If you are preparing for ISO certification, you will quickly run into two terms: internal audit and external audit. Many business owners, especially startups and MSMEs, use them interchangeably or assume one can replace the other. They cannot. Understanding internal audit vs external audit in ISO is essential if you want to get certified, stay certified and actually improve how your business runs.
In this guide, we explain what each audit is, who conducts it, how often it happens, how the two differ and how to use internal audits to pass your external ISO audit with confidence.
What Is an Internal Audit in ISO?
An ISO internal audit is a systematic, documented check of your own management system, carried out by your organisation. Its purpose is to confirm that your processes follow the ISO standard you have adopted, such as ISO 9001, ISO 14001, ISO 45001 or ISO 27001, and that they follow your own documented procedures.
Internal audits are not optional. Clause 9.2 of the major ISO management system standards requires you to conduct internal audits at planned intervals. Without them, you cannot demonstrate that your management system is working, and a certification body will raise a nonconformity.
Key features of an ISO internal audit:
- Conducted by your own people, or by a consultant you appoint to act on your behalf.
- Auditors must be objective and impartial, so nobody should audit their own work.
- Planned in advance through an audit programme that considers the importance of processes and the results of earlier audits.
- Focused on improvement, not just compliance. Findings feed directly into corrective action and management review.
Think of the internal audit as a practice exam. It is your chance to find and fix gaps before an outsider finds them for you.
What Is an External Audit in ISO?
An external audit is carried out by someone outside your organisation. In the ISO context, the term usually refers to the third-party certification audit conducted by an accredited certification body. The auditor checks whether your management system meets the requirements of the standard and decides whether to recommend you consulat a leadinf consultant of ISO certification in Delhi.
External audits also include second-party audits, where a customer audits their supplier, but certification audits are what most businesses mean when they say external ISO audit.
A certification audit typically runs in stages:
- Stage 1 audit: a review of your documentation and readiness, often partly done on site.
- Stage 2 audit: a detailed on-site assessment to verify that your system is actually implemented and effective.
- Surveillance audits: follow-up audits, usually every year, to confirm you continue to comply.
- Recertification audit: a full reassessment before your three-year certificate expires.
The independence of the external auditor is the whole point. A certificate carries weight with customers, tenders and regulators precisely because an impartial, accredited body vouches for it.
Internal Audit vs External Audit in ISO: Key Differences
The table below summarises the difference between internal and external audit in ISO.
|
Factor
|
Internal
Audit
|
External
Audit
|
|
Done by
|
Your team
or consultant
|
Certification
body
|
|
Purpose
|
Find gaps
and improve
|
Grant or
keep certificate
|
|
Frequency
|
Planned,
usually yearly
|
Yearly,
plus 3-year renewal
|
|
Cost
|
Low
(internal time)
|
Audit fee
|
|
Result
|
Report and
corrective actions
|
Certification
decision
|
In short, the internal audit is a self-check that you control, while the external audit is an independent verdict that you earn.
Internal Audit Requirements Across ISO Standards
The requirement for internal audits comes from the harmonised structure used by modern ISO management system standards. Whether you follow ISO 9001 for quality, ISO 14001 for environment, ISO 45001 for occupational health and safety or ISO 27001 for information security, you must: - Plan, establish and maintain an audit programme.
- Define audit criteria and scope for each audit.
- Select auditors who ensure objectivity and impartiality.
- Report results to relevant management.
- Take corrective action without undue delay.
- Keep documented information as evidence of the programme and results.
The international guideline for auditing management systems is ISO 19011. It is not a certifiable standard, but it is the best reference for planning and running good audits. Certification bodies themselves operate under ISO/IEC 17021-1.
How the ISO Internal Audit Process Works
A practical internal audit usually follows these steps:
- Prepare the audit programme. List the processes, departments and standard clauses to be covered during the year.
- Appoint competent auditors. Training in ISO 19011 and the relevant standard is strongly recommended.
- Issue an audit plan and checklist. Tell auditees what will be checked and when.
- Conduct the audit. Review records, observe operations and interview staff.
- Record findings. Classify them as conformities, nonconformities or opportunities for improvement.
- Raise corrective actions. Identify root causes, fix the problem and verify the fix.
- Report to management. The results become an input to the management review meeting.
Keep your evidence tidy. Auditors from the certification body will almost always ask to see your internal audit reports, checklists and corrective action records.
How the ISO External Audit Process Works
The external audit begins when you apply to a certification body. After a contract is signed, the stage 1 audit checks whether your system is ready. If gaps are found, you fix them before stage 2. In stage 2, auditors sample processes, records and people to confirm the system is implemented and effective.
Findings are usually graded as:
- Major nonconformity: a failure to meet a requirement that affects the system's ability to deliver results. It must be closed before certification.
- Minor nonconformity: an isolated lapse that needs a corrective action plan.
- Observation or opportunity for improvement: a suggestion that is not mandatory.
Once nonconformities are closed, the certification body issues the ISO certificate, valid for three years subject to successful surveillance audits.
Common Mistakes Businesses Make
After working with many organisations on ISO certification, a few patterns appear again and again:
- Treating the internal audit as a formality. Pencil-whipped audits with no real findings look suspicious to external auditors.
- Auditing your own work. This breaks the impartiality requirement.
- Skipping internal audits before surveillance visits. Certification bodies expect a full cycle of audits across the year.
- Ignoring corrective actions. An open finding from last year is a red flag.
- Confusing the roles. Internal audits cannot grant certification, and external audits are not a substitute for ongoing self-checks.
How Internal Audits Help You Pass the External Audit
The two audits work as a pair. A strong internal audit programme reveals gaps early, builds staff confidence and gives you a record of continual improvement. When the external auditor arrives, you can show that you already found issues, fixed them and verified the results.
A simple readiness approach is to complete at least one full internal audit covering all clauses and departments, hold a management review using those results, and close all corrective actions before your stage 2 audit. This one habit prevents most last-minute surprises.
Frequently Asked Questions
Is an internal audit mandatory for ISO certification?
Yes. Internal audits at planned intervals are a requirement in clause 9.2 of the major ISO standards, and certification bodies check for them.
Can the same person do the internal audit and the external audit?
No. A consultant who helped build your system can support internal audits, but the certification body's auditor must be independent of your organisation and your consultant.
How often should internal audits be done?
The standard says at planned intervals. Most organisations audit every process at least once a year, with higher-risk areas audited more often.
Does an external audit replace the internal audit?
No. They serve different purposes, and you need both to maintain a healthy, certified management system.
Conclusion
The debate of internal audit vs external audit in ISO is not about choosing one over the other. The internal audit is your ongoing health check, and the external audit is your independent proof. Run honest internal audits, act on the findings and you will walk into every external audit prepared, and your ISO certification will deliver real business value instead of just a certificate on the wall.
ALSO READ
