Part IV · Chapter 8 · The Second Year · lesson 4
They come back, and the second visit is not the first one again
12 min
Builds on Two answers to the same question, written for different readers
Part IV · Chapter 8 · The Second Year · lesson 4
12 min
Builds on Two answers to the same question, written for different readers
A company that holds both documents has three recurring dates in the diary, and they are three different kinds of event. One is a visit that looks at part of the system. One is a visit that looks at the whole thing again. One is not a visit at all — it is a period that keeps running whether anybody is looking.
Nearly everything written about this field describes the first time. The second time has a different shape, and the shape is worth knowing before you agree to a renewal price.
Predict
Three rhythms, and they do not line up.
Certification runs on a cycle. An initial audit in two stages, then surveillance visits through the cycle, then a recertification audit before the certificate expires. The cycle has historically been three years.
Surveillance samples. A visit looks at a fixed core every time plus a rotating slice of the rest, so one visit is not a small audit — it is a partial one, chosen so that the whole scope gets covered across the cycle.
An opinion over a period does not sample time. Every day in the window is in the window. There is no visit to prepare for because the thing being examined is the past, and the past is already written.
The practical consequence: two of the three can be prepared for and one cannot.
Not everything, and not a random selection either. A fixed set of things comes up every time, and in the rest of the system the auditor rotates.
The recurring core is the management system examining itself: the internal examination you commissioned, the scheduled meeting where leadership looked at the whole picture, what you did about the findings from last time, complaints and incidents, changes to the organisation and the boundary, and how you have been using the certification mark.
That list is worth staring at, because none of it is a security control. It is all second-order: evidence that the machine which maintains the controls is itself running. Those obligations are the reason a certification has a second year with work in it at all, and they exist on only one side.
Only on one side
Almost all of this is structural rather than an oversight. One document is a management system and the other is an opinion about a period, and that single difference generates most of the list.
Auditing yourself before anybody external does
9.2
A management system is expected to check itself on a cycle, which means an internal audit function with findings of its own that the external auditor then reads. The criteria side has monitoring language but nothing that makes the organisation commission an examination of itself, so a company can be entirely dependent on the annual external pass to learn anything.
Leadership sitting down with the whole picture on a schedule
9.3
A scheduled review by the people who control the budget, with a defined set of inputs, is part of the management system itself. Governance criteria on the other side are about the control environment generally and do not produce a recurring meeting with an agenda and minutes that an auditor can ask to see.
An enumerated applicability decision for every annex control
6.1.3
The artefact that lists every control in the annex with a decision and a justification beside it has no counterpart. The criteria side never makes anybody write down what they decided not to do, which removes both the discipline and the paper trail of exclusion.
Keeping a register of the legal and contractual requirements you are subject to
A.5.31
Identifying applicable obligations is a control, so the register is a thing that exists and can be found out of date. On the criteria side obligations enter only through the organisation's own description of its commitments, so an unlisted regulatory requirement is invisible rather than overdue.
Version control over the management system's own documents
7.5
The documents that describe the system are themselves subject to control, which is why a policy with no version and no approval date is a finding. Nothing equivalent exists on the other side: a policy is evidence of design there, and its own provenance is rarely the subject.
Two of those matter more than the rest in a second year, and the identifiers to look up are 9.2 and 9.3. Describing them in our own words: one forces you to commission an examination of yourself on a schedule, by somebody who is not the person running the thing being examined. The other forces a meeting, with defined inputs, attended by the people who control the budget, minuted.
Both are controls. Both have owners. Both drift exactly like the controls in the previous lesson, and both are looked at every single visit, which makes them the two most reliably detected failures in this subject.
Recertification is the end of a cycle rather than a bigger surveillance visit. It goes back across the whole scope, and it asks a question surveillance does not: has this management system been effective over the cycle, and does its scope still describe the organisation.
That second half is the one that catches companies out, and it is the subject of two later lessons in this track. A boundary written for a forty-person company with one region is a boundary that stopped describing anything at some point in year two, and recertification is where somebody reads it out loud.
On the attestation side nothing comes back, because nothing was ever certified. What happens instead is that a new period begins and, at some point after it ends, a new opinion gets written about it.
Two consequences, both unhelpful.
The first is that there is no event to prepare for, so there is no forcing function. Fieldwork for the second report is a conversation about things that have already happened, and by the time it starts, every control that did not run has already not run.
The second is the gap. Your report covers a period that ended, say, in December, and it is now April. For those four months the only thing on offer is a letter in which management asserts that nothing material has changed — signed by you, not by the auditor, and therefore a different kind of object entirely. It is covered properly in track 5; the thing to carry here is that the letter is your assertion, so its value depends on the reader's view of you rather than on anybody's examination.
This is the headline, and it is the opposite of what gets sold.
The fees do fall. Surveillance days are fewer than initial audit days. The readiness assessment was a one-off. Nobody is writing eleven policies again, nobody is running a gap exercise, and the consultant is not on a retainer. A second-year bill genuinely can be a fraction of the first.
The hours do not. A quarterly control owes four instances a year, for ever. The internal examination and the leadership review are new recurring work that did not exist before certification and now happen annually whether or not anybody visits. And on the attestation side there is a trap in the arithmetic: a great many first reports cover three months, because three months was the shortest window that would answer the buyer in time. The second one covers twelve. Four times the days means four times the expected instances, and nothing about that is visible in the fee.
So the honest sentence to say to whoever signs the renewal is that the invoice falls and the work does not, and that the work was always the larger number. Track 0 priced it; the sixth lesson in this track prices it again with the one-off part removed.
Check