a surveillance audit So when it's a minor nonconformity or observations, usually no audit follow-up is being scheduled, but there can be other means where you can do it. So for a minor nonconformity, uh usually the auditor will not perform uh a special audit. Uh we will then follow up um during a surveillance audit um or you can also follow those up uh through the internal audit. So what I see uh happening a lot is that When you have a minor non-conformity, we will follow it as an external audit in the surveillance audit to check if it has implemented. But organizations usually do their effectiveness check So they they implement the corrections and the corrective actions and they ask the internal audit to check the effectiveness. So that way you have a double check. So uh as stated it can be part of an upcoming uh surveillance audit. You can ask an internal audit team to look at that And sometimes we can also do an audit, we can also do a remote audit, of course, to check if the non-conformity has been solved. Nonconformities are usually individual in nature and uh a number of activities and methods can be used. to determine of the effectiveness has been taken. So before taking the decision to close a non-conformity, you should review That the corrections have been implemented, the corrective actions have been done, and a root cause analysis has been conducted. So has that been done? Um if as stated in the 1721 ISO standard certification body shall develop its surveillance activities so that representative areas and functions covered by the scope of the management system are monitored on a regular basis and take into account changes to its certified client and its management system. So an auditee must inform in all cases the certification body if there are any changes that have an impact on uh the management. system that might be uh an increase or a decrease in the number of employees, acquisitions, downsizing, mergers, all those kind of things need to be um needs the certification uh to be informed of So a surveillance audit issue is shorter than the stage one and stage two audit um and not the whole ISO standard will be checked. It will only be certain parts of the standard. But an auditor will also come on site to check certain requirements with respect to the standard. So of course other surveillance activities may of course also include a you more certification bodies ask questions to the certified uh clients to see if there were any complaints um to see how they uh use promotional material uh so to see what statements that they use. They want to ask if there were any uh changes in the organization They request certified clients to provide certain elements of documented information. So depending on the certification body, there might be more or less information that needs to be provided. Surveillance audits are on-site audits, but are not necessarily full system audits. So they are planned together with other surveillance activities so that the certification body can maintain That confidence that the client certified management system continues to fulfill requirements between recertification audits. So there are a couple of things that are mandatory to check during a surveillance audit. So what are those things? So the internal audit and the management review need to be checked during every surveillance audit You also need to have a look at the review of actions taken on nonconformities identified during the previous audit. You need to check any sort of complaints that the customer had. The effectiveness of the management system with regard to achieving the certified client's objectives and it tended intended results. So you want to have a look at the ISMS objectives. You want to have a look at continual improvement. You want to have a look at operational planning, review of any changes, and of course the use of marks and any other reference to certification. So surveillance audits need to be conducted once per calendar year, except in the recertification year The date for the first surveillance audit following the initial certification cannot be more than 12 months from the first certification decision date. So you really need to be careful When to schedule that surveillance audit. Usually when you do a stage two audit, you already plan the surveillance audit for the upcoming year. So if it's necessary to adjust the frequency of surveillance audit to accommodate factors such as seasons or management system certifications of a limited duration. So then you need to talk to your certification. bodies. So the main elements to audit during a surveillance audit are of course the management review and the internal audit of course Um the change management, uh any action plans, um the use of certification um reference and marks. That's something that we always check as something that organizations tend to forget as well, that they cannot use the ISO logo that is on the website of the ISO um of the website from ISO but you need to use the logo that you get from your certification. So the main goal of a surveillance audit is really to verify if the management system is continually maintained and it's also getting improvements uh implemented.