An ISO 14001 audit tests whether an organisation’s environmental management system does what the standard and the organisation’s own documents say: whether the significant environmental aspects have been identified and are controlled, whether the compliance obligations are known and met, whether objectives are set and pursued, whether emergencies are prepared for, and whether the system is maintained and improved. The 2026 edition, published in April 2026 with a transition to April 2029, widened the context an organisation must consider (climate change, biodiversity, pollution, resource availability), strengthened the life-cycle and supply-chain requirements and clarified what an internal audit programme must contain. This guide covers the standard’s structure and the 2026 changes, what clause 9.2 requires of the internal audit, how to build a risk-based programme around significant aspects and compliance obligations, how to plan and conduct a single audit with a clause-by-clause checklist, the compliance evaluation that distinguishes environmental audits from quality audits, how to classify and write findings and drive corrective action, auditor competence, the relationship with the internal audit profession and with ESG assurance, the nonconformities certification bodies raise most, and a worked audit at an illustrative food manufacturer.
It replaces the earlier guide at this address and is the companion to the ISO 9001 internal audit guide, which covers the shared method in more depth; the ESG auditing guide covers the disclosure and climate-risk assurance that sits above the management system.
In this guide
- The standard, its structure and the 2026 edition
- What clause 9.2 requires
- Building the programme around aspects and obligations
- Planning one audit: the clause checklist
- Evaluating compliance: the environmental audit’s distinct test
- Conducting the audit
- Testing the aspects register and operational controls
- Findings and corrective action
- Auditor competence and independence
- The internal audit profession and ESG assurance
- The nonconformities certification bodies raise most
- Worked example: Brightwater Foods’ EMS audit
- Frequently asked questions
- Related guides
The standard, its structure and the 2026 edition
ISO 14001 follows the harmonised structure shared with ISO 9001 and the other management system standards: context (clause 4), leadership (5), planning (6), support (7), operation (8), performance evaluation (9) and improvement (10). Its distinct content is in planning and operation: environmental aspects and impacts (6.1.2), compliance obligations (6.1.3), the life-cycle perspective in operational control (8.1), emergency preparedness and response (8.2), and the evaluation of compliance (9.1.2). The 2026 edition kept the structure and changed the content in the ways the table lists; the 2024 amendment’s requirement to consider climate change is carried forward and broadened.
| Change in ISO 14001:2026 | What it requires | What the audit now tests |
|---|---|---|
| Broader environmental context | Context must consider environmental conditions that affect or are affected by the organisation: climate change, biodiversity loss, pollution, availability of natural resources | Whether the context analysis addresses each condition with a documented conclusion and whether the significant aspects and risks reflect it |
| Leadership and integration | Environmental objectives aligned with strategic direction; EMS requirements integrated into core business processes; leadership promoting continual improvement | How objectives connect to the business plan; whether environmental considerations appear in capital, product and procurement decisions |
| Risks and opportunities refined | Risks and opportunities tied to aspects, compliance obligations and context, with clearer requirements for determining and addressing them | Traceability from aspects and obligations to risks and actions |
| Life-cycle and supply chain | Life-cycle thinking must demonstrably inform design and development, procurement and supply-chain controls, and the environmental requirements communicated to external providers | Design records, supplier requirements, procurement specifications and communications |
| Planning of changes | Clearer requirements for planning and managing changes to the system | A sample of changes traced through planning, implementation and review |
| Internal audit clarified | Defined audit objectives and a structured audit programme | The programme’s objectives, structure and rationale |
| Terminology and documented information | Alignment with the harmonised structure; clearer expectations on what must be documented | Checklists updated; documents mapped to the new wording |
| Transition | Three years from publication; certificates to the 2015 edition valid until April 2029 | A gap assessment and a transition plan in the programme |
What clause 9.2 requires
Clause 9.2 is the same requirement as in ISO 9001: internal audits at planned intervals to determine whether the system conforms to the organisation’s own requirements and to the standard and is effectively implemented and maintained; an audit programme with frequency, methods, responsibilities, planning requirements and reporting, considering the environmental importance of the processes, changes and previous results; defined criteria and scope per audit; objective and impartial auditors; results reported to relevant management; and retained documented information. The 2026 edition adds that the programme should have defined objectives and a structure. The ISO 9001 guide works through each phrase and what certification auditors ask for; the environmental difference is in the word “importance”, which in ISO 14001 means the significance of the environmental aspects and the weight of the compliance obligations attached to a process.
