A prospect asks whether you have been audited. Your insurer asks for a recent risk assessment. A distributor in Frankfurt asks whether you are certified. Three requests, three different pieces of work, and answering any of them with the wrong artifact costs weeks. The confusion is not the reader's fault, because the regimes use the words inconsistently. The card brands call their formal third party validation an assessment. The AICPA calls its formal engagement an examination. ISO calls the same activity an audit that leads to a certificate. Sorting the three out takes about ten minutes, and it decides what you buy, from whom, and how long before you can answer the email.
Audit vs Assessment vs Certification Compared
| Assessment | Audit | Certification | |
|---|---|---|---|
| Purpose | Find gaps and rank what to fix | Test whether stated controls actually operated | Confer a credential against a published scheme |
| Who performs it | Your own team, or a consultancy you hire | An independent auditor, internal audit, or a licensed firm | A certification body, ideally an accredited one |
| Independence | Optional, and often deliberately absent | Required for the result to mean anything externally | Required, and the body's own independence is checked by an accreditation body |
| What you receive | Findings, a gap list, a remediation plan | A report, an opinion, or a list of nonconformities | A certificate naming the standard, the scope and the dates |
| What failure looks like | Nothing. Bad news is the deliverable | An adverse opinion, an exception, or a failed control test | Nonconformities you must close before a certificate issues |
| Evidence tested | Whatever the assessor judges relevant | A sample chosen against fixed criteria | A sample chosen against the scheme's rules |
| Typical duration | Days to a few weeks | Weeks, after a period of evidence has accumulated | Months, across a staged audit and a correction window |
| How long it lasts | Until something changes | The period the report covers, then it goes stale | A fixed cycle with surveillance audits in between |
| Verifiable by a stranger | No | Only if you send the report | Yes, an accredited certificate is listed publicly |
| Named examples | Risk assessment, gap assessment, penetration test | SOC 2 examination, internal ISO audit, an OCR investigation | ISO 27001, CMMC Level 2, a PCI DSS validation |
Two things the table cannot show. The first is that the underlying work is largely the same work. Access reviews, change approvals, logging, vendor review, joiners and leavers: an assessment looks for them, an audit tests them, a certification body checks that a management system keeps them running. Do it genuinely once and you are most of the way to any of the three.
The second is that the choice is rarely made on the merits. It is made by whichever customer, regulator or insurer is currently refusing to move, so the useful question is which one satisfies the person asking, and what is the earliest honest date you can hand it over.
What Is a Security Audit?
An audit is an independent examination against criteria fixed before it starts. The NIST glossary, drawing on CNSSI 4009-2022, defines it as the independent review and examination of records and activities to assess the adequacy of system controls, and to ensure compliance with established policies and operational procedures. Every clause carries weight. Independent rules out the person who built the control. Records and activities means evidence rather than intent. Established policies means the yardstick existed before the auditor arrived.
An audit has four properties an assessment does not. The criteria are not negotiable once fieldwork begins. The auditor samples, choosing which access reviews to test rather than accepting the ones you offer. The output uses verdict language: an opinion, an exception, a nonconformity, a finding. And the result is written for somebody else to rely on, which is what makes independence a requirement rather than a nicety.
Audits are not automatically external. ISO management system standards require internal audits, performed by people independent of the activity being audited but employed by you. A regulator's examination is an audit you did not commission, which is why a healthcare organization under the HIPAA Security Rule can find itself audited by the Office for Civil Rights on somebody else's schedule.
The part that surprises first timers is that an audit rarely tests today. A period audit tests a window that has already closed, so the evidence either exists or it does not, and no amount of remediation in the final week creates records for a quarter when nobody performed the review. That is the whole argument for doing the preparation before fieldwork begins rather than during it.
What Is a Security Assessment?
An assessment measures. NIST defines a security control assessment as the testing or evaluation of management, operational and technical security controls to determine the extent to which they are implemented correctly, operating as intended, and producing the desired outcome. Notice what is missing from that sentence: no opinion, no pass mark, no independence requirement, no audience beyond the organization that commissioned it.
