Certification records an independent decision at a point in time. The management system still needs to operate, respond to change and improve between audits. A simple annual rhythm can keep responsibilities visible and evidence current.
Monitor Objectives and Process Performance
Review agreed measures at useful intervals. Investigate missed objectives, negative trends and recurring customer or operational issues. Measures should help people make decisions rather than exist only for an audit.
Review Risk and Change
Update relevant risk assessments when services, technology, suppliers, facilities, laws or organisational responsibilities change. Confirm that treatment actions and controls remain appropriate and that new risks have owners.
Keep Everyday Evidence
Retain records through normal work: training, approvals, monitoring, incident response, supplier reviews, maintenance, testing and corrective action. Clear evidence makes internal and surveillance audits more useful and reduces last-minute preparation.
Run a Risk-Based Internal-Audit Programme
Plan audits across the certification cycle, giving attention to important processes, change and previous findings. Auditors need appropriate independence and competence. Findings should identify evidence clearly and lead to actions that address causes.
Use Management Review for Decisions
Management review should consider performance, risk, resources, audit results, feedback, changes and improvement opportunities. Record decisions, owners and due dates. Follow up rather than waiting for the next meeting.
Prepare for Surveillance Without Rebuilding the System
Confirm the audit scope, logistics, records and status of earlier findings. Teams should explain how their processes work and show normal evidence. If preparation requires creating the system again, ongoing governance needs attention.
Certivanta can support maintenance, internal audits and surveillance readiness. Certificate status and certification decisions remain with the independent certification body. Talk to us about ongoing support.
A South African Surveillance Scenario
A certified organisation may add a site, replace a key supplier or launch a new service between audits. If scope, risks, competence and controls are not reviewed, the management system can fall behind the business. A quarterly governance rhythm helps teams capture these changes before the surveillance audit and use them to improve decisions.
Questions Management Should Ask
- What changed in customers, law, technology, people, sites or suppliers?
- Which objectives or controls are no longer effective?
- Are previous audit findings closed with evidence of effectiveness?
- Does the certification body need to be told about a material scope change?
Cost of Ongoing Compliance
Annual cost may include system ownership, training, internal audits, corrective action, technical testing and certification-body surveillance. The mix depends on the standard and risk profile. Avoid treating maintenance as a last-minute document exercise. Review related ISO services, read the Certivanta approach or discuss ongoing support.
What an Ongoing-Support Proposal Should Confirm
Clarify the review frequency, standards and sites covered, expected response times and whether internal audits, management-review preparation or corrective-action follow-up are included. Identify which records the organisation must maintain and which technical specialists remain outside the engagement. Certification-body surveillance fees are separate. Support should strengthen internal ownership rather than make the organisation dependent on a consultant for every routine system decision.