Internal audit vs external audit explained

The short answer

An internal audit is conducted by, or on behalf of, your organisation to understand whether your management system is working as intended and where it could be improved.

An external audit is conducted by someone outside your organisation to independently assess whether you meet specified requirements. This might be a customer assessing you as a supplier, or a certification body auditing you against a standard such as ISO 9001, ISO 14001 or ISO 45001.

Put simply:

Internal audit helps you understand and improve your system. External audit provides assurance to others that your system meets requirements.

What is an internal audit?

An internal audit is a first-party audit, meaning the organisation is effectively auditing itself.

It might be carried out by trained employees from another team or department, or by an external auditor engaged to conduct the audit on the organisation's behalf. Either way, the audit belongs to the organisation and should provide useful information about how its management system is performing.

That distinction is important.

A good internal audit isn't just a rehearsal for certification. And it shouldn't simply involve working through a checklist to confirm that procedures exist.

It is an opportunity to look at how work is actually being done.

Are processes working as intended? Are requirements being met? Are controls effective in practice? Are there differences between documented processes and the way work happens day to day? Where are people experiencing recurring problems or unnecessary complexity?

These are the kinds of questions that turn internal auditing from a compliance exercise into a useful source of organisational insight.

Because the organisation owns the audit program, it can also decide where to focus its attention. Higher-risk processes, recent changes, previous audit findings, recurring issues and areas of poor performance may warrant more frequent or more detailed auditing.

The goal isn't simply to find nonconformances. It's to understand the system well enough to improve it.

What is an external audit?

An external audit is conducted by someone independent of the organisation being audited.

In the management systems world, there are two common types.

A second-party audit is typically conducted by a customer, or someone acting on their behalf, to assess whether a supplier meets particular contractual, technical or management system requirements.

A third-party audit is conducted by an independent certification body. If your organisation is seeking or maintaining certification to a standard such as ISO 9001, this is the audit that determines whether your management system meets the requirements for certification.

Independence is a key part of the process.

The external auditor isn't responsible for running your management system or fixing the issues they identify. Their role is to objectively assess the available evidence against defined criteria and report what they find.

That independent assessment gives customers, regulators and other interested parties greater confidence that an organisation's management system meets recognised requirements.

Internal audit vs external audit: the key differences

Purpose

Internal audits help the organisation evaluate and improve its own management system.

External audits provide independent assurance that specified requirements are being met.

Who conducts the audit?

Internal audits can be conducted by appropriately competent people within the organisation or by someone engaged to audit on its behalf.

External audits are conducted by someone outside the organisation, such as a customer auditor or certification body auditor.

Independence and objectivity

Internal auditors still need to be objective and impartial. Where practical, they should not audit work for which they are directly responsible.

External auditors are independent of the organisation and assess it against agreed audit criteria.

Frequency

Internal audit frequency is determined by the organisation's audit programme. Rather than giving every process exactly the same attention, the programme should consider factors such as importance, risk, changes, previous results and performance.

Certification audits follow a defined certification cycle. This will generally include an initial certification audit, ongoing surveillance audits and recertification.

How the findings are used

Internal audit findings give your organisation information it can act on. They may lead to corrective action, changes to processes, further investigation or opportunities for improvement.

External audit findings may influence certification, supplier approval, contractual requirements or a customer's confidence in your organisation.

How internal and external audits work together

Internal and external audits shouldn't be viewed as competing activities. Done well, they complement each other.

Your internal audit program gives you the opportunity to understand your management system throughout the year, rather than waiting for an external auditor to tell you where the problems are.

This is one of the biggest differences between organisations that struggle through audit season and those that don't.

If internal audits are genuinely exploring how processes are working, identifying weaknesses and prompting meaningful action, an external audit shouldn't require weeks of frantic preparation.

The evidence should already exist

Actions should already be tracked

People should understand their processes

Known problems should already be visible and being managed

The external audit then becomes another useful assessment of a system you already understand, rather than an annual search for evidence before the auditor arrives.

Do you need both internal and external audits?

If your organisation maintains certification to a management system standard such as ISO 9001, ISO 14001 or ISO 45001, internal auditing is part of maintaining that management system, while external certification audits provide the independent assessment required for certification.

But internal auditing isn't only useful for certified organisations.

An organisation can use internal audits to better understand its processes, identify risks, test whether controls are working and find opportunities for improvement, regardless of whether certification is the end goal.

You may also encounter external audits without being certified. Customers often conduct second-party audits of suppliers to understand whether they can consistently meet contractual, quality, safety or other requirements.

For most organisations, the strongest place to start is with the part you can control: a well-built internal audit program.

What makes a good internal auditor?

The mechanics of auditing can be taught fairly quickly. The bigger skill is learning how to conduct an audit that produces useful information.

Good auditors know how to plan an audit around what matters, ask questions that get beyond rehearsed answers, follow evidence without jumping to conclusions and distinguish between an isolated issue and a weakness in the wider system.

They also know how to write findings clearly enough that someone can actually do something with them.

These skills matter whether you're conducting internal audits, preparing for certification or developing towards a career as a professional auditor.

If you want to develop your auditing capability, our Integrated Management Systems Lead Auditor course covers the auditing process across ISO management system standards, from planning and evidence gathering through to findings and reporting.

If you're specifically looking to strengthen your organisation's internal audit program, our guide to understanding internal auditing is a good place to continue.

It's important to remember: a good internal audit doesn't just help you pass the next external audit. It helps you understand whether your management system is actually helping the organisation work better.