Internal audits are official or unofficial assessments of a company's internal functions, generally conducted by employees with auditing experience.  This is also known as a first-party audit.  Please also see the last paragraph relating to management reviews and Internal ISMS audits.  Read our one-pager on Internal Audits here.  

External audits are official or unofficial assessments of a company conducted by a third-party audit firm.  Generally, these third-party audit companies employ persons who hold an auditor certification of some sort.  Examples include ISO 27001, PCI, HIPAA, or CMMC.

Then we have another form of external audit: an audit function applied to a third party, most likely a vendor providing services to a client company.  The whole purpose of this type of audit is to ensure that any vendors providing services to a client company are safe to do business with.

As it relates to audits, it's important that the audit scope be determined before the audit and fully agreed upon by the audit team and the auditee.  Otherwise, a never-ending audit may occur.  From a tactical standpoint, the auditee is also advised to keep the audit scope to the smallest possible footprint, as this will keep costs down and reduce effort overall.

Lastly, and extremely important, are the management reviews and internal ISMS audits.  If you are seeking anything relating to ISO (specifically ISO 27001), then this must be performed and be able to be proven.  This relates to ISO 27006 section 9.5.2, which states: "Certification shall not be granted to the client until there is sufficient evidence to demonstrate that arrangements for management reviews and internal ISMS audits have been implemented, are effective and will be maintained."