Certification shows the system worked on audit day. It says little about eighteen months later.
An organization certified eighteen months ago often assumes it is still audit-ready, and is surprised when a surveillance audit finds gaps. The surprise is common. Certification confirms that the quality system existed and worked as documented on the day of the audit. It does not confirm that it still works that way.
Quietly, in most organizations, it does not. The reasons are ordinary.
Staff leave. The person who knew why a control existed and how to run it has gone, and the replacement learned an approximation from a colleague, not from the procedure.
Processes drift. A workaround from a busy month becomes the habit, and nobody updates the procedure.
The business grows past the system. New products, services or sites are not folded back into the quality system, which was designed for a smaller operation.
Internal audits turn into a formality. Once certification pressure passes, they confirm what everyone already assumes instead of testing it.
Audit-readiness work, as opposed to the first certification push, is meant to catch this drift before a surveillance auditor does. The gap between certified and ready widens a little every month. Organizations that check it on a schedule, not only when an audit is near, rarely get an unpleasant finding they could have caught themselves.