Internal audit and certification: different purposes

PRACTICAL GUIDANCE

The starting point

An internal audit helps an organisation evaluate its own management system. A certification audit supports an independent certification decision. Outsourcing the first activity does not turn it into the second.

Understand the three audit perspectives

An internal, or first-party, audit is conducted by or on behalf of the organisation. A second-party audit is commonly performed by a customer or another interested party, including an audit of a supplier. A third-party certification audit is performed as part of an independent certification process.

ISO 19011:2026 is guidance for auditing management systems. It covers audit principles, programmes, conduct and competence. It is not an organisational certification requirements standard. Third-party management system certification has its own requirements, including ISO/IEC 17021-1.

Use internal audit to learn how the system works

Our recommended internal audit objective is to examine an important process against clear criteria and provide evidence that management can act on. Select a scope that is meaningful: a complete supplier onboarding process may reveal more than checking whether several policy documents exist.

Include examples of normal work and exceptions. Ask people to show how a decision was made, where the record is kept and what happened next. Compare accounts with observable evidence. A useful audit report explains the criteria, scope, evidence, findings and limitations so that readers can understand the basis of the conclusion.

Protect objectivity without assuming one staffing model

The appropriate arrangements depend on the organisation’s size, structure and complexity. An internal employee, a cross-functional team or an external provider may perform an internal audit. What matters is whether the work is competent and sufficiently objective for its purpose.

Our recommendation is to identify conflicts before assigning the work. Someone who designed or operates a process may be poorly placed to challenge their own decisions. Document how the organisation will obtain appropriate challenge, including independent review where needed. Calling an engagement independent does not remove the need to examine the actual relationships.

Understand the certification body’s role

A certification body evaluates the management system within an agreed scope and applies its certification process. A successful internal audit is useful preparation but does not entitle the organisation to a certificate.

Give the certification body accurate information about scope, sites, activities and relevant changes. Its audit programme and decision are separate from a consultant’s readiness opinion. The organisation remains responsible for its system, and the audit is based on sampled evidence rather than continuous observation of every activity.

Choose the work that answers the question

If the question is “Where are our gaps?”, a gap assessment may be appropriate. If it is “Are we implementing our system against these criteria?”, an internal audit can provide structured evidence. If it is “Can we obtain accredited certification?”, engage a suitably accredited certification body for the relevant process.

Our practical engagement brief sets out the purpose, criteria, scope, method, competence, independence arrangements, outputs and handling of sensitive evidence. Agree these before work begins. This reduces the chance that a short advisory review will later be described as a full audit, or that an audit report will be mistaken for certification.

Related guidance and practical next steps