You need both, because different people carry them out for different purposes.
The surveillance audit is the certification body's visit in years two and three of the certificate cycle. Their auditor checks a sample of the ISMS, writes their own report and can raise nonconformities with deadlines. Its purpose is to confirm the certificate is still deserved.
The internal audit is your own. You choose the auditor, who has to be impartial, and the findings go into your report and your corrective action log. Its purpose is to find problems before the certification body does.
The two are easy to confuse because they look at the same controls a few weeks apart. The yearly order is: internal audit, corrections, management review, surveillance audit. The surveillance auditor reviews your internal audit report and corrective action log as part of the visit, so a well-run internal audit makes that visit easier.