Internal and external audits get compared in terms of who employs the auditor, which is the least useful difference for the business being audited. What matters is what happens to the findings. An internal audit produces findings you own: you decide the corrective action, the deadline, and whether the risk is worth accepting. An external audit produces findings someone else owns: a certification body decides whether your response is adequate, or a customer decides whether you stay on their approved list. That single difference changes how you prepare, how you argue, and how much it costs to be wrong.
Who owns the finding, and what disagreement looks like
In an internal audit, disagreement is a conversation. If you think the auditor has misread the requirement you say so, and the finding is amended or withdrawn on the evidence. In an external audit, disagreement is a formal process with a name and a deadline, and the default is that the finding stands. That asymmetry is why the useful sequence is to run internal audits first and use them to settle interpretation arguments internally, rather than discovering during a certification visit that two people in your business read a clause differently.
What each one is allowed to look at
An internal audit can go anywhere in your organisation, including areas that are nobody's formal requirement, because the scope is yours to set. An external audit is bounded: by the certificate scope, by the contract, or by the standard being assessed. This makes external audits narrower and deeper, and it means that a business preparing for one should be preparing the declared scope rather than the whole organisation. Preparing everything is a common and expensive mistake, and it usually means the declared scope gets less attention than it should.
Preparation is worth more for the external one, and differently
For an internal audit, over-preparation is counterproductive: an internal audit that only sees a tidied version of the process finds nothing, and you have spent the effort for no information. For an external audit, preparation is exactly the job, because the auditor has limited time and will judge the system from a small sample. That means the records for the declared scope have to be findable in the room, indexed, current and approved. The free audit preparation checklist on this site sizes that gathering work from your own scope.
The financial statement audit, which is a different thing entirely
The phrase external audit also means the annual audit of financial statements by an accountancy firm, which is a statutory or contractual exercise with its own rules and its own profession. It is not what a management system auditor does, it is prepared for by your finance function and your accountants, and none of the guidance on this site is aimed at it. If the audit heading your way is about your accounts rather than your processes, the people to ask are your auditors and your accountant.
Questions people ask about internal vs external audit
Can an internal audit be done by an external person?
Yes, and for small organisations it often is. The word internal describes whose audit programme it belongs to and who owns the findings, not who is standing in the room. A contractor running your internal audits is still doing internal audits.
Does a good internal audit guarantee passing the external one?
No, but a weak internal audit function nearly guarantees the opposite. External auditors sample your internal audit records early, because an internal audit that never raises findings tells them exactly how much reliance to place on the rest of the system.
Which comes first?
The internal audit, by a margin that lets you close what it finds. Running an internal audit in the fortnight before a certification visit produces findings you cannot fix in time and a record showing you knew about them.
Do internal and external audits use the same criteria?
They should, for the same standard. Where they diverge is depth and coverage: an internal programme covers everything across a cycle, while an external audit samples the declared scope in a fixed number of days.