The most common cause of a suspended certificate is a system that stops being maintained once the certificate is on the wall. Internal audits are skipped, management reviews stop happening, and by surveillance year two the system is a paper record of what the business used to do.
A minimum maintenance rhythm
One internal audit cycle per year, one management review per year, and a monthly check of corrective actions is the minimum viable rhythm to keep a certificate current. Most SMEs need less than half a day per month to stay on top of it.