Services
Recertification Audits
Recertification audits completed before your certificate expires, reviewing performance over the cycle and renewing certification for three years.
- Advance scheduling ahead of certificate expiry
- Review of performance over the full certification cycle
- Audit of the whole management system across the scope
- Optional Stage 1 where significant changes have occurred
Overview
Renew your certificate for a further three-year cycle
Recertification renews your certificate for a further three-year cycle. It must be planned and carried out in good time so that the audit, any corrective action and the certification decision are all completed before the existing certificate expires. Leaving it too late risks a gap in certification, which can affect contracts and tender eligibility. We therefore contact you in advance of the expiry date to agree a timetable that leaves room for any follow-up work.
A recertification audit evaluates the continued conformity and effectiveness of the management system as a whole. It considers performance across the full certification period, including the results of surveillance audits, and confirms that the system remains relevant to your scope, context and strategic direction. A Stage 1 may be needed where there have been significant changes, such as new activities, sites or a change in legal status. Audit time is reviewed to reflect any such changes.
Major nonconformities found at recertification must be corrected and verified before the expiry date. If recertification is not completed in time, the certificate expires. ISO/IEC 17021-1 allows certification to be restored within six months, provided outstanding activities are completed; otherwise at least a Stage 2 audit is required. Planning recertification early is the simplest way to avoid either situation and to keep certification continuous for your customers.
How it works
Recertification Audits, step by step
Every stage is planned and confirmed with you in advance, so your team knows exactly who is coming, when, and what they need to see.
- 1
Early planning
We contact you well before the expiry date to agree dates, review changes to the organisation and confirm audit time for the recertification audit.
- 2
Review of the cycle
Auditors consider surveillance reports, findings and performance trends over the three years to focus the audit on the right areas.
- 3
Recertification audit
The audit evaluates the effectiveness of the whole system across the scope, including how it supports your objectives and intended results.
- 4
Corrective action
Any nonconformities are addressed by you, with majors verified by us before expiry so that continuity of certification can be maintained.
- 5
Renewal decision
An independent decision is made and a renewed certificate is issued for a further three-year cycle.
- Organisations approaching the end of a three-year certification cycle
- Businesses with integrated certificates due for renewal
- Organisations that have transferred to us mid-cycle
- Organisations whose certificate has recently expired and who are within the restoration window
Available for
Recertification Audits for every standard
This service is available for every standard we certify. Choose one to learn more.
Quality
ISO 9001:2026Quality Management
ISO 9001:2026 sets out the requirements for a quality management system. Published in September 2026, it replaces ISO 9001:2015 and keeps the same core approach. It asks an organisation to understand its context and interested parties, plan its processes around risks and opportunities, and show that it consistently provides products and services that meet customer and applicable statutory and regulatory requirements. It is the most widely used management system standard and applies to organisations of any size or sector, from sole manufacturers to national service providers.
- Meet tender and supplier requirements
- Consistent processes
- Fewer errors and complaints
- Risk-based planning
Environment & Energy
ISO 14001:2026Environmental Management
ISO 14001:2026, published in April 2026 to replace the 2015 edition, specifies the requirements for an environmental management system. It helps an organisation identify the environmental aspects of its activities, products and services, understand its compliance obligations, and manage significant impacts through planning, operational control and evaluation. The standard takes a life cycle perspective, so organisations consider stages they can control or influence, such as purchasing, transport, use and end-of-life treatment, as well as their own sites.
- Supply chain and tender credibility
- Structured legal compliance
- Control of significant impacts
- Resource and waste efficiency
Health & Safety
ISO 45001:2018Occupational Health and Safety Management
ISO 45001:2018 sets out requirements for an occupational health and safety management system. Its aim is to prevent work-related injury and ill health and to provide safe and healthy workplaces. The standard places strong emphasis on leadership, the consultation and participation of workers, hazard identification and the hierarchy of controls. It replaced OHSAS 18001 and follows the Harmonized Structure, so it integrates readily with ISO 9001 and ISO 14001.