Building the programme around aspects and obligations
An environmental audit programme is built from two registers the system already has: the aspects and impacts register, which ranks activities by environmental significance, and the compliance obligations register, which lists the permits, laws, regulations and voluntary commitments that apply. Processes with significant aspects and heavy obligations are audited most often; the registers themselves are audited every cycle, because a stale register is the most common root cause of everything else.
| Input | How it shapes the programme | Evidence |
|---|---|---|
| Significant aspects | Activities with significant aspects (emissions to air, discharges to water, waste, energy, hazardous materials, land use) audited at least annually, more often where impacts are severe or limits are tight | Aspects register ranked; frequencies traced to it |
| Compliance obligations | Permitted activities and reporting obligations audited before their reporting or renewal dates; new obligations audited within a quarter of taking effect | Obligations register with dates; audit dates aligned |
| Changes | New processes, materials, equipment, sites, suppliers or permits trigger an audit of the changed activity | Change log cross-referenced |
| Previous results and incidents | Nonconformities, spills, exceedances, complaints and regulator contacts raise frequency | Incident log and findings mapped to the plan |
| Emergency preparedness | Emergency plans and drills audited annually, with a drill observed | Drill records and the audit observing one |
| Life cycle and suppliers | Design, procurement and supplier controls audited in the cycle; critical suppliers’ environmental requirements verified | Supplier audits or verifications in the programme |
| Coverage | Every clause and every site covered before recertification; the 2026 transition gap assessment scheduled | Coverage matrix |
Planning one audit: the clause checklist
Each audit has a plan with scope (the activity, site and processes), criteria (the clauses, the organisation’s procedures, the permits and obligations that apply) and the people to see, and a checklist organised by the process. The table gives the questions by clause; the general method is in the audit work program guide.
| Clause | Questions | Evidence |
|---|---|---|
| 4. Context and scope | Have internal and external issues and environmental conditions (climate change, biodiversity, pollution, resources) been determined and reviewed? Are interested parties and their requirements identified, including regulators, neighbours and customers with environmental requirements? Is the scope documented with physical and organisational boundaries? | Context analysis, interested-party register, scope statement |
| 5. Leadership | Does top management demonstrate commitment; is the environmental policy appropriate, with commitments to protection of the environment, compliance and continual improvement; are roles assigned; are objectives aligned with strategy? | Policy, communications, organisation chart, interviews, strategic plans |
| 6.1.2 Environmental aspects | Are aspects identified for activities, products and services with a life-cycle perspective, in normal, abnormal and emergency conditions; are significance criteria defined and applied; is the register current? | Aspects register, criteria, review dates, site walk |
| 6.1.3 Compliance obligations | Are legal requirements and other obligations identified, accessible and applied to the aspects; is the register maintained as law changes? | Obligations register, legal update service, permit conditions |
| 6.1.4 and 6.2 Planning action and objectives | Are actions planned for significant aspects, obligations and risks; are objectives measurable, resourced and monitored? | Action plans, objectives with indicators and progress |
| 7. Support | Resources, competence (including for emergency roles), awareness of the policy and of significant aspects, internal and external communication (including regulatory reporting), and control of documented information | Competence records, awareness interviews, communication records, document control |
| 8.1 Operational control | Are controls established for significant aspects consistent with the life-cycle perspective: design, procurement, outsourced processes, supplier requirements, end-of-life information? | Procedures, work instructions, supplier requirements, design records |
| 8.2 Emergency preparedness and response | Are potential emergencies identified; are plans in place, tested, reviewed after incidents and drills; is information provided to interested parties? | Emergency plans, drill records, post-incident reviews |
| 9.1 Monitoring and compliance evaluation | Are the right parameters monitored with calibrated equipment; is compliance evaluated at planned intervals with records; is status known? | Monitoring data, calibration, compliance evaluation records |
| 9.2 and 9.3 Audit and management review | Programme as above; management review covering the required inputs including compliance status and interested-party communications | Audit records, review minutes |
| 10. Improvement | Nonconformity reaction, cause analysis, corrective action and effectiveness review; continual improvement of environmental performance | Corrective action records, performance trends |
Evaluating compliance: the environmental audit’s distinct test
Clause 9.1.2 requires the organisation to evaluate the fulfilment of its compliance obligations at planned intervals, to act if needed, and to maintain knowledge and understanding of its compliance status. It is the requirement that separates environmental audits from quality audits and the one with legal consequences. The internal audit tests the evaluation process and then tests compliance itself for a sample of obligations; the second part is where auditors without environmental training go wrong, because it requires reading the permit.
