Solution: Certification @ TÜV AUSTRIA Group

Types of Audits

Initial, surveillance, and recertification audits differ in their purpose, timing, and scope:

• Initial audits are the first comprehensive assessments conducted to grant certification. They are the most extensive in terms of time and effort required.
• Surveillance audits are conducted annually to verify the ongoing effectiveness and development of the management system. These audits are shorter in duration and focus on random checks, as well as any deficiencies found in previous audits and key points of the standard requirements.
• Recertification audits (also called repeat audits) are required before the certificate expires, typically after three years. These audits involve random checks of all requirements, similar to the initial audit, but require less time and effort—about two-thirds of the initial audit’s duration. Upon successful completion, a new certificate is issued for another three years, which must again be confirmed by annual surveillance audits.

The process of initial, surveillance, and recertification audits applies to several types of certifications, including quality management in education (ISO 21001), anti-bribery management systems (ISO 37001), hotel safety and security standards, and occupational health and safety certification (ISO 45001). For each of these, the certificate is typically valid for three years, requires annual surveillance audits to maintain validity, and a recertification audit before the certificate expires.

A certificate usually is valid for three years.
Annual surveillance audits are required, and at the end of the three‑year cycle, a recertification audit is conducted.

Definition of the scope of the management system

To correctly define the scope of your management system, you should ensure that it covers all relevant areas and processes that are subject to certification.

For example, a comprehensive certification standard for hotels may include hygiene, water and food quality, technical systems, IT security, emergency management, and fire protection. The defined scope should transparently reflect the quality and safety standards you want to demonstrate to both guests and employees. By identifying and documenting these areas in a structured way, the certification process becomes a valuable tool—not only to showcase your high standards, but also to continuously improve them. At the same time, it reinforces the trust that guests, employees, and other stakeholders place in your organization.