QULDEXResources · Glossary
What is an external audit? Types and what to expect
What does an external audit involve?
The external auditor checks the same things an internal auditor does, but owes their conclusion to someone else: an accreditation body, the users of a report, or the public.
The organisation's task is to make the audit efficient: a clear scope, evidence ready and in period, people available, and internal findings already being dealt with.
What are the types of external audit?
An independent body audits against a standard and issues a certificate or a report.
A customer audits a supplier, or an organisation audits its own vendors.
A regulator examines compliance with law or licence conditions.
How does a certification audit run?
An ISO 27001 certification audit.
| Item | What it looks like |
|---|---|
| Stage 1 | Review of scope, documented information and readiness |
| Stage 2 | Testing that the system and controls work in practice |
| Decision | The certification body decides on certification after any nonconformities are addressed |
| Afterwards | Surveillance audits during the three-year cycle, then recertification |
This is an illustration written for this page, not a customer record.
Who performs external audits for each framework?
| Framework | Performed by | Result |
|---|---|---|
| ISO 27001 | Accredited certification body | A certificate, valid for three years with surveillance audits. |
| SOC 2 | Licensed CPA firm | An attestation report, Type 1 at a point in time or Type 2 over a period. It is not a certificate. |
| PCI DSS | Qualified Security Assessor | A report on compliance, or a self-assessment for smaller scopes. |
| GDPR | Supervisory authority | Investigations and audits under Article 58; there is no general certificate. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
What makes external audits harder than they need to be?
No internal audit first
The external auditor finds what an internal audit would have.
Instead: complete an internal audit and a management review beforehand.
Evidence gathered on the day
People search for records while the auditor waits.
Instead: have evidence linked to controls before the audit.
Scope unclear
The auditor and the organisation disagree about what is included.
Instead: agree the scope in writing before planning.
How does QULDEX handle this?
Each auditor and reviewer has their own access, and every decision is recorded against their name.
External Audit: common questions
What is a third-party audit?
An audit by a body independent of both the organisation and its customers, such as a certification body.
Is a SOC 2 report a certification?
No. It is an attestation report issued by a CPA firm. People often say 'SOC 2 certified', but no certificate is issued.
Can the consultant who helped us also certify us?
No. Certification bodies must be impartial, so the body that certifies you cannot have provided consultancy on your management system.
Sources
- ISO/IEC 17021-1:2015, Requirements for bodies providing audit and certification of management systems
- ISO/IEC 27006-1:2024, Requirements for bodies providing audit and certification of ISMS
- ISO 19011:2018, Guidelines for auditing management systems
- AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022). aicpa-cima.com
Give external auditors their own controlled access
Controls, evidence, findings and corrective actions in one audit workspace.