| Test | What the auditor does | Evidence | Typical finding |
|---|---|---|---|
| Register completeness | Compare the obligations register to the permits, consents, registrations and applicable regulations for the site; check additions in the year | Permits, legal update records | A permit condition or a new regulation absent from the register |
| Evaluation process | Check that each obligation has an evaluation method, frequency and owner, and that evaluations happened | Evaluation schedule and records | Evaluation recorded as “compliant” with no evidence examined |
| Compliance testing | For a sample of obligations, test compliance directly: emission and discharge results against limits, waste consignment records against carrier and facility licences, reporting submitted on time, storage against the conditions | Monitoring data, consignment notes, submissions, site observation | A limit exceeded and not reported; a waste carrier’s licence expired |
| Status knowledge | Ask management what the compliance status is and whether it matches the records | Interviews, management review minutes | Management unaware of an open notice |
| Regulator contact | Review inspection reports, notices, correspondence and the organisation’s responses | Regulator files | An improvement notice not reflected in the corrective action system |
Conducting the audit
The environmental audit is conducted like any management-system audit (opening meeting, interviews and observation, sampling, evidence, daily close, closing meeting; the ISO 9001 guide gives the sequence), with two emphases. The site walk is evidence in its own right: an auditor who walks the yard, the drains, the bunds, the waste area and the storage sees aspects the register missed and controls that are not operating, and should walk before reading the register rather than after. And monitoring data is tested for integrity: who takes the samples, how the equipment is calibrated, whether results are reviewed against limits by someone who would act, and whether exceedances are reported within the permit’s timescale. The audit interviewing guide covers the interviews, which in environmental audits reach the shift operators, the maintenance team and the contractors as well as the environmental manager.
Testing the aspects register and operational controls
The aspects and impacts register is the system’s foundation and the audit tests it in three ways. Completeness: walk the site and the process flow and list the interactions with the environment the auditor sees (emissions, effluents, waste streams, energy and water use, materials, noise, land, the supply chain and the product’s use and disposal), then compare the list to the register; the gaps are findings. Conditions: the register must cover normal operation, abnormal conditions (start-up, shutdown, maintenance) and emergencies (spills, fires, floods), and most registers cover only the first. Significance: the criteria for significance should be defined, applied consistently and reviewed, and the significant aspects should drive the controls, the objectives and the audit programme, which the auditor traces.
| Significant aspect | Controls to expect | How to test them | What goes wrong |
|---|---|---|---|
| Discharges to water | Treatment plant operation, sampling and monitoring, limits, containment of spills, drain plans | Observe sampling; review results against limits; inspect drains and interceptors; test spill response | Samples taken at the wrong point; results unreviewed; surface-water drains connected to process areas |
| Emissions to air | Abatement equipment maintenance, stack monitoring, fugitive emission control, refrigerant management | Maintenance records; monitoring results; leak checks; refrigerant logs | Abatement bypassed during maintenance; refrigerant losses unrecorded |
| Waste | Segregation, storage, labelling, licensed carriers and facilities, consignment documentation, hazardous waste controls | Observe storage; vouch transfers to licences and consignment notes; trace a waste stream end to end | Mixed hazardous and general waste; expired licences; missing consignment notes |
| Hazardous materials and storage | Inventory, safety data sheets, bunding and secondary containment, spill kits, inspections | Inspect tanks, bunds and drums; check capacities; test spill kit contents and training | Bunds cracked or drained open; capacity insufficient; incompatible materials stored together |
| Energy and resource use | Metering, targets, efficiency projects, procurement specifications | Meter data against targets; project records | Targets set without baselines; data unverified |
| Suppliers and outsourced processes | Environmental requirements in contracts; supplier evaluation; verification of licensed activities | Contract clauses; evaluation records; licence checks | Requirements never communicated; waste contractors unverified |
| Product life cycle | Design considerations; end-of-life information to customers; packaging | Design records; customer communications | Life-cycle perspective asserted and not evidenced |
Findings and corrective action
Findings are classified and written as in any management-system audit: major and minor nonconformities, observations and opportunities for improvement, each nonconformity stated in three parts (requirement, evidence, gap). Two environmental particulars apply. A breach of a compliance obligation is a nonconformity against clause 6.1.3 or 9.1.2 whatever its size, and a breach with a reporting obligation is a major, because the consequence is regulatory. And corrective action for environmental nonconformities often needs engineering (secondary containment, abatement, monitoring equipment) with lead times, so the action plan carries interim controls as well as the permanent fix. The root cause guide gives the cause analysis methods and the issue validation guide the effectiveness review standard.