- Prequalification and tenders
- Worker involvement
- Systematic hazard control
- Clear legal oversight
Information & Technology
ISO/IEC 27001:2022Information Security Management
ISO/IEC 27001:2022 specifies requirements for an information security management system (ISMS). It requires an organisation to assess information security risks to the confidentiality, integrity and availability of information, select controls to treat them and manage those controls through a continual cycle of monitoring and review. Annex A lists 93 reference controls in four themes: organisational, people, physical and technological. Each organisation compares its chosen controls against Annex A and records the outcome in a Statement of Applicability.
- Answer security questionnaires
- Risk-based security
- Supports data protection duties
- Management oversight
Environment & Energy
ISO 50001:2018Energy Management
ISO 50001:2018 specifies requirements for an energy management system (EnMS). It requires an organisation to understand how it uses and consumes energy, identify significant energy uses, set an energy baseline and energy performance indicators, and plan actions to improve energy performance. Unlike some other management system standards, ISO 50001 requires an organisation to demonstrate continual improvement in energy performance itself, not only in the management system.
- ESOS compliance route
- Measured energy performance
- Focus on significant uses
- Cost control
Resilience & Governance
ISO 22301:2019Business Continuity Management
ISO 22301:2019 specifies requirements for a business continuity management system (BCMS). It helps an organisation prepare for, respond to and recover from disruptive incidents when they occur. The core of the standard sits in clause 8, which requires a business impact analysis and risk assessment, business continuity strategies and solutions, documented plans and procedures, an exercise programme and evaluation of business continuity capability. It follows the Harmonized Structure and integrates with other management system standards.
- Evidence for customers
- Clear recovery priorities
- Tested plans
- Understanding dependencies
Sector-specific
ISO 22000:2018Food Safety Management
ISO 22000:2018 specifies requirements for a food safety management system for any organisation in the food chain, from feed and primary production through processing, storage, transport, retail and food service, as well as packaging and equipment suppliers. It combines the Harmonized Structure management system clauses with HACCP principles from Codex Alimentarius, prerequisite programmes (PRPs) and interactive communication across the food chain. The standard uses two linked Plan, Do, Check, Act cycles: one for the management system and one for operational hazard control.
- Structured hazard control
- Applies across the food chain
- Management system discipline
- Communication across the chain
Sector-specific
ISO 13485:2016Medical Devices Quality Management
ISO 13485:2016 specifies requirements for a quality management system where an organisation needs to demonstrate its ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements. It applies to manufacturers and to organisations involved in other stages of the device life cycle, such as design, distribution, installation, servicing, sterilisation and component supply. The standard places particular emphasis on risk management, process validation, traceability and regulatory reporting.
- Supports regulatory submissions
- Supply chain requirements
- Risk management throughout
- Validated processes
Information & Technology
ISO/IEC 20000-1:2018IT Service Management
ISO/IEC 20000-1:2018 specifies requirements for establishing, implementing, maintaining and continually improving a service management system (SMS). It covers the planning, design, transition, delivery and improvement of services to meet agreed requirements. Clause 8 sets out the operational processes, grouped into service portfolio, relationship and agreement, supply and demand, service design, build and transition, resolution and fulfilment, and service assurance. The 2018 edition follows the Harmonized Structure, which allows integration with ISO/IEC 27001 and ISO 9001.
- Procurement credibility
- Consistent service delivery
- Clear service agreements
- Controlled change
Information & Technology
ISO/IEC 42001:2023Artificial Intelligence Management
ISO/IEC 42001:2023 is the first international management system standard for artificial intelligence. It specifies requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS) within an organisation that develops, provides or uses AI systems. It requires AI risk assessment, AI risk treatment and AI system impact assessment, considering effects on individuals, groups and society. Annex A provides reference controls covering areas such as AI policy, resources, impact assessment, the AI system life cycle, data and third-party relationships.
