At least one surveillance audit in each three-year period after initial certification is unannounced (clients may opt for all surveillances, and recertification on request; initial audits never). The CB picks the date without notice and shares the plan only at the opening meeting (a window, typically 30 days, may be given where visas require it); the audit runs in normal hours across shifts, the CB and client may fix in advance days on which no visit will happen, the facility inspection begins within an hour of arrival, all requirements are covered with an announced follow-up within 28 days for anything missed, separate head office audits stay announced while on-site head office work does not, and off-site locations including accommodation are included. Refusal leads to suspension within three working days and withdrawal if the audit has not happened within six months.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.