| Finding | Classification | Why | Corrective action pattern |
|---|---|---|---|
| Discharge sample exceeded the permit limit; not reported to the regulator within the permit’s notification period | Major | Compliance obligation breached with a reporting failure | Immediate notification and correction; cause analysis of the process upset and of the reporting failure; interim monitoring; permanent process control |
| Waste transferred to a carrier whose licence had lapsed | Major | Duty-of-care breach; regulatory consequence | Carrier verification control at every transfer; licence expiry tracking |
| Bund around a chemical tank cracked; capacity below the required percentage | Minor or major by risk | Operational control for a significant aspect not effective | Interim secondary containment; repair; inspection schedule |
| Aspects register not reviewed since a new process line was installed | Minor | Register not maintained for a change | Register update; change trigger added to the procedure |
| Emergency drill not performed in the year | Minor | Preparedness not tested | Drill scheduled and observed; annual trigger |
| Context analysis does not address climate change or biodiversity | Minor (2026 edition) | Context requirement not met | Analysis extended; aspects and risks reviewed |
Management review under clause 9.3 takes the audit results alongside compliance status, interested-party communications including regulator contacts, environmental performance and objectives, and the adequacy of resources; the programme’s report to it should give coverage against plan, findings by clause and aspect, compliance status with any open notices, corrective action ageing and effectiveness, and the transition status to the 2026 edition. The review’s outputs on resources and system changes become next cycle’s programme inputs.
Auditor competence and independence
Competence for environmental audits adds subject matter to the general auditor competence in ISO 19011: the environmental science behind the aspects, the regulatory regime of the jurisdiction and sector, the technology of the controls, and the permit conditions of the site. A lead auditor course in the standard supplies the method; the subject matter comes from the organisation’s own environmental staff, external specialists for complex sites, and the regulators’ published guidance. Independence follows the same rule as any first-party audit: no one audits their own work, so the environmental manager does not audit the environmental function, and the programme is reviewed by someone who does not run it. Certification auditors reconcile the auditor matrix to the reports.
The internal audit profession and ESG assurance
Three activities now touch the same ground, and organisations that have all three should know which does what. The ESG auditing guide covers the top layer in depth and the assurance mapping guide how to show the board who covers what.
| Activity | What it tests | Criteria | Who does it | Relationship to the EMS audit |
|---|---|---|---|---|
| ISO 14001 internal audit | The environmental management system: aspects, obligations, controls, performance, improvement | ISO 14001 and the organisation’s EMS documents | Trained staff; the environmental function; external first-party auditors | The subject of this guide |
| Internal audit profession | Governance, risk management and control across the organisation, including environmental risk, the EMS as a control system and its audit programme | The organisation’s objectives, regulations, control frameworks; the IIA Standards | The internal audit function reporting to the audit committee | Audits the EMS and its programme as controls; may rely on EMS audit results after testing them; owns the opinion to the board |
| ESG and sustainability assurance | Published sustainability disclosures (emissions, energy, water, waste, targets) and climate risk management | ESRS, ISSB standards, GRI, the GHG Protocol, ISSA 5000 | External assurance providers; internal audit for readiness | Relies on the EMS’s monitoring data and controls; an EMS audit that tests data integrity supports the disclosure controls |
| Regulatory inspection | Compliance with permits and law | Permits and law | The regulator | The compliance evaluation in the EMS audit is the organisation’s own version |
A practical division of labour follows from the table. The EMS audit programme tests the system and the compliance obligations at the level of detail the permits require, every cycle. The internal audit function audits the programme (its rationale, independence, coverage and the corrective action it produces) and the environmental risk governance above it (whether the board sees compliance status and incidents, whether environmental risk is in the register, whether capital decisions consider it), and relies on the programme for the detail once it has tested it. The assurance provider relies on both for the data behind the disclosures. An organisation that runs the three without the map usually has the compliance evaluation done twice and the governance audited by nobody.