Three different things get called an assessment, and conflating them is where budgets go wrong.
- A risk assessment identifies what could go wrong, how likely it is and what it would cost, then ranks the results. It is the input to a security program rather than a verdict on one.
- A gap or readiness assessment compares what you run against the criteria of a specific framework and lists what is missing. This is the pre-audit exercise, and it is deliberately not independent, because you want the assessor to help you fix things.
- A technical assessment tests the systems themselves. This is where a penetration test and a vulnerability scan live, and both are assessments in the compliance sense even though neither feels like paperwork.
The common belief that an assessment is the optional one is wrong often enough to be expensive. The FTC Safeguards Rule requires covered financial institutions to base the information security program on a risk assessment, states at 16 CFR 314.4 that the risk assessment shall be written, requires annual penetration testing of information systems based on the risks the assessment identified, and requires the Qualified Individual to report in writing at least annually to the board or a senior officer. The HIPAA Security Rule likewise makes a risk analysis a required implementation specification. In both regimes the assessment is the legally mandatory piece and the third party audit is not.
What Is a Certification?
A certification is an audit with a governing scheme behind it and a credential at the end. The relevant standard is ISO/IEC 17021-1:2015, Conformity assessment, Requirements for bodies providing audit and certification of management systems, and its framing is the clearest statement of what certification actually is: certification of management systems is a third party conformity assessment activity, and the bodies performing it are third party conformity assessment bodies. The audit is the activity. The certificate is the artifact. The scheme is what makes one comparable to another.
That last point is what buyers are really buying. If your assessor and my assessor each worked to whatever methodology they preferred, our two reports would not be comparable. A certification scheme fixes the standard, the audit stages, the sampling rules, the correction window and the surveillance cycle, and an accreditation body checks that the certification body follows them. ISO 27001 works this way: a staged audit, a certificate naming the standard, the scope and the dates, a three year cycle with surveillance audits in between, and recertification at the end.
Three details decide whether somebody else's certificate is worth anything to you.
The scope statement. A certificate covers a boundary chosen by the certified organization. One covering a single subsidiary, product line or data center is honest and common, and it tells you nothing about the rest.
Accreditation. Anyone can print a certificate. An accredited certification body has itself been assessed against ISO/IEC 17021-1, and accredited certificates appear in public registers. An unaccredited one is a private opinion in a formal typeface.
Dates. A certificate carries an issue date, an expiry date and a surveillance schedule. One in its final month with a surveillance audit missed is a different object from the same page a year earlier.
Who Performs an Audit, an Assessment and a Certification
The chain of trust is what separates the three. Somebody assesses you, somebody accredits or qualifies that assessor, and your customer relies on the result without meeting either party.
Who is allowed to sit in the assessor lane varies by regime, and the rules are stricter than most buyers realize. A SOC 2 examination can only be performed by a licensed CPA firm working under the AICPA's attestation standards, and its independence rules are why the firm that helped you build the controls generally cannot be the firm that later tests them. A PCI DSS validation is performed by a Qualified Security Assessor company, which the PCI Security Standards Council describes as an independent security organization qualified by the Council to validate an entity's adherence to PCI DSS. The Council is careful about what that qualification means: it indicates only that the assessor met the Council's requirements, not that the Council endorses its business practices. An ISO 27001 certificate comes from a certification body, and the body that matters is one an accreditation body has assessed.
Defense contracting shows all three lanes in one program. The CMMC final rule, effective December 16, 2024, sets Level 1 and Level 2 self-assessments that the contractor performs and affirms itself, a Level 2 certification assessment provided by an authorized or accredited third party assessment organization, and a Level 3 certification assessment performed by the government's own Defense Industrial Base Cybersecurity Assessment Center, with a final Level 2 status as a prerequisite for even scheduling it. Same security requirements underneath, three different levels of independence, three different amounts of money and time.
What Each One Actually Proves
Scope and period are the entire answer, and everything else is decoration.
