Internal vs External vs Certification Audit: Key Differences

An internal audit is a first-party audit carried out by, or on behalf of, the organisation itself. An external audit is carried out by someone outside it: a customer or other interested party (second-party) or an independent body (third-party). A certification audit is a third-party audit by a certification body that decides whether to grant or maintain a certificate against a standard such as ISO 9001, ISO 22000 or FSSC 22000.

Each type has a different purpose, auditor and consequence. Quality and food safety teams in India and the GCC often face all three in one year, so knowing the differences helps you prepare without duplicating effort.

The three audit parties

ISO 19011:2018, the guideline for auditing management systems, describes three types of audit and applies to all of them:

• First-party (internal): the organisation audits its own system, using trained staff or contracted auditors acting on its behalf.
• Second-party (external provider or customer): a customer audits a supplier, or an organisation audits its own suppliers, against contract terms, specifications and often its own code of practice.
• Third-party: an independent body audits for certification or accreditation, or a statutory or regulatory body carries out its own checks.

ISO 19011 also sets out seven principles of auditing, including independence and an evidence-based approach, and guidance on audit programmes and auditor competence. Certification bodies themselves must meet ISO/IEC 17021-1, which sets requirements for bodies that audit and certify management systems.

Internal vs second-party vs certification audits compared

Inside a certification audit

Stage 1

The stage 1 audit reviews documented information, the scope, site conditions and readiness. The auditor checks whether key elements, such as internal audits and management review, are planned and performed, and identifies areas of concern that could become nonconformities at stage 2.

Stage 2

The stage 2 audit takes place on site and evaluates whether the system is implemented and effective, through interviews, observation and record review. Nonconformities are typically graded major or minor, and the organisation must provide correction and corrective action within the timescale the certification body sets. The certification decision is made by the certification body, not by the auditor on the day.

Surveillance and recertification

Certificates are usually issued on a three-year cycle. Surveillance audits take place at least once each calendar year, except in recertification years, and a recertification audit is completed before the certificate expires. Scheme owners such as FSSC 22000 and BRCGS add their own rules on top of ISO/IEC 17021-1.

Unannounced audits

Some schemes include unannounced audits. FSSC 22000, for example, requires at least one unannounced audit within each certification cycle, and BRCGS offers unannounced options. Check the current version of your scheme, as these rules are revised periodically.

Regulatory inspections are different

A regulatory inspection by an authority such as FSSAI, Dubai Municipality, ADAFSA or the SFDA is carried out under law, not by contract. The inspector checks compliance with legal requirements, may arrive unannounced and can take enforcement action, from improvement notices to fines, suspension or closure. Certification is voluntary; legal compliance is not, and holding a certificate does not exempt a site from inspection.

Accreditation assessments are also third-party, but they assess the competence of laboratories, inspection bodies and certification bodies against standards such as ISO/IEC 17025 or ISO/IEC 17021-1.

How to prepare for each

Internal audits

• Base the audit programme on risk, past findings and process changes
• Use auditors who are trained and independent of the area
• Audit against the standard and your own procedures, then follow findings to CAPA closure

Customer audits

• Ask for the customer's checklist, scope and specification in advance
• Prepare evidence for their priorities, such as testing, traceability and complaints
• Agree corrective action dates you can realistically meet

Certification audits

• Complete a full internal audit cycle and a management review before stage 1
• Close stage 1 concerns well before stage 2
• Brief process owners to answer questions with records, not memory

Worked example: three audits in one quarter at a Kochi spice exporter

A spice processor near Kochi cleans, sterilises, grinds and packs pepper, chilli and turmeric for export. A European importer has made FSSC 22000 certification a condition of a new contract and will also audit the site itself. Both fall in the same quarter.

Month 1, internal audit. The food safety team leader schedules a full internal audit using two trained auditors from other departments. They find incomplete metal detector verification records, no trend analysis of pest activity, and a steam sterilisation step with temperature records but no validation study. Each finding gets a root cause and a CAPA with an owner.

Month 2, buyer audit. The importer's auditor focuses on pesticide residue testing against EU limits, Salmonella and mycotoxin testing plans, foreign matter controls and food fraud risks such as adulteration of chilli powder. A mock recall is traced within the agreed time. One finding, a supplier approval file without a current residue certificate, is corrected within the week.

Month 3, certification audit. Stage 1 confirms readiness, noting that the sterilisation validation must be complete before stage 2. At stage 2 the auditor raises one minor nonconformity on calibration records for a hand-held thermometer. The site submits its corrective action, and the certification body later grants the certificate.

The lesson: one CAPA log and one evidence set served all three audits, so each built on the last.

Common mistakes

• Treating internal audits as rehearsals instead of genuine checks
• Letting staff audit their own work
• Preparing separate, inconsistent evidence for each auditor
• Assuming a certificate means a regulatory inspection will go well
• Closing findings with corrections but no root cause analysis

Key takeaway: Internal audits check your system for your own benefit, customer audits protect the buyer, and certification audits give independent assurance. Run one evidence base and one CAPA system, and each audit becomes easier than the last.

Frequently Asked Questions

What is the difference between an internal and an external audit?

An internal audit is carried out by or for the organisation itself to check its own system. An external audit is carried out by an outside party, either a customer auditing a supplier (second-party) or an independent certification, accreditation or regulatory body (third-party). External audits usually carry commercial or certification consequences.

Is a certification audit the same as an external audit?

A certification audit is one kind of external audit. It is a third-party audit performed by a certification body to decide whether to grant or maintain a certificate. Customer audits are also external, but they are second-party audits with different criteria, purposes and consequences.

What happens in a stage 1 audit?

The auditor reviews documented information, scope, site conditions and readiness, and checks that internal audits and management review are planned or performed. Stage 1 identifies concerns that could become nonconformities at stage 2 and helps plan the stage 2 audit. It is a readiness check rather than the full implementation audit.

How often are surveillance audits carried out?

Under ISO/IEC 17021-1, surveillance audits take place at least once each calendar year, except in recertification years, within a three-year certification cycle. Some schemes add requirements, such as unannounced audits. Confirm the exact schedule with your certification body and the current version of your scheme rules.

Can an internal auditor audit their own department?

ISO 19011 advises that auditors should be independent of the activity audited wherever practicable and should act free from bias and conflict of interest. In small organisations full independence can be difficult, so many use cross-department audits, shared auditors with partner sites or contracted auditors to keep objectivity.

Next steps

Build practical audit skills with Internal Auditing & Audit Readiness Essentials, or, for food businesses, ISO 22000 Internal Auditor: FSMS Auditing & Audit Programme Leadership. Innoryx delivers both online to learners in India and the GCC.

Then read internal auditor skills and audit planning, how to respond to audit nonconformities and our food safety internal audit checklist, or speak to a counsellor.