A code review happens during development – a developer checks a colleague’s pull request before it gets merged. It’s fast, narrow, and part of the normal build process.
A code audit is a broader, more formal assessment of an entire codebase – or a significant portion of it. It examines security, architecture, compliance, technical debt, and long-term maintainability. If a code review is a proofreading pass, an audit is a full editorial review of the whole manuscript.
Reference
OWASP Code Review Guide – OWASP Foundation – owasp.org