ISO 27001 · Clause 9.2
Two audits, and only one of them decides your certificate
Internal audit
You control it
Who runs it
You, or an auditor you bring in
When
Once a year, and after a big change
A finding means
A task with an owner and a date
Seen by
Your management, nobody else
Certification audit
They control it
Who runs it
An external certification body
When
On their schedule, every year
A finding means
A nonconformity on the record
Decides
Whether you get the certificate