The two are confused because they share a vocabulary and produce documents with the same headings. Both are called audits. Both involve someone asking questions of process owners, looking at records and writing down what they found. Both end in a report with a scope, a set of findings and a conclusion. An organisation that has never been through either can be forgiven for thinking the second is the first done more thoroughly, by people with better briefcases.
They are not the same instrument, and the difference is not thoroughness. It is who is auditing whom, what is produced, and whose name goes on it. Those three differences decide what the output is worth, what it obliges anyone to do, and whether it can be substituted for the other. An internal audit cannot become a certification audit by being more rigorous, and a certificate does not discharge the duty to run internal audits. Getting the two the wrong way round is expensive in both directions: an organisation that prepares for a certification it is not ready for, or one that treats its internal programme as an inspection it will never have to sit.
The same definition, applied from different sides
ISO 9000:2015 defines an audit as a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria. ISO 19011:2018 carries the same definition into its guidance. Nothing in the definition distinguishes the two kinds, and nothing needs to: the definition describes the activity, not the relationship behind it.
Independent is the word that does the work, and it is a relative term. An internal auditor is independent of the process being audited — they do not run it, cannot be its owner, and are not permitted to audit their own work — but they are employed by the same organisation, report inside it, and are paid by it. A certification auditor is independent of the organisation itself. Both are honest applications of the word independence; they are not the same degree of it, and the difference cannot be closed by method.
The criteria differ for the same reason. An internal audit is conducted against the standard and against the organisation’s own procedures, and the second criterion is where most real nonconformities are found, because most organisations write a procedure that conforms and then work to a different rhythm. A certification audit is conducted against the standard, plus the certification body’s own rules — its accreditation obligations, its grading definitions and its sampling conventions — none of which the organisation wrote and few of which it can see in advance.
First party, second party, third party
ISO 19011:2018 sorts audits by the relationship between auditor and auditee, and the sorting is the useful part of the vocabulary.
A first-party audit is an internal audit: conducted by the organisation on itself, for its own management. A second-party audit is conducted by an interested party — most often a customer auditing a supplier, or a parent company auditing a subsidiary — and it is the category most often mistaken for an internal audit, because it is sometimes performed by people in the same group. It is not internal: the report goes to the customer, the criterion is usually the contract plus the standard, and the auditee has a commercial interest in the conclusion.
A third-party audit is conducted by an external, independent organisation with no interest in the outcome: a certification body, an accreditation body or a regulator. Certification is the common case, and it is the one this piece means by a certification audit.
The distinction is not academic, because the party decides what the auditee can do with the result. A first-party finding is a management instruction that the organisation may accept, schedule or decline, and it binds nobody outside the building. A second-party finding binds a supplier through the contract, or through the customer’s decision to keep buying. A third-party nonconformity binds the certificate: unresolved, it withholds or withdraws the thing the organisation was buying.
The two instruments side by side
Table 1. The same activity, two relationships. Source: ISO 9001:2015 clause 9.2, ISO 19011:2018 clause 6 and the certification-body requirements described in ISO/IEC 17021-1; the internal column reflects the convention used by the studio’s ISO Auditor.
| Internal audit | Certification audit | |
|---|---|---|
| Party | First party — the organisation auditing itself | Third party — an accredited certification body |
| Who is audited | A process, a site or a shift, named in the programme | The management system, within a defined scope |
| Criteria | ISO 9001:2015 and the organisation’s own procedures | ISO 9001:2015, plus the certification body’s rules |
| Who selects the auditor | The organisation; must not audit their own work | The certification body; the team must be independent of the organisation |
| Produced | Audit report and findings log, for management | Stage 1 and stage 2 reports, nonconformity reports, a certificate with scope and expiry |
| Grading vocabulary | The organisation’s own definitions, published before use | Major and minor, under the body’s own definitions |
| Signed by | The auditor who conducted it | The audit team leader, then a certification decision by personnel who did not audit |
| What it obliges | Correction, cause analysis, action, verification; review by management | Correction before the certificate, or within the deadline set for a minor |
| Interval | The programme the organisation sets, per clause 9.2.2 | Three-year cycle: surveillance in years one and two, recertification in year three |
| If it goes badly | A finding that management may reasonably defer, and the next audit finds it again | A certificate withheld, suspended or withdrawn |
Two rows deserve more than a table cell.
The grading vocabulary is not a matter of taste. Major and minor are defined by certification bodies under their accreditation rules, and a major is the finding that puts the certificate at risk. An internal programme that borrows the words borrows those consequences without the rulebook: the auditee asks what makes a nonconformity major, and the honest answer is that a rule set not governing this audit says so. An internal programme has two defensible options — adopt a named external scheme with its definitions, or define its own and publish them before the first entry. The studio’s convention is the second, four grades defined in the log’s front matter; the grades and the tests that assign them are set out in the piece on grading a finding, and they are not ISO 9001’s.
