An ISO certificate is valid for three years with an annual surveillance audit, and what happens in that cycle decides whether you keep it. The certificate is not a one-time purchase. In year one and year two, the certification body audits your system to confirm it still works. At the end of year three, the certificate expires and a recertification audit issues a new one for the next cycle. Start with our guide to ISO certification cost and process in Iraq, or see ISO 9001 certification.
This guide covers the four questions certified companies in Iraq ask most: what the surveillance audit checks, what nonconformities mean, how renewal works at year three, and how to transfer a certificate to another body. IraqCert manages this cycle for its clients. Certificates are issued by our partner body AQSR, accredited by UAF, an IAF MLA signatory, and verifiable on IAF CertSearch. Consulting stays separate from the certification audit, as ISO/IEC 17021-1 requires.
What a Surveillance Audit Checks
A surveillance audit is a shorter annual audit that confirms your management system still works the way it did on certification day. The auditor samples the system instead of re-checking all of it: internal audits, management review, customer complaints, corrective actions from the last visit, and any process that changed. Surveillance audits happen in year one and year two of the certificate cycle.
Treat it as maintenance, not a second exam. Companies that keep records current through the year pass without drama. Companies that rebuild the paperwork the week before the visit generate findings. IraqCert keeps client systems audit-ready between visits, so surveillance stays a routine event.
Failing an Audit: Minor and Major Nonconformities
You do not fail an audit outright. The auditor raises nonconformities, and the type decides what happens next. A minor nonconformity is an isolated slip, such as one missing record. You submit a corrective action plan and the certificate stays valid. A major nonconformity is a system failure, such as a required process that does not exist. The certification body sets a deadline to close it.
Ignore a major finding and the sequence is fixed: the certificate is suspended, and if the finding stays open, it is withdrawn. A suspended certificate cannot be used in tenders or marketing. Fix the root cause, send the evidence, and the certificate comes back. Withdrawal means starting certification again from zero.
| Event | What happens | What you should do |
|---|---|---|
| Minor nonconformity | The certificate stays valid. The finding is recorded and checked at the next audit. | Submit a corrective action plan and close the finding before the next visit. |
| Major nonconformity | The certification body sets a deadline to close it. Left unresolved, it leads to suspension. | Fix the root cause and send evidence before the deadline. |
| Missed surveillance audit | The certificate is suspended, then withdrawn if the audit is not completed. | Contact the certification body at once and book a new date. |
| Recertification at year three | A full audit before expiry issues a new certificate for three more years. | Book early so the certificate never lapses. |
| Certificate transfer | The new accredited body reviews your file and continues the cycle with the same expiry date. | Confirm the certificate is valid and issued under IAF-recognized accreditation. |
Renewal at Year Three: The Recertification Audit
Your certificate expires at the end of year three, and a recertification audit before that date issues a new certificate for another three-year cycle. This audit is fuller than surveillance. It reviews the whole management system plus its performance across the cycle: results, complaints, and how findings were handled.
Book it well before the expiry date. If the certificate lapses, most certification bodies treat you as a new applicant, which means a full initial audit again. IraqCert tracks client expiry dates and schedules recertification with AQSR so the certificate never gaps. A gap in the certificate is a gap in every tender you submit.
Transferring Your Certificate to Another Certification Body
You can transfer a valid accredited certificate to another accredited certification body without repeating the full certification audit. The rules come from IAF MD 2, the IAF mandatory document for certificate transfers. Two conditions matter: the certificate must be valid and not suspended, and it must have been issued under accreditation recognized by the IAF. The receiving body reviews your certification file, then continues your existing cycle with the same expiry date.
Certificates from unaccredited bodies cannot transfer. If you bought one, no accredited body will adopt it, and you start certification from the beginning. This is one more reason accreditation matters on the day you sign, not later. Certificates arranged through IraqCert are issued by AQSR under UAF accreditation, so they transfer and verify on IAF CertSearch.