ISO 14001 Internal Audit Checklist: 100+ Questions Covering All Clauses (4–10)
How to Use This Checklist
This checklist contains 100+ audit questions designed for internal auditors to evaluate conformance with ISO 14001:2015 (principles reaffirmed in 2026) across Clauses 4–10. It covers the performance evaluation and improvement sub-cluster comprehensively.
Audit approach:
1. Select questions relevant to your scope (you may not audit all clauses in every audit)
2. For each question, gather evidence: document review, observation, interview
3. Record the finding: Conformant (C), Non-Conformity (NC), Observation (OBS), or Opportunity for Improvement (OFI)
4. Note the evidence (e.g., “WM-001 procedure reviewed; waste segregation observed in Warehouse A”)
5. If NC or OBS, raise a finding using the template in the Internal Audit guide
Scoring guidance (if you wish to quantify):
– Conformant answers = 1 point each
– OFI or OBS answers = 0.5 points each
– Non-Conformity answers = 0 points
– Overall compliance score = (Total points / Max possible points) × 100%
– Target: 90%+ conformance; 95%+ for certification readiness
CLAUSE 4: CONTEXT OF THE ORGANISATION (12 Questions)
4.1 Understanding the Organisation and Its Context
4.1.1 Does the organisation have documented information defining the scope of the EMS? (Check Scope Statement)
– Guidance: Scope must define which parts of the organisation, which locations, which products/services are covered. Scope should clarify exclusions (if any) and rationale.
4.1.2 Has the organisation identified internal and external issues relevant to its purpose and strategic direction? (Check context analysis/register)
– Guidance: Issues might include: market trends, regulatory changes, climate risks, stakeholder expectations, supply chain disruptions, technology changes. These should inform EMS strategy.
4.1.3 Are issues documented and regularly reviewed (at least annually)? (Check review records)
– Guidance: Context should be revisited when significant changes occur (new regulations, acquisition, major incident). Documented evidence should show when and how context was evaluated.
4.2 Understanding Stakeholder Needs and Expectations
4.2.1 Has the organisation identified stakeholders relevant to the EMS? (Check stakeholder register or analysis)
– Guidance: Stakeholders include: employees, customers, communities, regulators, NGOs, suppliers, investors. The organisation should know who they are and why they matter.
4.2.2 Are stakeholder expectations documented and considered in EMS planning? (Check minutes, strategy, planning documents)
– Guidance: Example: Customer requirement for carbon-neutral operations → sets EMS objective. Regulator expectation for quarterly reporting → sets monitoring frequency.
4.2.3 How does the organisation obtain stakeholder feedback (e.g., surveys, engagement, complaints)? (Check records of engagement)
– Guidance: Evidence: customer feedback forms, community consultation records, complaint process, employee surveys. Feedback should feed into EMS improvement.
4.3 Determining the Scope of the EMS
4.3.1 Is the scope clearly defined in writing and available to relevant personnel? (Check EMS Scope Statement; interview staff)
– Guidance: Staff should be able to explain what is and is not covered by the EMS. Scope document should be version-controlled and current.
4.3.2 If the organisation has multiple sites, does each site understand its scope and responsibilities? (Check site-specific scope documentation; interview site managers)
– Guidance: Corporate-level EMS scope may be broad; site scope should be specific (e.g., “Melbourne facility covers manufacturing of Product X, not distribution”). Exclusions must be justified.
4.3.3 Does the scope cover all operations that have significant environmental aspects? (Compare scope to aspect assessment)
– Guidance: If an operation creates significant waste but is excluded from the EMS, this is a red flag. Scope should be comprehensive unless there is a clear rationale for exclusion.
4.4 Environmental Management System
4.4.1 Is there documented information defining the EMS (policy, structure, processes, responsibilities)? (Check EMS Manual or equivalent)
– Guidance: The EMS does not need to be a single document, but there should be a map showing how procedures, documents, and responsibilities link together. New staff should be able to find “the EMS.”
4.4.2 Does documented information reference Clause 4.1–4.4 (Context, Stakeholders, Scope, EMS definition)? (Check)
– Guidance: This is housekeeping, but it confirms that context and scope considerations are documented and maintained.
CLAUSE 5: LEADERSHIP (10 Questions)
5.1 Leadership and Commitment
5.1.1 Does top management demonstrate commitment to the EMS? (Check: budget allocation, time commitment, strategic planning)
– Guidance: Evidence: EHS budget approved and funded, senior leadership attends management reviews, environmental objectives aligned with business strategy, resources allocated to improvement initiatives.
5.1.2 Does top management ensure the EMS achieves its intended outcomes? (Interview senior management; review strategy)
– Guidance: Top management should be able to articulate the purpose of the EMS and recent decisions taken to strengthen it. If they cannot, they are not genuinely committed.
5.1.3 Is accountability for EMS effectiveness assigned to specific roles/people? (Check job descriptions, delegation letters)
– Guidance: Someone should own the overall EMS (often an EHS Manager or Director). That person should have clear accountability and resources.