The interval row is where the two instruments touch. Clause 9.2.2 requires the organisation to plan an audit programme, with frequency, methods, responsibilities, planning requirements and reporting, taking account of the importance of the processes concerned, changes affecting the organisation, and the results of previous audits. A certificate does not remove that duty. The certification body audits the programme: it asks for the schedule, the reports and the evidence that results reached management, and where they do not exist the finding is against the organisation’s own planning clause. Buying a certificate does not buy the internal audit function, and an organisation that stops auditing internally once certified has misread what it purchased.
The same gap, written twice
The clearest way to see the structural difference is to take one deficiency and write it both ways.
An illustrative organisation keeps a calibration register. The register lists forty instruments by asset number and location, and it records the date each was last calibrated. It does not record the calibration interval, so nothing in the register shows which instruments are due; two instruments in the register were last calibrated nineteen months ago, against a manufacturer’s recommended interval of twelve, and no certificate covers the intervening period. The organisation’s own calibration procedure requires the interval to be recorded and the instrument withdrawn from use when it falls due.
As an internal finding, the entry in the log carries six fields: the criterion, which is clause 7.1.5.2 read with the client’s procedure at its calibration section; the objective evidence, which is the register extract and the two asset numbers; a sentence saying which criterion failed, in this case both the procedure’s recording requirement and the standard’s requirement that measuring equipment be calibrated or verified at specified intervals; the grade, a nonconformity under the organisation’s own four definitions; the corrective action, with an owner and a date; and a verification line for the next audit. It is a row in a table, terse enough to be argued with. The method for writing that row is set out in the piece on audit findings, and the discipline it imposes — evidence named, dated and locatable — is what makes the row answerable rather than asserted.
As a certification nonconformity, the same facts become a document. It names the requirement and quotes it; it states the objective evidence specifically, with the register extract attached; it states the nonconformity in a sentence the auditee must accept or contest; it classifies the finding major or minor under the body’s definition, and the classification has a consequence — a major normally withholds the certificate until the correction has been made and its effectiveness verified, typically at a follow-up visit; a minor carries a deadline; it records the auditee’s acknowledgement, the proposed correction and corrective action with dates, and the audit team’s acceptance of that plan; and closure is verified by the certification body, not by the organisation.
The two documents describe identical facts and are not interchangeable. The internal entry can be closed in a week by a person inside the building. The certification nonconformity cannot be closed by the auditee at all: it can be answered, and only the body can close it.
Who signs
Two documents, two names, and in the certification case a third decision that belongs to neither.
An internal audit report is signed by the person who conducted the audit, and its conclusion is a readiness conclusion for management: this system, against these criteria, at this point in time, with these findings open. The signature is a statement of authorship and method, not of conformity. It confers no status on the system, is not evidence that the system conforms, and cannot be presented to a customer as one. Management then reviews the results under clause 9.3, which is a separate act with a separate record, and it is management’s review rather than the audit that settles what the organisation does next.
A certification audit report is signed by the audit team leader, and the certificate is issued after a decision taken by personnel of the certification body who did not conduct the audit. That separation is the point of the third party: the people who find the nonconformities do not decide whether the certificate is granted. The certificate then carries the body’s accreditation, which is another body’s oversight of the first. Nothing inside the audited organisation signs any part of it.
Two corollaries follow, and both are practical rather than philosophical.
The first is that an internal audit signature cannot be upgraded. A rigorous internal programme is the best preparation for certification and remains, at the end, a first-party opinion. The person signing it is an employee of the auditee, and no amount of evidence changes the relationship.
The second is that a certificate cannot be signed by anyone but the certification body, and no tool, agent or method changes that. An assembly that drafts the checklist, the log and the report prepares a document for a person to sign; the opinion is that person’s, and certification remains an accredited body’s act. Where a role is named for a standard, the name is a job description, not a qualification.
What it costs to rehearse
The productive use of the internal audit, where a certificate is coming, is rehearsal: a stage 1-style review of the documented system and a stage 2-style test of whether it runs. That is real work and it can be costed, provided the costing is honest about what it covers.
The rate is measured, not listed: $0.00700 a call for deepseek-v4-flash on Base under exact with a short prompt, read from the live 402 challenge on 31 October 2026 outside the service’s weekday peak windows of 01:00–04:00 and 06:00–10:00 UTC. The $0.00875 that circulates as this service’s catalogue figure is Qwen’s rate, and it appears here only as the figure that circulates, beside its correction.
An illustrative rehearsal of a four-process system, drawn from an eighteen-document corpus: eighteen extraction calls, one a document, $0.12600; eighteen mapping and request-for-information calls, $0.12600; ten calls for the stage 1-style review of the documented system, $0.07000; eight calls for a stage 2-style test of four processes, two questions each, $0.05600; six calls to draft the findings log, $0.04200; four calls to draft the report, $0.02800; nine calls to work the auditee’s replies, $0.06300; five rewrite passes after those replies, $0.03500.
