Internal Audit vs Certification Audit: What Is the Difference?

Many organizations use the words internal audit and certification audit as if they mean the same thing. But they do not. Both involve checking a management system against requirements, but their purpose, auditor, independence and outcomes are different.

Understanding the difference helps organizations prepare their internal audit programme and better understand what happens during an external certification audit.

ISO 19011:2026 distinguishes between first-party internal audits, second-party audits and third-party certification audits. It focuses mainly on first- and second-party auditing, while ISO/IEC 17021-1 provides requirements for third-party management-system certification.

Quick Difference

What Is an Internal Audit?

An internal audit is an audit carried out on behalf of the organization itself. The purpose is to determine whether the management system is working as intended and whether applicable requirements are being met.

For example, an organization with a quality management system may use internal audits to examine:

• Process performance
• Documented information
• Customer-related processes
• Supplier controls
• Training and competence
• Internal procedures
• Corrective actions
• Objectives and performance
• Risk-related controls
• Previous audit findings

ISO 9001 itself identifies internal audits as an important way for organizations to check how their quality management system is working.

Why Do Organizations Conduct Internal Audits?

An internal audit can help an organization identify problems before they become larger issues. For example, an internal audit may identify:

• A required record is not consistently maintained
• Employees are following an outdated procedure
• A supplier evaluation is incomplete
• Corrective actions have not been effectively implemented
• A process is not producing the expected results
• A documented procedure does not match actual practice

Finding these issues internally gives the organization an opportunity to take action before a customer, regulator or certification auditor identifies the same problem.

What Is a Certification Audit?

A certification audit is a third-party audit performed by an independent certification body for the purpose of assessing conformity with the applicable management-system requirements.

ISO/IEC 17021-1 describes management-system certification as a third-party conformity-assessment activity and establishes requirements related to the competence, consistency and impartiality of certification bodies.

The certification audit may be part of:

• Initial certification
• Surveillance
• Recertification
• A special audit, where applicable

The exact audit arrangements depend on the applicable certification scheme and circumstances.

Who Conducts the Audit?

This is one of the clearest differences.

Internal Audit

An internal audit may be conducted by:

• An employee trained as an internal auditor
• An internal audit team
• An appropriately qualified external person working on behalf of the organization

The organization remains responsible for its internal audit programme. Auditor competence and impartiality should be considered when planning internal audits. For example, having someone audit their own work can create an independence problem.

Certification Audit

A certification audit is conducted by auditors working for or on behalf of the certification body. The certification body must operate with appropriate competence, consistency and impartiality under the applicable requirements for certification bodies.

What Does an Internal Auditor Look For?

The internal auditor is usually trying to understand whether the management system is being implemented and whether it is effective.

They may ask:

• Is the process being followed?
• Are employees aware of their responsibilities?
• Are required records available?
• Are controls working?
• Are objectives being monitored?
• Are previous findings closed effectively?
• Are risks and opportunities being addressed?
• Are documented procedures consistent with actual activities?

The auditor collects evidence before reaching conclusions.

What Does a Certification Auditor Look For?

A certification auditor also collects objective evidence, but the audit is performed within the defined certification scope and applicable certification requirements.

Depending on the standard and organization, the auditor may examine:

• Processes
• Records
• Personnel competence
• Operational controls
• Objectives
• Monitoring and measurement
• Risks and opportunities
• Internal audit results
• Management review
• Corrective actions
• Customer-related information
• Relevant outsourced processes
• Actual implementation of the management system

The auditor is not simply checking whether a company has created documents. The key question is whether the management system has been implemented and whether there is sufficient evidence to evaluate conformity.

Internal Audit Is Not a Practice Run for Certification

This is an important misunderstanding. An internal audit should not be treated as a rehearsal designed only to make the organization "pass" the certification audit.

Its purpose is broader. A useful internal audit should provide the organization with information about the actual performance of its management system.