The nonconformities certification bodies raise most
| Clause | Typical nonconformity | Internal audit test that finds it first |
|---|---|---|
| 6.1.3 and 9.1.2 Compliance obligations and evaluation | Register incomplete; evaluation not performed or not evidenced; status unknown | Register against permits; sample compliance tests |
| 6.1.2 Environmental aspects | Register not reviewed for changes; abnormal and emergency conditions omitted; life-cycle perspective absent | Site walk against the register; change log |
| 8.1 Operational control | Controls for significant aspects not operating (bunds, drains, waste segregation, chemical storage); supplier environmental requirements not communicated | Site observation; supplier files |
| 8.2 Emergency preparedness | Drills not performed; plans not reviewed after incidents; contractors unaware | Drill records; contractor interviews |
| 9.1.1 Monitoring and measurement | Monitoring equipment not calibrated; results not reviewed; records missing | Calibration and review evidence |
| 7.5 Documented information | Obsolete procedures; records not retained | Document sweep |
| 9.2 Internal audit | Programme not based on environmental importance; auditors not independent; audits late | Audit the programme |
| 10.2 Corrective action | Cause analysis absent; effectiveness not verified; exceedances recurring | Sample closed actions |
| 4.1 Context (2026) | Environmental conditions not considered | Context analysis review |
| 7.2 and 7.3 Competence and awareness | Emergency roles untrained; operators unaware of significant aspects | Interviews on the floor |
Worked example: Brightwater Foods’ EMS audit
Brightwater Foods is the illustrative 180-million-dollar food manufacturer used in examples across this site, with two plants certified to ISO 14001 and ISO 9001. Its rebuilt quality audit programme, described in the ISO 9001 guide, was extended to the environmental system after a regulator’s inspection raised a notice about wastewater sampling records. The first environmental internal audit under the new programme covered the larger plant’s wastewater, waste and chemical storage processes, with the compliance evaluation as its centre.
| Area | What the audit found | Classification | Action |
|---|---|---|---|
| Compliance obligations register | The discharge permit’s revised sampling frequency, in force for five months, was not in the register; sampling continued at the old frequency | Major | Register updated; sampling schedule revised; a legal update review added to the monthly environmental meeting |
| Compliance evaluation | Quarterly evaluations recorded “compliant” for wastewater with no results examined; two results in the year had exceeded the limit and were not reported within the permit’s period | Major | Late notifications made; evaluation procedure rewritten to require examination of results; exceedance reporting trigger built into the monitoring log |
| Monitoring integrity | The pH meter used for discharge checks had no calibration record; results were recorded by the operator with no review | Minor | Calibration schedule; supervisor review of results against limits |
| Waste duty of care | One of four waste carriers’ licences had expired three months earlier; transfers continued | Major | Transfers suspended with that carrier; licence verification at each transfer; expiry tracking |
| Chemical storage | Bund capacity below the required share of the largest tank; a drain valve left open | Minor | Valve locked; bund repaired; weekly inspection checklist |
| Aspects register | The new packaging line’s solvent use absent from the register | Minor | Register updated; change trigger added |
| Emergency preparedness | Spill drill performed; contractors on site had not been briefed on the spill procedure | Observation | Contractor induction updated |
| Context (2026 transition) | Context analysis did not address climate change or water availability, both relevant to the plant’s abstraction licence | Minor | Analysis extended in the transition plan |
The plant’s internal audit function reviewed the engagement for its own environmental compliance coverage and placed the EMS audit programme on the assurance map as a provider it could rely on after the second cycle; the regulator’s notice was closed with the corrected sampling and reporting evidence, and the three majors were verified effective at the ninety-day review.
