The recertification audit now is in the third year. So the purpose of a recertification audit is really to confirm the continuate uh conformity and effectiveness of the management system as a whole and its continued relevance and applicability for the scope of certification. So a recertification audit will be planned and conducted to evaluate that continued fulfillment and other normative documents, and this shall be planned and conducted in due time to enable for a timely renewal. before the certificate expiry date. So a recertification audit will also look at um all the other surveillance audits. So If you do a re-certification audit, you also need to review any comments, any non-conformities of previous surveillance audits to see if there is a trend that can be spotted. For example, if people um didn't pick up nonconformities or the same non-conformities is coming back year after year. So you need to include that as well. It might be that you need to do a stage one audit, but that is only the case when there have been significant changes in the management system within the organization or the context. Now that can occur uh in at any time um and the sir uh certification body then needs to perform a special audit. Um it might be uh a stage uh two-stage uh audit. It depends on what the magnitude of the change is. of course. So again during a recertification audit um almost all clauses and controls are being reviewed again So, the effectiveness of the management system in the entirety of the internal and external changes is being reviewed. You want to see again that demonstrated commitment to maintain the effectiveness and the improvement of the management system. And of course, in regard to achieving the objectives, the ISMS objectives, and the intended results Again, for any major nonconformity, the certification body will also give a timeline to give back the non-conformity report and to have actions performed. Of course When planning that re-certification audit, you need to take into account. So, usually, what happens with most of the certification body is that they plan the recertification audit Three months before the certificate reaches its end date, so that an organization still has sufficient time to mitigate and to solve all nonconformities. When recertification activities are successfully completed, the expiry date of the new certification can be based on the expiry date of the existing certification. So the issue date will then be on the new certificate shall be on or even after the recertification. Decision. If you do not have an organization has not completed the recertification audit, or the certification body was unable to verify the implementation of the corrections for any major nonconformity Prior for the expiry date of the certification, the recertification shall not be recommended and the validity of the certification shall not be extended. So of course the client will be then be informed. So if the certification has been expired, a certification body Can restore the certification within six months provided that any outstanding recertification activities have been completed. So If your certificate is expired, but you still need one or two months to complete any major nonconformity and you do it within the six month time frame, you can still restore the certificate If you go over those six months, a stage two audit shall be conducted again. So a normal stage two audit like you've done in the initial certification will be done So the effective date on the certificate shall then be on or after the recertification decision, and the expiry date shall then be based on a prior certification. Cycle. So the certification body is the body that makes the decisions, of course, based on the result of the re-certification audit, as well as the review Of previous years or complaints that have been received. So it might be the case that your recertification audit was successful, but that you had a number of complaints on which the uh research the uh uh certification body decides um not uh to uh uh prolong your certificate. I've never seen that happening but it might be uh the case case. So a management system certification is valid for three-year, of course, conditional upon completion of surveillance audits. So you need to do the surveillance audits So that means that a full certification cycle includes an initial certification, two surveillance audits, and a recertification audit. Sometimes you can also do a pre-audit, which is always optional, where you do kind of a gap analysis. It's done at least three months before the certification audit. It's really to prepare you before the audit. plan is contains the audit information, the audit scope, audit objectives as we've discussed. The audit in year zero is the stage one and the stage uh two audit and non-conformities should be closed at least three months. after the audit conclusions have been uh presented and then you will get your initial certification after you've submitted. your non-conformity reports and it has been approved. Normally it is issued within two weeks after the audit has been successfully closed. Then you go into two years of surveillance audit, so year surveillance audit one should not be conducted longer than 12 months from the initial certification audit. Surveillance audit 2 should not be conducted longer than 12 months from the surveillance audit, and then you have the recertification. That should be conducted within two months before the triinal certification expiration. My experience is that most certification bodies find the two months a little bit too short, so they usually go for three months. But you cannot go