ISO/IEC 17065 is for bodies certifying products, processes and services. ISO/IEC 17021 is for bodies auditing and certifying management systems.
The two standards cover different objects. ISO/IEC 17065 certifies a product, a process or a service, often with testing or inspection and with surveillance of production or delivery. ISO/IEC 17021 certifies an organisation's management system, such as quality, environment or information security. The competence, the evaluation method and the decision path differ. A body can hold both, and a group can run both, but the impartiality rules and the consultancy bar apply to each. ISO/IEC 17065 refers to ISO/IEC 17021 for management system auditing where the scheme requires an assessment of the client's system. The FDIS wording is not held. If your certificate says a management system meets a standard, you are in 17021 territory. If it says a product, process or service meets a standard, you are in 17065.
Can one body do both?
Yes, with the right structure, competence and impartiality controls. The two certification activities must not compromise each other, and the consultancy bar applies.
Which standard does a product scheme use for a factory audit?
ISO/IEC 17065 can require an assessment of the client's management system and points to ISO/IEC 17021 for the auditing competence. The certificate object is still the product, not the system.
Where this comes from
The clause record states each requirement in our own words and cites the clause. The revision page separates the public FDIS record from the edition in force. The official record is ISO standard 94443.
Not legal advice; does not certify. The FDIS requirement wording is not held and is not stated.