On Friday, 9 October 2026, every structural leader at Lazismu Universitas Muhammadiyah Yogyakarta (UMY) sat through the second surveillance audit of the institution's ISO 9001:2015 certificate. Lazismu reported the outcome on 12 October 2026: the audit team found no nonconformities, major or minor, and confirmed that Lazismu UMY remains in line with its SNI ISO 9001:2015 certification. The quality management system in scope supports the collection, administration and distribution of zakat, infak and sedekah funds, the charitable contributions this Indonesian zakat institution manages on behalf of donors.
A result with no findings looks like the end of the story, yet experienced quality managers read it more carefully. Whether you run a charity, a hospital, a school or a factory, the useful question is what a clean surveillance audit proves and what it cannot prove. A clean result confirms that the sampled processes met requirements on the audit days; it does not confirm that every process, in every unit, will keep doing so. Understanding that gap is what separates organizations that keep their certificates comfortably from those that scramble before recertification.
To see why, it helps to look at how surveillance fits into the certificate lifecycle. ISO 9001 certificates run for three years, and certification bodies working to ISO/IEC 17021-1 monitor holders in between. The table below sets out the typical rhythm and shows where Lazismu UMY's October audit sits.
| Stage | Timing | What auditors concentrate on |
|---|---|---|
| Certification audit (stages 1 and 2) | Start of cycle | Documented system first, then implementation across the full scope |
| First surveillance | Within 12 months of the certification decision | Sampled processes, closure of earlier findings, correct use of certification claims |
| Second surveillance | Year two | Different sample, effectiveness of corrective actions, evidence of continual improvement |
| Recertification | Before the certificate expires | Whole-system review of three years of performance |
Because auditors sample rather than inspect everything, two consecutive surveillance audits at the same organization can look quite different. The wording of the audit report matters just as much as the headline result, so the next table translates the four kinds of audit remarks, including the four positive observations and single opportunity for improvement reported for Lazismu UMY.
| Remark | Meaning | What the organization should do |
|---|---|---|
| Major nonconformity | A failure that undermines the system's ability to deliver intended results | Close within the certification body's deadline; unresolved cases can put the certificate at risk |
| Minor nonconformity | An isolated lapse that does not break the system overall | Root cause analysis, corrective action, evidence of closure |
| Positive observation | A good practice the auditor wants recorded | Protect it and spread it to other units |
| Opportunity for improvement | A suggestion, not a breach of a requirement | Decide, assign an owner, review in management review |
What Was Reported from the 9 October 2026 Audit
The audit involved the full structural leadership of Lazismu UMY. The auditor recorded no major or minor nonconformities, four positive observations and one opportunity for improvement.
The head of Lazismu UMY, Wahyu Manuhara Putra, stressed that the institution's growth needs to be matched by stronger governance.
Reported next steps: act on the improvement opportunity, raise the competence of staff through certification and training programs, and keep donor trust and service consistency strong.
Taken together, those details suggest five habits that any donor-funded or service-driven organization can borrow. They are drawn from the reported facts and framed as practices you can test against your own system.
Make the audit a leadership event
With the whole structural leadership taking part, no unit could treat quality as someone else's job. When leaders answer auditor questions in their own words, it shows the system lives in the organization rather than in a binder.
Read the positive observations as assets
Four positive observations are four practices the auditor considers worth protecting. Record them, name who owns them, and check that a change of staff or software does not quietly erase them.
Close the single improvement opportunity visibly
Handled through management review with an owner and a date, one opportunity for improvement becomes proof of continual improvement. Left unattended, it tends to return next year as a formal finding.
Scale governance with growth
The head of office linked institutional growth to stronger governance. More donors, programs or branches multiply the places where a process can fail, so authorities, document control and risk reviews need updating at the same pace.
Build competence deliberately
The stated plan to strengthen staff competence through certification and training reflects the competence requirements of ISO 9001. People who understand why a procedure exists adapt it sensibly, while people who only follow forms drift as soon as nobody is watching.
Turning those habits into routine is mostly a matter of calendar discipline. The checks below are worth running throughout the year, and an organization with a working system can usually complete most of them within a few weeks:
- Confirm every corrective action from the previous audit is closed and evidenced.
- Run internal audits that reach every unit, especially the ones rarely examined.
- Hold management reviews that end in recorded decisions and owners.
- Test whether quality objectives still fit the organization as it is today.
- Keep training and competence records current for everyone who runs a process.
- Rehearse how unit leaders explain their processes with real examples.
Certificate holders also have a bigger date to plan around than the next surveillance visit. The 2026 edition of ISO 9001 has been published, so an organization certified to the 2015 edition, as Lazismu UMY is according to the report, should ask its certification body about transition rules and deadlines and put a plan on the calendar now. Starting early turns transition into scheduled improvement instead of a rush against a deadline.
Worth remembering: ISO 9001 supports consistency and accountability, particularly valuable when donors entrust funds to an organization, but it does not replace legal, regulatory or sector-specific obligations.
Frequently Asked Questions
The organization must analyze the root cause and close the finding within the deadline set by its certification body, with evidence the fix works. If a major nonconformity is not resolved in time, the certification body can suspend the certificate. Minor nonconformities need a corrective action plan and later verification.
No. Auditors sample processes and clauses, check follow-up of earlier findings, and look at core elements such as internal audit and management review. Over the three-year cycle the sampling is designed to cover the full system, so weak areas tend to surface eventually.
No. An opportunity for improvement is not a breach of a requirement. It is a suggestion from the auditor, and the organization decides how to respond. Handling it through management review shows the continual improvement that ISO 9001 expects.
Yes. The standard applies to any organization that wants consistent, documented and improving services. For donor-funded organizations it provides a structured way to show accountability, but it does not replace legal, regulatory or sector-specific obligations.
Yes. The 2026 edition has been published, so certificate holders should ask their certification body about the transition rules and deadlines and build a transition plan early rather than waiting for the final months.
Want Your Quality System to Stay Strong After Certification?
Arafar Nusa supports organizations across sectors, from ISO 9001 certification readiness to surveillance audit preparation and transition to the latest edition. First consultation is free.
💬 Free Consultation via WhatsApp