Free resource
For already-certified teams: what to confirm before the surveillance auditor arrives - prior findings, evidence freshness, drift since certification and governance.
The actual structure of the file, straight from the template we use on live engagements.
Sheet: Start here
Read this tab first, then work through the checklist. Score honestly - a 'Partly' you can see is worth more than a 'Yes' you cannot evidence. This is a working tool, not a certificate: it shows where an assessor will push, before they do.
| Topic | Detail |
|---|---|
| What this is | For already-certified teams. Surveillance auditors do not re-audit everything - they look for drift since certification and check your prior findings stayed closed. This finds the drift first. |
| How to score | Yes = in place and you can show the evidence today. Partly = it exists but is incomplete, informal or unevidenced. No = not in place. Only a clear Yes counts when it is audited. |
| The #1 mistake | Going quiet after certification, then reviving the ISMS the month before surveillance. Evidence all dated to audit week is the clearest signal of a paper system. |
| A second pair of eyes | If you want someone who has sat on the other side of the audit table to sanity-check your scoring before it counts, that is what we do at kellwick.com. |
Sheet: Surveillance Prep
Score each item and fix anything that is not a clear Yes before the visit. The middle columns show what a pass looks like and the drift signal auditors look for.
| Area | Check | What good looks like | Most common failure (the red flag) | Status (Yes / Partly / No) | Owner | Notes |
|---|---|---|---|---|---|---|
| Prior findings | Every prior nonconformity is closed with evidence it stayed closed | Each prior NC has closure evidence and a later check that it held | NCs closed on paper while the underlying issue quietly returned | - | - | - |
| Risk register | The risk register has been reviewed and updated since certification | The register shows changes reflecting this year's reality | Untouched since the certification audit - frozen in time | - | - | - |
| Internal audit | An internal audit has been run this cycle, by someone independent | A fresh internal audit this cycle, with findings and independence | Last year's internal audit reused, or none run this cycle | - | - | - |
| Management review | A management review has been held with real decisions recorded | A current-cycle review with decisions and resource allocated | No review since certification; the cadence lapsed | - | - | - |
Preview only. The download is a fully editable .xlsx file.
Go deeper
See how this template fits the wider readiness work, and where we pick it up on a live engagement.
Explore the related serviceMore resources