The shape is the expensive one, and deliberately so: the rehearsal runs two stages, maps clause by clause rather than process by process, and works every reply through a rewrite, where a single audit of a larger system spends most of its calls on the corpus and finishes at the report.
The addition: 18 + 18 = 36; + 10 = 46; + 8 = 54; + 6 = 60; + 4 = 64; + 9 = 73; + 5 = 78 calls. Seventy-eight calls at $0.00700 is $0.54600, which is $0.13650 for each of the four processes and seven tenths of a cent for each of the eighteen documents.
Three comparisons bound it. At the circulated rate the same seventy-eight calls cost $0.68250, which is $0.13650, or 25 per cent, more. At the metered ceiling of $0.00955 — a long prompt under exact, or upto at max_tokens: 1000 — they cost $0.74490, which is $0.19890, or 36 per cent, more. And the 0.50 USDC opening balance buys seventy-one calls at $0.00700, so the rehearsal runs seven calls and $0.04900 past a first balance and needs a top-up before the report is finished.
What the figure covers is drafting. The auditor’s days, the corpus (a licensed copy of the standard and the client’s documents prepared as text rather than photographed pages), the auditee’s hours and the certification body’s fee are outside it entirely. The rehearsal is cheap to draft and expensive to sit, and the certificate at the end of it is a purchase from a third party whose price this publication has not measured and does not quote.
Where the comparison stops
Three things this comparison does not establish, and one it cannot.
It does not say the internal audit is a lesser instrument. For most organisations most of the time it is the more useful one, because it can be scheduled at will, it can look at anything, and its findings can be argued with before they become commitments. What it cannot do is change party.
It does not make the two comparable on rigour. A certificate is granted on a sample, at a point in time, within a scope, and it says the system conforms on that sample and that scope. An internal audit can be deeper and still be first party. Neither property is a substitute for the other: the certificate answers a question a customer or a regulator asks, and the internal audit answers a question management asks, and the two questions are not the same.
It does not price certification. Fees, days on site and the cost of a suspended certificate are the body’s commercial terms and the organisation’s risk, and this publication has measured neither. Where a customer or a regulator requires a certificate, the internal audit cannot be offered in its place whatever its quality; that is a contractual fact rather than a judgement about method.
What the comparison cannot do is decide for the reader which audit is being planned. That is the first question in the audit plan and the last thing most plans state.
The decision
Write four words into the audit plan before anything is scheduled: party, criterion, product, signature. First party, ISO 9001 and our own procedures, report and findings log, the auditor who conducted it. Or third party, the standard and the body’s rules, stage reports and a certificate, someone who did not do the audit. Everything else — the checklist, the fieldwork, the log, the tone of the closing meeting — follows from those four answers, and most of the confusion in a badly scoped audit programme comes from never having written them down.
Then apply one test at the end of the year, which is the only one that matters: count the signatures. If the report carries the name of the person who did the work and a management review beneath it, the organisation has audited itself. If it carries a body’s decision taken by people who were not in the room, the organisation has been certified. Both are useful. They are not the same purchase, and the second one does not mean the first one happened.
Where this goes
- The pillar: x402.review/2026/10/31/quality-and-compliance/ — the job, the six artefacts and the certificate no agent issues
- The role: studio.x402.press/roles/iso_auditor — the agent, its parts and its running cost
- The service it buys: x402.press/services/deepseek/ — the canonical price, seven chains
- The review: x402.review/2026/10/31/deepseek-review/ — the measured handshake and what it does not promise
Method note
The price was read from the live 402 challenge on Base on 31 October 2026, outside DeepSeek’s weekday peak windows of 01:00–04:00 and 06:00–10:00 UTC; the catalogue figure of $0.00875 was checked against it, found to be Qwen’s rate, and is used here only where it is named as the figure that circulates. The call counts of the rehearsal are planning assumptions, stated in the cost section and repeated in the arithmetic; they are not observations of a real engagement. The requirements and definitions cited are ISO 9001:2015 (clauses 7.1.5.2, 9.2 and 9.3), ISO 9000:2015 (audit, objective evidence, nonconformity) and ISO 19011:2018 (the audit types, and the conduct of an audit); the two-stage certification process, the separation of the certification decision from the audit team and the three-year cycle are the requirements of ISO/IEC 17021-1, described here in outline rather than quoted. The organisation in the worked example is constructed for this piece, and no client, engagement or audit outcome is described. No fee, duration or failure rate for a certification audit is offered, because none has been measured.
x402.review is written and edited by N.P. Vincent. The publication is connected to x402.press, which sells the services reviewed here; that interest is disclosed on every piece that touches a service, and it is stated here rather than left to inference.
Filed under Jobs
