First, Second and Third-Party Audits: What Is the Difference?
Internal audit, supplier audit or certification audit: who audits whom, why, and what each one can and cannot tell you
The word “audit” covers three very different activities. An internal audit, a customer’s audit of its supplier and a certification body’s audit can look similar on the day, with an auditor, a checklist, interviews and findings, but they have different purposes, different auditors and very different consequences.
Understanding the difference helps organisations plan their audit programmes, avoid duplicated effort and know what evidence each audit actually gives them.
1. The three types at a glance
| First-party audit | Second-party audit | Third-party audit | |
|---|---|---|---|
| Who audits? | The organisation itself, or someone acting for it | A customer, or an auditor acting for the customer | An independent certification body |
| Who is audited? | The organisation’s own system | A supplier or contractor | The organisation seeking certification |
| Purpose | Check conformity and effectiveness, find improvements | Confirm the supplier can meet the customer’s requirements | Decide whether to grant or keep certification |
| Criteria | The standard, the organisation’s own requirements | Contract terms, specifications, legal and customer requirements, standards | The standard and certification scheme rules |
| Outcome | Internal findings and improvement actions | Supplier approval, conditions or rejection | Certificate granted, maintained, suspended or withdrawn |
| Guidance | ISO 19011 | ISO 19011 | ISO/IEC 17021-1 for certification bodies, plus ISO 19011 |
2. First-party audits: the internal audit
Every certified management system must have a planned internal audit programme. It is the organisation’s own check that the system conforms to the standard and to its own requirements, and that it is effectively implemented.
What makes a good internal audit:
- Independence: auditors do not audit their own work.
- Competence: auditors are trained in the standard and in audit techniques.
- Risk-based planning: important and problematic processes are audited more often.
- Process focus: auditors follow the work, not the clause order.
- Follow-up: findings lead to corrective actions that are checked for effectiveness.
Internal audits can be carried out by trained staff, or outsourced to external auditors acting for the organisation. They remain first-party audits either way.
3. Second-party audits: auditing suppliers
A second-party audit is carried out by a customer, or by an auditor acting for the customer, on a supplier. Its purpose is to confirm that the supplier can meet the customer’s own requirements, which a general certificate does not always cover:
- Product specifications and approved samples.
- Private-label or brand requirements.
- Legal requirements in the country of sale.
- Specific controls, such as allergens, foreign bodies or traceability.
- Social or environmental commitments in the contract.
A second-party audit does not lead to a certificate. Its result is a decision by the customer: approve the supplier, approve with conditions, or reject.
4. Third-party audits: certification
A third-party audit is carried out by an independent certification body, which must itself be accredited and impartial. For management system certification, the process usually includes:
- Stage 1: review of documented information, readiness and scope.
- Stage 2: evaluation of implementation and effectiveness on site.
- Certification decision by the certification body, not by the auditor alone.
- Surveillance audits, usually once a year.
- Recertification audit before the certificate expires, usually every three years.
A certificate gives customers confidence that the system was found to conform by an independent body. It does not guarantee that every product or shipment is conforming.
5. How the three work together
| Question | Best answered by |
|---|---|
| Is our system working, and where can we improve? | First-party internal audit |
| Can this supplier meet our requirements? | Second-party audit, supported by inspection |
| Can we show customers and tenders an independent confirmation? | Third-party certification |
| Are we ready for the certification audit? | An independent readiness assessment or pre-audit |
Organisations get most value when the three are linked: internal audit results feed management review, supplier audits feed the approved supplier list, and certification findings are treated with the same root cause analysis as internal findings.
6. Common misunderstandings
- “We are certified, so we don’t need internal audits.” Internal audits are a requirement of the standard and are checked by the certification body.
- “The supplier has a certificate, so no audit is needed.” Only true if the certificate’s scope covers what you buy and the risk is acceptable.
- “Our consultant can certify us.” Consultants cannot certify. The certificate is issued by an independent certification body, which must not consult for the same client.
- “A second-party audit is the same as an inspection.” An audit evaluates the system; an inspection checks a product, shipment or site at a given moment.
Conclusion
First-party audits help the organisation improve itself, second-party audits protect it from supplier risk, and third-party audits give independent confirmation to the outside world. A mature organisation uses all three, each for what it does best.
Look at your audit calendar for next year: are all three types planned, and do their results reach management review?