Not all assurance carries the same weight. A strong structure has independent, eyes on it, at arm's length from the people who built the system.
From self-declared to independently certified
First partyThe business checks itself. Essential, but it's marking its own work.
Second partyA customer or head office audits you. Useful, and focused on their own interests.
Third partyAn independent body audits you against a defined standard.
Third party, accreditedThat body has itself been assessed by an body as competent to certify.
Benchmarked schemeThe standard itself is recognised against an international benchmark, such as GFSI.
Regulators sit alongside these levels. Inspection and enforcement are separate from any voluntary , and a doesn't replace them.