They are two separate requirements, and certification bodies check each of them.
The internal audit, Clause 9.2, is a test carried out by an impartial auditor, and its output is a report with findings. The management review, Clause 9.3, is a meeting of top management, in a small company often the CEO, the CTO and the ISMS owner. Its output is decisions: new resources, changed objectives, risks accepted or treated differently.
The two are linked. Clause 9.3 lists the inputs the review must consider, and audit results are one of them, alongside the status of earlier actions, changes in context, trends in nonconformities and corrective actions, monitoring results, and the results of the risk assessment. The natural order is audit first, review second. A company that audits in April and reviews in May can discuss each finding in the review and record what was decided.
A common Stage 1 finding is a management review whose minutes never mention the internal audit. Minutes that list each finding with its decision, for example "access review findings: budget approved for an access management tool, owner CTO, due Q3", show the auditor that the two requirements work together.