Surveillance Audits and Keeping Evidence Current Between Them
Surveillance audits are a condition of keeping your ISO 42001 certificate valid. Throughout your three-year certificate period, your certification body conducts surveillance audits to verify that your management system has not deteriorated and that you are maintaining compliance. Surveillance audits are different from Stage 1 and Stage 2 audits because they do not re-assess your entire system. Instead, they focus on a sample of controls and a review of changes that may have occurred since your last audit.
The auditor conducting a surveillance audit will ask for an update on significant changes. Have any new AI systems been deployed? Have any control procedures been changed? Has your organisational structure changed? Has management changed? Has your risk profile changed? These questions allow the auditor to focus surveillance on areas most likely to have been affected by change.
Surveillance audits typically cover the following: a review of your management review records and evidence that you have been addressing non-conformities or observations found in prior audits. A sample of control evidence to verify that controls are still operating. A check of any changes to your scope (new systems, new locations or new regulatory requirements). A review of staff turnover and training to ensure that knowledge of controls has been maintained.
The auditor may also examine incident records and complaints to see how your management system is handling issues. If your AI systems have experienced incidents (e.g., accuracy failures or unexpected behaviour), the auditor will review how those incidents were investigated and managed. This provides insight into whether your controls are effective at identifying and responding to problems.
Planning for Surveillance Audits
To prepare for surveillance audits, maintain updated documentation of your management system. Do not wait until the audit is scheduled to compile records. Keep your statement of applicability current. If your risk assessments have identified new risks, update them in your system. If your procedures have changed, document the changes. If staff have been trained, maintain training records. Between audits, the best practice is to treat your evidence as a living system rather than something you only pull together when auditors arrive.
Schedule surveillance audits with your certification body 60 to 90 days in advance. This gives you time to compile evidence and to address any immediate issues. If the audit is surprise (some certification bodies conduct unannounced audits), ensure that you maintain evidence sufficiently up to date that a surprise audit does not catch you off guard.
During surveillance audits, be prepared to discuss how your management system has evolved. If you added new controls, explain why. If you removed controls or changed procedures, explain the reasoning. If you have experienced incidents and changed your controls in response, the auditor will want to understand your learning process.
If a surveillance audit identifies a non-conformity, you will have time to address it before your next scheduled surveillance. However, repeated issues or major findings may place your certificate at risk. Some certification bodies suspend certificates if major non-conformities are identified during surveillance. A suspended certificate cannot be used on your marketing or in customer claims. Suspension typically lasts until you have submitted and verified corrective actions.
Maintaining Evidence Between Surveillance Audits
The challenge of surveillance audits is maintaining evidence over time. Staff members move roles or leave the organisation. Procedures may be followed informally without being documented. Records may be scattered across different systems. To keep evidence current, assign ownership of each major control area to a specific person. Make that person responsible for updating and maintaining evidence between surveillance audits.
Create a schedule for reviewing and updating key documents. For example, schedule a quarterly review of your risk registers to ensure they remain current. Schedule an annual review of your training records to ensure training is being delivered as planned. Schedule a periodic review of your incident records to verify that incidents are being logged and managed.
If you discover that you have not maintained evidence adequately or that controls have not been operating as documented, address the issue immediately. It is better to discover the gap yourself and remediate it before the auditor arrives than to have the auditor find it during surveillance.
A practical tip is to conduct an internal mini-audit before each surveillance audit. Review your own evidence against the requirements you know the auditor will examine. This internal review, sometimes called a pre-audit assessment, allows you to identify and fix issues before the formal audit. Many organisations find this practice invaluable for maintaining readiness between audits and for building staff confidence in your management system.