Surveillance Audit

A surveillance audit is a periodic, externally conducted audit that checks whether an organization’s certified management system continues to conform to the requirements of a specific standard, such as a quality, environmental, or information security standard.

In industrial and regulated manufacturing environments, surveillance audits commonly apply to management systems like quality management systems, environmental management systems, or occupational health and safety systems. They are typically performed by an accredited certification body as part of the ongoing certification cycle.

Key characteristics

Surveillance audits commonly:

• Occur at planned intervals during the certification cycle (for example, annually or semi-annually)
• Have a defined but narrower scope than the original certification (or recertification) audit
• Verify continued implementation of documented processes and controls
• Sample selected processes, sites, and records rather than reviewing the entire system in depth
• Review how previously identified nonconformities were addressed
• Confirm that significant changes in scope, products, or sites are controlled within the management system

On the shop floor and across OT/IT systems, a surveillance audit may review items such as:

• Current procedures and work instructions against actual production practices
• Change control, document control, and version governance in MES, ERP, and QMS
• Traceability records, batch histories, and device history records
• Calibration, maintenance, and verification records for production equipment
• CAPA, deviation, and complaint investigations and their effectiveness

How it differs from other audits

• Initial certification audit: A broader, often two-stage audit that evaluates the full management system before granting certification. A surveillance audit is less extensive and happens after certification is already granted.
• Recertification audit: A more comprehensive audit at the end of a certification cycle to renew the certificate. Surveillance audits occur between recertification events.
• Internal audit: Conducted by or on behalf of the organization itself. A surveillance audit is conducted by the external certification body.
• Regulatory or regulatory inspection: Performed by regulators to assess compliance with laws and regulations. A surveillance audit focuses on conformity to a voluntary or contractual standard, not directly on legal enforcement.

Common confusion

The term “surveillance audit” is sometimes loosely used to describe any recurring external review. In a certification context it has a specific meaning: one of the scheduled external audits that maintain a management system certificate over its validity period. It should not be confused with continuous monitoring or with one-time special audits, such as follow-up audits dedicated only to verifying corrective actions.

Operational context in manufacturing

For manufacturing organizations, surveillance audits often drive preparation activities across operations, quality, and IT/OT, including:

• Ensuring records from MES, ERP, LIMS, QMS, and other systems are complete and retrievable
• Verifying that changes to equipment, software, and processes were properly approved and documented
• Confirming employees are trained to current procedures and can demonstrate standard work
• Reviewing recent nonconformities, deviations, and corrective actions for effectiveness

The outcome of a surveillance audit is typically an updated audit report that may include observations, opportunities for improvement, and any nonconformities to be addressed. Continued certification normally depends on participating in these audits and responding to identified issues in a timely manner.