An assessment proves that somebody competent looked, on a date, at what they chose to look at. It proves nothing to a third party, because nothing constrains what was examined or what was left out of the write-up.
An audit proves that specific criteria were tested against sampled evidence, inside a stated scope, across a stated period. That is a strong claim and a narrow one. It says nothing about systems outside the boundary, nothing about the period after the report closed, and nothing about controls the criteria never asked for.
A certification proves that an accredited body found a management system conforming to a published standard, within a scope you can read on the certificate. It is the most portable of the three and the most often over-read: a valid certificate is not a statement that the organization is secure, and the scheme does not claim it is.
Do You Need an Assessment Before an Audit?
Almost always, yes, and the reason is arithmetic rather than caution. An audit that tests a period cannot test a period that has not happened. Every week of remediation you spend after the clock starts is a week of missing evidence somebody will sample.
- Gap or readiness assessment against the chosen criteria. Output is a gap list with an owner and a date on every line
- Remediation. Controls switched on and genuinely running, with the records they produce as a by-product
- The observation period for an audit, or the implementation history a certification body expects to see. Three months is a practical floor and twelve is the steady state
- Fieldwork. The auditor or certification body samples evidence across the whole period and tests each control
- The artifact issues: a report naming the period and any exceptions, or a certificate naming the scope and the dates
- Surveillance audit or a fresh examination period. A gap between periods is visible to every buyer who reads carefully
The exceptions are worth naming, because plenty of companies skip the assessment and are right to. If you have held a report or certificate before, the gap assessment collapses into a review of what changed since last year. If a regulator has already told you what is deficient, that letter is your gap list. And a point in time engagement examining design rather than operation can be produced quickly once the design exists, which is why it gets used when a deal is waiting.
Is SOC 2 a Certification?
No, and the distinction is not pedantry. SOC 2 is an attestation. The AICPA describes the engagement as an examination, a report on controls at a service organization relevant to security, availability, processing integrity, confidentiality or privacy. A licensed CPA firm forms an opinion about management's assertion and publishes that opinion in a report. There is no certificate, no registry, no expiry date and no issuing authority to check with. "SOC 2 certified" is shorthand that marks the speaker as unfamiliar with the thing they bought.
An attestation sits between an assessment and a certification. Like an audit, it is independent, evidence based and written for somebody else to rely on. Unlike a certification, the deliverable is a private document you send under an NDA rather than a public credential, and nobody outside the engagement can confirm it exists.
Certification is the literal legal word in some regimes, which is why the answer changes by context. CMMC calls the third party engagement a certification assessment because the program confers a status the Department of Defense checks before contract award. Federal doctrine used it differently again: the NIST glossary still records the older meaning of certification as a comprehensive assessment of security controls made in support of security accreditation, which inverts the commercial usage almost exactly. If you are unsure which sense somebody means, ask what document they expect to receive. That question has never once produced an ambiguous answer.
Which One Does Your Business Need?
Here is the plain verdict, and none of the three wins on every axis.
Choose an assessment when nobody is holding a contract hostage and you do not know where you stand. It is the cheapest, the fastest and the only one allowed to tell you uncomfortable things privately. Its weakness is total: it convinces nobody outside your company, and an assessment emailed to a prospect is read, correctly, as marketing.
Choose an audit or attestation when a specific customer, insurer or regulator needs independent evidence about your controls, and mostly when that party is in the United States. Its strength is depth, since the reader sees the tests and the results. Its weaknesses are cost, the lead time the observation period imposes, and a report only as broad as its criteria and scope. It also expires quietly, and a period that ended fourteen months ago is close to worthless.
Choose certification when buyers you have never met need to check you without a conversation, which means selling outside North America, into public procurement, or into a supply chain that screens vendors before anyone talks. Its strength is portability. Its weaknesses are the calendar, the surveillance burden, and a single page that compresses so much nuance that careful buyers ask for the scope statement anyway.
Key takeaways
- An assessment finds gaps. An audit tests evidence against fixed criteria and returns a verdict. A certification is a scheme governed audit ending in a credential a stranger can verify.