Frequently asked questions
What is an ISO 14001 audit?
An audit of an environmental management system against ISO 14001 and the organisation’s own EMS documents, testing whether significant environmental aspects are identified and controlled, compliance obligations are known and met, objectives are pursued, emergencies are prepared for, and the system is maintained and improved. Internal audits under clause 9.2 are the organisation’s own; certification audits are the registrar’s; the method is the same and the compliance evaluation is the distinctive test.
What changed in ISO 14001:2026?
A broader environmental context (climate change, biodiversity, pollution and resource availability must be considered), stronger leadership and integration requirements, refined risks and opportunities tied to aspects and obligations, a demonstrable life-cycle perspective in design, procurement and supplier requirements, clearer planning of changes, clarified internal audit expectations with defined objectives and a structured programme, and terminology aligned with the harmonised structure. Published in April 2026 with a transition to April 2029.
How is an ISO 14001 internal audit different from an ISO 9001 internal audit?
The method is identical and clause 9.2 is the same requirement. The content differs: an environmental audit is built around the aspects and impacts register and the compliance obligations register, tests compliance with permits and law directly, treats the site walk as evidence in its own right, tests monitoring data integrity, and audits emergency preparedness. Breaches of compliance obligations have legal consequences, so they are nonconformities regardless of size.
What is the compliance evaluation in ISO 14001?
Clause 9.1.2 requires the organisation to evaluate at planned intervals whether it meets its compliance obligations, to act where it does not, and to know its compliance status. The internal audit tests the evaluation process (method, frequency, owner, records) and then tests compliance itself for a sample of obligations by examining monitoring results against limits, waste records against licences, submissions against deadlines and storage against permit conditions.
Who can audit an ISO 14001 system?
Anyone competent in the standard, audit methods, the environmental science and the regulatory regime of the site, who is not auditing their own work: trained staff from other departments, the environmental function for processes it does not run, or external first-party auditors. Complex sites often pair a trained internal auditor with an environmental specialist. Independence is documented so the auditor matrix reconciles to the reports.
How often should ISO 14001 internal audits be done?
At planned intervals set by a programme based on the environmental significance of the processes, the compliance obligations attached to them, changes and previous results, covering every clause and site before recertification. Activities with significant aspects and permitted discharges are audited at least annually; the registers, the emergency plans and the compliance evaluation every cycle; changed activities within a quarter of the change.
What is the relationship between an ISO 14001 audit and ESG assurance?
The EMS produces the monitoring data (emissions, energy, water, waste) that sustainability disclosures rely on, and the EMS audit that tests data integrity supports the disclosure controls that external assurance providers test under ESRS, ISSB-based standards and the GHG Protocol. The internal audit profession audits the EMS and its programme as controls and coordinates the three through an assurance map.
What are the most common ISO 14001 nonconformities?
Incomplete compliance obligations registers and unevidenced compliance evaluations; aspects registers not updated for changes; operational controls for significant aspects not operating (bunds, drains, waste segregation, storage); emergency drills not performed; uncalibrated monitoring equipment and unreviewed results; obsolete documents; audit programmes not based on environmental importance; corrective actions without cause analysis; and, under the 2026 edition, context analyses that ignore environmental conditions.
Related guides
- ISO 9001 Internal Audits — the shared method in depth
- ESG Auditing — disclosure controls and climate risk above the management system
- Internal Audit in Manufacturing — environmental compliance from the profession’s side
- Internal Audit in Energy and Utilities — the sector with the heaviest environmental obligations
- Internal Audit Work Program — the checklist template
- Audit Interviewing — reaching operators and contractors
- Root Cause Analysis for Audit Findings — cause analysis for exceedances and spills
- Issue Validation — the effectiveness-review standard
- Assurance Mapping — EMS audit, internal audit and ESG assurance on one map
- Third-Party Risk Management — supplier environmental requirements
- Types of Internal Audits — where management-system audits sit
- ISO and management systems category — every management-system guide in one archive
Leave a Reply