For example, if an internal auditor finds that a process is technically documented but employees consistently follow a different method, that is valuable information.

The organization can investigate the reason and decide whether the process, documentation, training or controls need improvement.

Can an Internal Audit Replace a Certification Audit?

No. An internal audit and certification audit have different purposes. An internal audit provides first-party evaluation for the organization. A certification audit is a third-party conformity assessment performed by an independent certification body.

ISO 19011:2026 specifically distinguishes first-party internal audits from third-party certification audits. Therefore, an organization cannot simply perform its own internal audit and issue itself an independent certification certificate.

How the Two Audits Work Together

The two audits can complement each other.

A simple cycle can look like this:

Management System → Internal Audit → Corrective Action → Management Review → Certification Audit → Findings/Actions → Certification Decision

The internal audit gives the organization an opportunity to evaluate its system before and during the certification cycle. The certification audit then provides an independent third-party assessment.

What Should an Organization Do Before a Certification Audit?

A useful preparation approach is to:

1. Complete Planned Internal Audits

Do not leave the internal audit programme until the last moment.

2. Review Previous Findings

Check whether corrective actions have actually been implemented and whether effectiveness has been evaluated where necessary.

3. Review Management-System Records

Make sure required records are available and controlled.

4. Check Actual Practice

Do not only review documents. Walk through important processes and confirm that employees are actually following the established arrangements.

5. Review Management Performance

Check relevant objectives, monitoring results, management review outputs and other required information.

6. Make Sure Employees Understand Their Roles

Employees do not need to memorize the ISO standard. They should, however, understand the processes they work in and their responsibilities.

Common Misunderstandings

"The internal auditor should find everything before certification."

Not necessarily. Audits use sampling, and no audit can examine every activity, record and transaction.

"If our documents are complete, we will pass."

Not necessarily. A management system must be implemented, not merely documented.

"The certification auditor will fix our problems."

The certification auditor evaluates conformity. The organization remains responsible for addressing its own management-system issues.

"Internal audits are only required before certification."

Internal auditing is part of maintaining an effective management system and should be planned according to applicable requirements and the organization's audit programme.

Why Both Audits Matter

Internal audits and certification audits serve different purposes, but both can contribute to confidence in a management system.

The internal audit helps the organization understand its own system. The certification audit provides independent third-party assessment.

Together, they create a useful distinction:

Internal audit = "How is our system working?"

Certification audit = "Does the management system conform to the applicable certification requirements?"

ISO 19011:2026 provides current guidance for management-system auditing, including audit principles, audit programmes and conducting audits.

Final Takeaway

An internal audit and a certification audit should not be viewed as competing activities. They have different roles.

An organization uses internal audits to evaluate and improve its own management system. A certification body conducts a third-party audit to independently assess conformity within the certification process.

The strongest organizations do not wait for the certification auditor to discover every problem. They use their internal audit programme to identify weaknesses early, take appropriate action and continually improve the management system.

Frequently Asked Questions

Is an internal audit the same as an ISO certification audit?

No. An internal audit is generally a first-party audit conducted for the organization, while a certification audit is a third-party conformity assessment conducted by an independent certification body.

Can an employee conduct an internal audit?

Yes, provided the person has appropriate competence and the audit is planned and conducted with suitable objectivity and impartiality.

Can a certification auditor provide consultancy during the audit?

Certification audits and consultancy are different activities. Certification bodies must manage impartiality and conflicts of interest under applicable certification-body requirements.

Does every company need a certification audit?

Certification is not universally mandatory. Whether an organization seeks certification depends on its business, customers, contracts, regulatory environment and other requirements.

How often should internal audits be conducted?

The frequency should be determined through the organization's audit programme, considering factors such as process importance, changes, previous audit results and risks.

Does an internal audit guarantee certification?

No. An internal audit can help identify and address weaknesses, but certification is based on an independent certification audit and the applicable certification decision process.