Why management systems fail in year two, not year one

Surveillance visits are shorter than the certification audit and sample a subset, but they are real audits and they can raise nonconformities. What they look for is continuity: that internal audits kept happening, that management review met and decided things, that risks were reassessed, that last year’s findings were closed, and that the controls still produce records.

This is exactly where a system built by a departing consultant comes apart. The documents are immaculate, the policies say the right things, and nothing has been operated since the certificate arrived. An auditor sampling for records from eight months ago finds none, and the finding is not a control gap — it is that the management system stopped being a management system.

The organisations that sail through are rarely the ones with the best documentation. They are the ones where the periodic controls have an owner, a calendar entry and somewhere the output lands automatically, so a quiet year still produces a year of evidence.