What a three-year certification cycle has to include

A certification cycle is three years long and its shape is fixed: an initial audit in two stages, at least one surveillance audit in each of the two following years, and a recertification audit before the certificate expires. That much most people can recite. What causes trouble is that two dates inside the cycle are set on day one and everything else has to bend around them.

The two dates that bind you

The first is the first surveillance. It must take place no more than twelve months after the last day of the stage 2 audit — not twelve months after the certification decision, and not twelve months after the certificate was issued. Those three dates can sit weeks or months apart, and using the wrong one is one of the most common scheduling errors in the industry. If the first surveillance slips past that anchor, the certificate has to be suspended or withdrawn.

The second is recertification. The audit has to be completed — and the decision taken — before the expiry date on the certificate. Completed means the nonconformities are closed too, which pushes the practical start of that audit months earlier than the date on the certificate suggests. Bodies that book recertification for the month of expiry discover the gap when a major appears.

What the programme has to say, beyond dates

The audit programme is not a calendar. For each audit it has to establish the objective, the scope and the criteria, and it has to show that over the cycle the whole scope of the management system gets covered — you cannot audit the same three comfortable processes for three years. It also has to account for changes at the client: a new site, a new product line, a significant incident, a change of ownership. Any of those can force the programme to be reworked mid-cycle.

This is why a spreadsheet stops working somewhere past a few dozen certified clients. Every cycle has its own anchors, every auditor has their own qualifications and availability, and every change reshuffles the rest. Generating the cycle from the certification decision, matching auditors by competence code and replanning when something moves is what the Audit Planning Agent handles, so the programme stays a live document rather than a file that drifts.