closer than two months before the recertification date. There are a couple of special cases. So the first one is extensions So you can do a scope extension. So that might be because you decided to start with a smaller scope and that you then for a first certification and then you want to extend the scope or you do a merger or something like that. An extension of the scope can be conducted during the surveillance audit. And if an extension certification is not granted, the audit does not lose the current certificate. So that is very important. You can also suspend uh your certificate can be suspended off or withdrawn. So that only happens in a couple of instances. as something really needs to um have gone wrong then and Audit T can have its its uh certificate withdrawn when the certified management system has constantly Or severely fail to comply with the certification requirements, including requirements related to effectiveness of the management system And the certification body must make any certification suspension public. So what can that be? It can be when an um an auditee does not want to do the surveillance audit within uh the twelve months uh following um the stage two audit. So if you uh are not willing to do the surveillance audit your certificate will be withdrawn If the audit does not have enough resources to meet the requirement, if the certification body determines that, it can be withdrawn. If you get excessive, if the certification body gets Excessive or serious complaints by interested parties that might also lead to a withdrawal. If an auditee refuses to implement corrective actions Uh in response to the nonconformities during the period required. So if you don't get your nonconformity report back. If the audite misuses the trademark of the certification If the Odity has failed to correct the willful misuse of the trademark of the certification or accreditation body within a month, The Odity used and applied the certificate out of its scope. So you say that you're ISO 27001 certified for everything. Well, that's not the case. The information that has been provided during the audit was misleading. Or yeah, you can of course also request voluntarily the suspension. Uh if you don't pay your certification body, that might also lead to withdrawal or to suspension. So um having your certificate suspended if you take things seriously, um it's it's pretty difficult to have that happening But of course you need to uh take it seriously. You can also transfer your registration from one certification body to another certification Body even if you've signed a long-term agreement. So if you're not happy with your certification body, you can decide to move from one uh to another. So what needs to happen then? You of course need to create a request for transfer. You need to provide your last audit report to the new certification body. Also your last corrective action plan and of course a copy of the valid certification registration needs to happen as well It might also happen that the certification body needs to conduct audits on a short notice or unannounced because there were complaints or there were changes. So basically what will happen then is that the certification body will inform the client in advance to inform them about the audit and under which conditions the audit will be happening And of course, the certification body will need to have then a little bit of additional care in assignment of the audit team because there wasn't a lot of opportunity to object to the audit team members. Audit or certification bodies need to have a policy and a documented procedure available for suspension, withdrawal, or reduction of the scope and shall specify the subsequent actions by the certification body. And uh of course um yeah a certification body needs to adhere to uh ISO standards as well. Um so um under uh suspension when uh Certification body decides to suspend a certification, the certification becomes temporarily invalid The certification body will also restore the suspended certification if the issue that has resulted in the suspension has been resolved. If it uh will not be resolved uh within the time frame that is uh set forward, um it will result in a withdrawal or in a reduction of scope. Now, use of trademarks. I've already talked a little bit about that. Certified ADT is authorized to publicly display its certification and to use it for marketing purposes. However, the certification cannot be displayed directly on a product or in such a way that it would lead to belief that the product is certified. You cannot certify a product to ISO 27001. The certification body will provide the auditi with a logo that can be used. So the unauthorized use of ISO trademarks could mislead um would create false impressions or cause confusion. So ISO trademarks are not allowed to be used with the intention to express the certification of a product, a person or organization, since ISO does not perform certification. So using a logo or an ISO trademark is not allowed. So you get the logo that you're or the trademark that you're allowed to use. use um you get it in a certain color coding and you're not allowed to um yeah change that color coding or to make any other changes to the trademark. You need to use the trademark that you have received So, in summary, the main objective of the re-certification audit is to confirm the continued conformity and the effectiveness of the management system. Surveillance audits shall be conducted at least once a year, except in recertification years. The recertification audit aims to ensure that the management system is still implemented and being continually improved.