Every ISO management system standard requires an organisation to audit itself. Certification adds a separate, independent audit. The two are related but serve different purposes, and confusing them is a common source of weak systems.
Three types of audit
| Type | Who audits | Who is audited | Purpose |
|---|---|---|---|
| First-party (internal) | The organisation itself, or someone acting on its behalf | Its own management system | Check conformity and effectiveness; find improvements |
| Second-party | A customer or other interested party | Its supplier | Check the supplier meets the customer's requirements |
| Third-party (certification) | An independent certification body | The organisation seeking or holding certification | Independently confirm conformity to the standard, leading to certification |
Guidance on auditing management systems — planning programmes, auditor competence, conducting audits — is given in ISO 19011. Certification bodies must additionally meet ISO/IEC 17021-1.
Internal audits
Why they are required
The performance evaluation clause of each standard (clause 9.2 in the Harmonized Structure) requires internal audits at planned intervals to check that the management system conforms to your own requirements and the standard, and that it is effectively implemented and maintained.
What a good internal audit programme looks like
- Planned and risk-based. Audit more often where processes are important, have changed, or have had problems.
- Covers everything over a cycle. All clauses and all processes in scope, across sites and shifts.
- Objective and impartial. Auditors should not audit their own work. Small organisations can use trained staff from other departments or an external internal auditor.
- Evidence-based. Look at records, observe work, interview people — and check results, not just paperwork.
- Followed through. Findings lead to corrections, root-cause analysis and corrective action, which are then verified.
- Reported to management. Results are an input to the management review.
Who can be an internal auditor?
Anyone competent and impartial. Competence typically comes from training in the standard and in auditing techniques, plus practice. Many organisations train a small team of internal auditors from different departments.
Certification audits
Certification audits are carried out by an independent certification body, ideally accredited for the relevant standard and scope. The cycle typically includes:
- Initial certification: stage 1 (readiness) and stage 2 (implementation and effectiveness) — see How to Prepare Your Organization for an ISO Audit
- Surveillance audits: at least annually
- Recertification: before the certificate expires, normally at the end of a three-year cycle
- Special audits: for example scope extensions, transitions to a new edition, or short-notice audits following serious complaints
Certification auditors sample — they cannot see everything. That is why your own internal audits, which can go deeper and more often, are so important.
Key differences at a glance
| Internal audit | Certification audit | |
|---|---|---|
| Purpose | Improve and check your own system | Independent confirmation for certification |
| Conducted by | Your trained staff or an external party on your behalf | Independent certification body |
| Frequency | You decide, based on importance and risk | Set by the certification cycle |
| Outcome | Findings for your own action | Certification decision; findings you must address |
| Depth | Can be detailed and focused on problem areas | Sample-based across the scope |
Can a consultant do our internal audit?
Yes — an external party can conduct internal audits on your behalf. However, to protect impartiality, an organisation that has provided consultancy on your management system should not also act as the certification body for that same system. If you use outside help, keep these roles clearly separate.
Key takeaways
- Internal audits are a requirement of every ISO management system standard and your best early-warning system.
- Certification audits are independent, sample-based and follow a three-year cycle.
- A strong internal audit programme makes certification audits smoother — and makes the system genuinely useful.
Sources & further reading
- ISO 19011:2026 — Guidelines for auditing management systems — ISO
- ISO/IEC 17021-1:2015 — Requirements for bodies providing audit and certification of management systems — ISO
Links open the original publisher's page. Summaries on this page are written by Certsure; for the authoritative text of any standard, refer to the official publication.
