ISO internal audits.
Find it before the certification body does.

A planned examination of whether your management system operates as documented and meets the requirements of the standard. Every ISO management system standard requires it, and it is not optional: clause 9.2 in the harmonised structure obliges the organisation to conduct internal audits at planned intervals. It is the organisation checking itself, ahead of and independently from the external certification audit.

Yes, and it is common. The standard requires objectivity and impartiality, which means an auditor cannot audit their own work. In a small team that is difficult to arrange internally, since the people who know the system are the people who built it. Using an external auditor satisfies the impartiality requirement and usually produces a more useful finding set, because there is nothing to protect.

No. They are separate and serve different purposes. Internal audit is your own assurance that the system works, required by the standard itself. The certification audit is conducted by an accredited certification body and is what results in the certificate. A weak internal audit programme is one of the most common reasons a certification audit produces major findings, because problems that should have surfaced internally arrive in front of the external auditor instead.

At planned intervals covering the full scope of the system within the certification cycle, with frequency weighted by risk and by past performance. In practice most organisations run a rolling programme so that every process and site is audited at least once a year, with higher-risk areas visited more often. A single annual sweep just before the external audit meets the letter of the requirement and defeats its purpose.

An internal audit is the organisation checking its own system, required by clause 9.2 of every management system standard and run by its own people or an independent firm it appoints. An external audit is carried out by someone outside: a customer auditing a supplier, or an accredited certification body deciding whether to grant or keep the certificate. The internal audit is what should find problems first, so the external one finds nothing new.

The audit is quoted as a fixed fee after a short call. The number of audit days depends on the standards in scope, the number of sites and headcount, and is fixed in the audit plan before fieldwork starts. An integrated audit of several standards costs less than separate audits, because shared clauses are audited once.

Anyone competent who is not auditing their own work. The standards require the organisation to select auditors so that the audit is objective and impartial, and to ensure they are competent; they do not require a certificate. An internal auditor course is a sensible way to show competence, and ISO 19011 gives the guidance on auditing that most courses follow. The practical difficulty is impartiality, which is why smaller organisations often bring in an external auditor.

An internal auditor audits their own organisation's system as part of the clause 9.2 programme. A lead auditor is trained to plan and lead a full audit team, typically for second-party audits of suppliers or third-party certification audits. For internal audit, lead auditor training is useful but not required.

Both follow the same clause 9.2 requirement as every other management system standard, with standard-specific substance. An ISO 27001 internal audit tests the information security management system and the Annex A controls the organisation has declared applicable in its Statement of Applicability. An ISO 22301 internal audit tests the business continuity management system, including the business impact analysis, the continuity plans and the results of the exercise programme. Where either sits alongside ISO 9001 or ISO 45001, the shared clauses are audited once.