- Independence is the dividing line. An assessment does not need it, an audit is meaningless without it, and certification adds accreditation as a layer above the auditor.
- Scope and period decide what any of them proves. None says anything about systems outside the boundary or time after the window.
- Assessments are frequently mandatory. The FTC Safeguards Rule requires a written risk assessment and annual penetration testing, and the HIPAA Security Rule requires a risk analysis.
- SOC 2 is an attestation. The AICPA calls the engagement an examination and no certificate exists.
- The three words are used inconsistently across regimes, so ask what document the other party expects to receive.
- Do the assessment first. An audit tests a period that has already closed, so remediation after the clock starts shows up as missing evidence.
Common questions
What is the difference between an audit and an assessment?
An audit tests sampled evidence against criteria fixed in advance and produces a verdict somebody else relies on. An assessment measures where you stand and produces findings you act on, with no opinion, no pass mark and no requirement that the assessor be independent. Assessments are diagnostic, audits are evidentiary.
Is a certification the same as an audit?
A certification includes an audit but is not the same thing. The audit is the activity, the certificate is the artifact, and the scheme behind it fixes the standard, the stages, the sampling and the surveillance cycle. That scheme, and the accreditation of the body applying it, are what make one certificate comparable to another.
Is SOC 2 a certification?
No. SOC 2 is an attestation performed by a licensed CPA firm under AICPA standards, and the deliverable is a report containing an opinion. There is no certificate, no registry and no issuing authority. "SOC 2 certified" describes a report somebody holds rather than a credential anyone issued.
What is an attestation?
An independent practitioner's conclusion about somebody else's written assertion. It sits between an assessment and a certification: independent and evidence based like an audit, but delivered as a private report rather than a public credential. SOC 1, SOC 2 and SOC 3 are the ones most US buyers meet.
What is the difference between accreditation and certification?
Certification is what a body grants you. Accreditation is what a national accreditation body grants that certification body, after assessing it against ISO/IEC 17021-1. Accreditation is why a certificate means anything to a stranger, and an unaccredited certificate is a private opinion on formal paper.
Can the same firm do your assessment and your audit?
Usually not, and where it is permitted it is still a poor idea. Independence rules stop a firm from testing controls it designed or implemented. Consultancies routinely do the readiness work and hand the examination to a partner firm, which is the normal shape of the market rather than an upsell.
Is a penetration test an audit or an assessment?
An assessment. It evaluates systems and produces findings, with no opinion against fixed criteria and no verdict a third party relies on. Tests frequently become evidence inside an audit or a certification, and some regimes require one on a schedule, but the test itself is diagnostic work.
What does a self-assessment prove?
That you examined yourself and said so, which in some regimes is exactly what the law asks for. CMMC Level 1 and one path through Level 2 are self-assessments the contractor performs and affirms. The affirmation carries legal weight even though no third party tested anything.
How often do you need a security audit?
Annually is the common rhythm, because reports cover a period and buyers treat anything older than about twelve months as stale. The better framing is that the controls run continuously and the audit samples them once a year. Certification schemes formalize that with surveillance audits between recertifications.
How long is a certification valid?
A certificate carries an issue date, an expiry date and a surveillance schedule, and ISO management system certificates typically run a three year cycle with surveillance audits in between. Validity depends on those surveillance visits happening, so an in-date certificate with a missed one is worth querying.
Which one do buyers ask for most often?
In the United States, a SOC 2 Type 2 report, because vendor risk teams want to see tested controls. Outside North America and in public procurement, an ISO 27001 certificate. In defense contracting, a CMMC status at the level the contract names. Ask the specific buyer, since the answer is in their vendor policy.
On this page
- Audit vs Assessment vs Certification Compared
- What Is a Security Audit?
- What Is a Security Assessment?
- What Is a Certification?
- Who Performs an Audit, an Assessment and a Certification
- What Each One Actually Proves
- Do You Need an Assessment Before an Audit?
- Is SOC 2 a Certification?
- Which One Does Your Business Need?
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.