First, second, and third party ISO audits differ mainly in who commissions the audit, who performs it, and how the result will be used. A first party audit is conducted for the organisation itself. A second party audit is conducted by, or for, a party with an interest in another organisation, such as a customer auditing a supplier. A third party audit is conducted by an independent external body.
Confusing these categories can lead to incorrect claims about independence or certification. All three can support improvement, but they do not provide the same level or type of assurance. The examples below explain how to select the right audit and set appropriate objectives.
First party ISO audits
A first party audit is commonly called an internal audit. The organisation commissions it to evaluate its own management system, processes, sites, or functions. Employees may conduct it, or the organisation may use an external specialist on its behalf. It remains a first party audit because the audit client is the organisation itself.
Examples include:
- a manufacturer auditing its production and calibration processes against ISO 9001 and internal procedures;
- a bank auditing information security access reviews against its ISMS criteria;
- a construction company auditing site safety controls under ISO 45001; and
- a group audit team reviewing one division on behalf of head office.
First party audits provide information for management review, corrective action, and continual improvement. Many management system standards require an internal audit programme. Auditors should be competent and selected to preserve objectivity and impartiality. A process owner should not simply approve their own work as conforming.
The audit can be more candid than an external assessment because the organisation controls the purpose and distribution. That freedom should be used to examine difficult risks and recurring failures, not to reduce rigour.
Second party ISO audits
A second party audit occurs when an interested party audits another organisation, usually within a commercial relationship. A customer may audit a current or prospective supplier. A principal contractor may audit a subcontractor. An organisation may appoint a specialist to audit a critical cloud provider or laboratory on its behalf.
Typical objectives include confirming contractual controls, qualifying a supplier, investigating poor performance, assessing a change, or monitoring a high risk service. The criteria may combine an ISO standard with technical specifications, service levels, legislation, customer procedures, and contract terms.
Second party audits should be proportionate. Repeating a complete certification audit may waste effort when the real concern is traceability, cybersecurity, product release, or occupational safety. Review available assurance first, then target residual risk. A supplier’s accredited certificate can inform the plan, but it does not remove the customer’s responsibility to manage supplier performance.
Be explicit about confidentiality, access, evidence, reporting, and follow up in the contract or audit agreement. The audit relationship has commercial power dynamics that competent auditors must manage fairly.
Third party ISO audits
A third party audit is performed by an independent organisation that is not the customer or supplier in the relationship. The familiar example is a certification body auditing a management system for initial certification, surveillance, or recertification. Regulatory and other independent audits can also be described as third party assessments, although their rules and legal powers may differ.
For accredited management system certification, the certification body must operate under relevant conformity assessment requirements and the oversight of an accreditation body. ISO develops standards but does not certify organisations or issue ISO certificates.
The certification audit assesses conformity within the stated scope. A successful decision gives customers and interested parties independent assurance that the management system meets the relevant standard. It does not guarantee every product, service, legal outcome, or future performance. Always read the certificate scope, sites, standard edition, status, and issuing body.
First, second, and third party ISO audits compared
The audit party affects purpose and reliance:
- First party: The organisation seeks internal assurance and improvement. The report normally goes to its management.
- Second party: A customer or other interested party seeks assurance about a provider or partner. The report supports procurement, contracting, or relationship decisions.
- Third party: An independent body evaluates against defined criteria. A certification body may use the result for a certification decision.
Independence is not a simple label. An outsourced internal auditor can be independent of the activity while still performing a first party audit. A customer’s auditor may be objective and competent, but the commercial relationship makes the work second party. A consultant who designed the system should not present a readiness review as an independent certification audit.
How to choose the right audit
Start with the decision the report must support. If leadership needs to know whether its own controls work, use a first party audit. If procurement needs evidence about a critical supplier, design a focused second party audit. If the market or a tender requires recognised certification, approach a competent certification body for a third party audit.
In every case, define objectives, scope, criteria, methods, competence, reporting, confidentiality, and follow up. Apply risk based planning. Use remote methods only where they can produce reliable evidence and protect information.
Build internal capability through ISO 19011 audit training. Use ISO implementation support to close system gaps, while keeping certification decisions separate. Continue testing controls between external visits through management system maintenance.
Use the label that matches the relationship
First, second, and third party audits can complement one another. An organisation may use internal audits to improve its system, customer audits to manage supply chain confidence, and certification audits to provide independent assurance. WWISE can help define the correct audit programme, competence needs, and evidence trail without overstating what any one audit proves.
