A surveillance audit is the annual check-up that keeps your ISO 27001 certificate valid between the three-year recertification cycles — and in 2026, auditors are spending more time testing evidence, not just reading policies.
Why this matters
A failed surveillance audit doesn't just cost you a re-visit fee. It puts your certificate on suspension, which means every tender that asks "are you ISO 27001 certified?" gets a no until you fix it.
Certification bodies run surveillance audits once a year, in years one and two of your three-year cycle, and they're shorter than the initial audit — usually one day instead of three. Shorter doesn't mean lighter. Auditors in 2026 sample fewer controls but dig deeper into each one, checking that your ISMS has actually been running, not just documented.
The businesses that sail through treat compliance as a live system with a paper trail. The ones that scramble treat it as a folder they open once a year. The gap between those two approaches is what a surveillance audit measures.
What you'll need
- Your Statement of Applicability (SoA) from the last audit, unchanged unless you've logged a formal update
- A risk register with review dates covering the full period since your last audit
- Internal audit records for the current cycle — at least one internal audit is expected before the surveillance visit
- Management review minutes, ideally quarterly, showing the ISMS was discussed at leadership level
- Evidence of corrective actions closed out from any prior non-conformities
- Access review logs, patch records, and training completion data covering the 12 months under review
- A named ISMS owner who can answer auditor questions without checking with three other people
If you're running ISO 27001 for a SaaS startup with a lean team, most of this evidence sits scattered across Slack, spreadsheets and ticketing tools by default — that's the single biggest reason surveillance prep eats a week instead of an afternoon.
The steps
1. Pull your last audit report and close every open item first
Start with the non-conformities and observations from your previous audit, not the new stuff. Auditors always check these first in 2026 surveillance visits, and an unresolved observation from 12 months ago is an easy path to a new non-conformity.
List every finding, the corrective action taken, the date it was closed, and who signed it off. Common mistake: treating an "observation" as optional because it isn't a formal non-conformity — auditors expect a response to both.
2. Refresh the risk register with dated reviews
Your risk register needs evidence it was actually reviewed during the period, not just created once and left alone. Auditors look for review dates, changes in risk scoring, and a link between new risks and any incidents logged that year.
Set a quarterly review cadence if you don't have one, and record who attended. Expected outcome: a register showing at least 2-4 review cycles since the last audit, with at least one risk added or re-scored.
3. Verify access reviews and offboarding records
Pull a list of everyone with access to critical systems and cross-check it against your current HR roster. Auditors in 2026 routinely sample 3-5 leavers and check that access was revoked within your stated SLA — often 24 to 48 hours.
If you can't produce a clean access review for the full period, do one now and document the gap as a management-reviewed exception. Common mistake: relying on memory instead of a logged review — "we're pretty sure we removed their access" fails every time.
4. Check patch and vulnerability management evidence
Auditors want proof that vulnerabilities were identified and remediated on a schedule, not just that a scanning tool exists. Pull scan reports, patch logs, and remediation timelines for the last two to three cycles.
If your vulnerability and patch management process is manual, this is usually where surveillance prep takes the longest — reconciling tickets against scan output by hand. Expected outcome: a clear timeline from vulnerability found to vulnerability closed, with no gaps over 30 days for critical findings.
5. Confirm training and awareness records are current
Every employee with system access needs documented security awareness training within the audit period, and auditors sample this heavily because it's cheap to check and often skipped. Pull completion rates, dates, and content covered.
If your team is distributed, security awareness training for remote teams needs the same completion tracking as in-office staff — auditors don't distinguish. Common mistake: running training once at onboarding and never refreshing it; most schemes expect annual repeats.
6. Run an internal audit before the external one
ISO 27001 requires at least one internal audit per certification cycle, and surveillance auditors check for it explicitly. If you haven't run one this year, run it now, even informally, and document the findings.
A 30-60 minute internal review against your SoA, with findings written up and dated, is enough to satisfy this requirement for most small and mid-sized businesses. Expected outcome: a dated internal audit report with at least one finding or a formal "no issues found" note, reviewed by management.
7. Hold a management review meeting and minute it
Management review is a named clause in ISO 27001 (9.3), and surveillance auditors ask for minutes covering risk changes, incidents, audit results, and resource needs. A missing management review is one of the more common non-conformities auditors raise in 2026 surveillance visits.
Schedule it before the audit date, invite the ISMS owner and at least one senior stakeholder, and keep the minutes to one page covering decisions made. Common mistake: treating this as a formality with no substantive discussion recorded — auditors want to see actual decisions, not "reviewed and approved."
8. Brief whoever the auditor will interview
Auditors interview staff outside the compliance team, and a confident answer from an engineer or ops lead does more for your audit than a perfect policy document. Brief the people likely to be sampled on what the ISMS covers and where evidence lives.
Expected outcome: any employee interviewed can explain, in plain terms, what happens if they lose a laptop or spot a phishing email, without reading from a script.
Automate your surveillance audit evidence
OneClickComply pulls evidence continuously so surveillance prep stops being a scramble.
Troubleshooting
Problem: your risk register hasn't been touched since the last audit. Fix it now with a dated review, log any changes since certification, and flag the gap openly in your management review minutes rather than hiding it.
Problem: access logs show a leaver still had system access weeks after departure. Document the delay, the reason, and the corrective action taken — auditors accept a well-handled exception far more readily than a hidden one.
Problem: no internal audit has happened this cycle. Run a lightweight one this week. A short, honest internal audit beats no internal audit every time.
Problem: training completion rates sit below 80%. Chase the outstanding staff before the audit date and be ready to show the completion trend improving, not just the current snapshot.
Problem: the auditor asks a question and nobody on the call knows the answer. Have the ISMS owner present for the whole audit, not just the opening meeting — most surveillance non-conformities trace back to a knowledge gap in the room, not a missing document.
Problem: your Statement of Applicability doesn't match what you're actually doing. Update the SoA before the audit and log the change formally — an SoA that's drifted from reality is a near-automatic finding.
Tools and resources
- ISO 27001 for SaaS startups — background on scoping the ISMS if you're early in the certification cycle
- Preparing for a Cyber Essentials Plus audit — useful if you're running dual certifications in the same year
- Tabletop exercise for incident response — auditors increasingly ask for evidence of a tested incident response plan
- Your certification body's surveillance audit checklist, usually issued 4-6 weeks before the scheduled date
- A shared evidence folder with clear ownership, updated monthly rather than assembled once a year
What to do next
Once the surveillance audit is booked, put a 90-day countdown on the calendar and work backwards through the steps above. If evidence collection is still manual across spreadsheets and ticket exports, that's the process to fix before your next cycle, not during it — OneClickComply automates ISO 27001 evidence collection end to end so surveillance prep stops being an annual fire drill.
Frequently asked questions
One last thing
The single biggest predictor of a clean surveillance audit isn't the size of your evidence folder — it's whether the ISMS owner can walk into the room and explain, unscripted, what changed since last year. Auditors read that confidence as proof the system runs itself day to day, not just on audit week, and that's exactly what a surveillance audit in 2026 is designed to test.