- Evidence of responsible AI governance
- Structured risk and impact assessment
- Clear roles and accountability
- Life cycle controls
Resilience & Governance
ISO 37001:2025Anti-Bribery Management
ISO 37001 specifies requirements for an anti-bribery management system. It helps an organisation prevent, detect and respond to bribery, whether by the organisation, its personnel or business associates acting on its behalf, and bribery of the organisation. Requirements include an anti-bribery policy, top management and governing body oversight, an anti-bribery compliance function, bribery risk assessment, due diligence, financial and non-financial controls, gifts and hospitality controls, and processes for raising and investigating concerns. The second edition, ISO 37001:2025, was published in February 2025.
- Supports adequate procedures
- Risk-based controls
- Due diligence on third parties
- Clear governance oversight
FAQs
Recertification Audits: your questions
When should recertification take place?
The recertification audit should be scheduled early enough to allow for corrective action and the certification decision before the existing certificate expires. Many organisations plan it two to three months ahead of the expiry date. We will contact you in advance, but it is worth noting the expiry date in your own management review planning.
Is recertification the same as the initial audit?
It is similar in depth to a Stage 2 audit but also considers performance over the whole certification cycle. A separate Stage 1 is only needed where there have been significant changes, for example to the organisation, its context or the scope. Audit time is normally around two thirds of the initial certification audit time, adjusted for your circumstances.
What happens if our certificate expires before recertification is complete?
If the recertification activities and decision are not completed before expiry, the certificate expires and you cannot claim to be certified. Certification can be restored within six months, provided outstanding recertification activities are completed. The restored certificate takes effect from the new decision, and its expiry date remains based on the previous cycle. After six months, at least a Stage 2 audit is required.
Can we change our scope at recertification?
Yes. Recertification is a natural point to review whether the scope still reflects your activities and sites. Extensions or reductions should be agreed with us before the audit so that audit time and auditor competence can be planned. Significant changes may require a Stage 1 audit.
Can we move to a new version of a standard at recertification?
Where a new version of a standard has been published, transition arrangements are set by the IAF and accreditation bodies, with fixed deadlines. Transition can often be combined with recertification or surveillance if the timing allows. We will tell you about any transition affecting your certificate and the deadline that applies.
Will our certificate number change?
Normally the certificate number stays the same, and the renewed certificate shows the new expiry date. Where the scope or legal entity changes significantly, details on the certificate will be updated accordingly. The certificate always shows the current issue date and the expiry date of the cycle.
What does the auditor need to see at recertification?
Auditors will want evidence that the system has been maintained and improved over the cycle, including internal audit results, management reviews, objectives and performance data, corrective actions and how changes have been managed. They will also confirm that the system continues to support the organisation's strategic direction.
Can recertification be combined with other standards?
Yes. If you hold several certificates, recertification dates can sometimes be aligned so that the standards are audited together in an integrated audit. Alignment may require a short or extended cycle for one certificate, and we can discuss the options with you at the planning stage.
Certificate verification
Check a Hexa certificate
Need to know whether a supplier's certificate is current? Customers, buyers and other interested parties can ask us to confirm the details held in our records.
We confirm the organisation name, certificate number, ISO standard, certified scope, status, and issue and expiry dates.
More services
Explore our other services
- Initial CertificationIndependent Stage 1 and Stage 2 certification auditsLearn more
- Surveillance AuditsAnnual audits that keep your certificate validLearn more
- Certificate TransferMove an existing accredited certificate to HexaLearn more
- Integrated Management SystemsCombined audits for several ISO standardsLearn more
- Pre-assessmentAn optional readiness check before certificationLearn more
- Management System TrainingPublic awareness and internal auditor coursesLearn more
- Certificate VerificationConfirm a Hexa certificate is genuine and currentLearn more
Start your certification
Get a fixed, three-year certification quote
Tell us about your organisation and the standards you need. We will confirm audit days, scope and dates in writing, with no obligation.