5.2 Environmental Policy
5.2.1 Does the organisation have a documented environmental policy? (Check policy document)
– Guidance: Policy should be: approved by top management, publicly available (at least to employees), communicated to all staff, reviewed and updated periodically.
5.2.2 Does the policy commit to compliance with applicable laws and other obligations? (Check policy text)
– Guidance: The policy should explicitly state commitment to legal compliance and any voluntary commitments (e.g., industry standards, customer requirements).
5.2.3 Does the policy commit to preventing pollution and continual improvement? (Check policy text)
– Guidance: These are explicit ISO 14001 requirements. The policy should include these commitments (or state the basis for why the organisation considers them not applicable).
5.2.4 Are staff aware of the policy and its relevance to their roles? (Interview various staff; check training records)
– Guidance: Awareness should extend beyond senior staff. A warehouse worker should understand that “preventing pollution” means proper waste segregation and spill prevention.
5.2.5 Is the policy reviewed and updated at least annually or when major changes occur? (Check review dates and revision history)
– Guidance: Policy should be reviewed in management review. Changes might be triggered by: new legislation, significant aspect changes, strategic shifts, acquisition/divestiture.
5.3 Organisational Roles, Responsibilities and Authorities
5.3.1 Are EMS roles, responsibilities and authorities documented? (Check RACI matrix, job descriptions, delegation)
– Guidance: Should cover: overall EMS ownership, monitoring and measurement, compliance evaluation, internal audit, management review, corrective action, training, operational control.
5.3.2 Is there a person responsible for ensuring the EMS meets the requirements of ISO 14001? (Check position description; interview that person)
– Guidance: This person may not have EMS as their sole role, but they should be identifiable and have sufficient authority and resources.
5.3.3 Are environmental responsibilities clearly assigned in operational procedures and job descriptions? (Check procedures, job descriptions; interview staff)
– Guidance: A supervisor should know they are responsible for ensuring environmental controls in their area. A procurement officer should know they assess supplier environmental performance.
CLAUSE 6: PLANNING (34 Questions)
6.1 Actions to Address Risks and Opportunities (including Environmental Aspects and Impacts)
6.1.1 Has the organisation identified its environmental aspects (inputs, activities, outputs of the organisation)? (Check aspect register)
– Guidance: Aspects include: energy use, water use, waste generation, emissions, chemical use, land use, noise, vibration. The list should be comprehensive for your industry.
6.1.2 Are all significant environmental aspects identified? (Check criteria for significance; review aspect assessment)
– Guidance: Significance criteria might include: scale (amount of impact), severity (potential to cause harm), frequency (how often), regulatory limits, stakeholder concern, cost impact.
6.1.3 Has the organisation assessed the environmental impacts of significant aspects? (Check impact assessment document)
– Guidance: For example: energy use → CO₂ emissions → climate change. Waste generation → landfill impact → resource depletion. The chain from activity to environmental impact should be clear.
6.1.4 Are environmental aspects and impacts documented and regularly reviewed (at least annually)? (Check register; review dates)
– Guidance: The register should be updated when operations change (new process, new product, process improvement). Review dates should show active management, not a static list.
6.1.5 Do staff understand what the significant environmental aspects are in their area? (Interview relevant staff)
– Guidance: A person working with hazardous chemicals should know this is a significant aspect. A person managing energy systems should understand energy consumption tracking.
6.1.6 Has the organisation identified risks and opportunities related to environmental management? (Check risk/opportunity register)
– Guidance: Risk examples: new regulation that could require process change; climate extreme that could disrupt supply chain. Opportunity examples: energy efficiency investment; waste reduction via process change; new market for by-products.
6.1.7 Are risk/opportunity assessments documented and linked to EMS objectives? (Check)
– Guidance: If a risk assessment identifies climate change as a threat to operations, the EMS should include objectives to build resilience (e.g., renewable energy adoption, flood-resistant facilities).
6.1.8 Are actions to address risks and opportunities assigned, resourced, and tracked? (Check action plan, budget allocation, progress tracking)
– Guidance: Risk/opportunity identification is useless without action. Actions should be specific, assigned to named people, given timelines and resources, and monitored.
6.2 Compliance Obligations
6.2.1 Does the organisation have a documented register of applicable legal requirements and other obligations? (Check legal register)
– Guidance: Register should include: legislation (national, state, local), regulations, permits, licenses, industry standards, customer requirements, corporate policy.
6.2.2 Is the legal register current and comprehensive? (Check dates; compare to known legislation for your industry)
– Guidance: A register from 3+ years ago is likely incomplete. If major legislation has changed (e.g., new environmental protection act, updated water discharge standards), the register should reflect this.
6.2.3 Does the register clearly specify which obligations apply to which areas/processes of the organisation? (Check register mapping)
– Guidance: A single obligation (e.g., water discharge limits) may apply to multiple locations. The register should make this clear. A manufacturing facility might have 50+ applicable laws; a small office might have 10.
6.2.4 Is there a mechanism to stay informed of changes in legal requirements? (Check: subscriptions, government notifications, consultants, industry bodies)
– Guidance: Evidence: subscription to environmental law updates, meeting notes from industry associations, consultancy reports, government notification registrations. Without this, you will miss new regulations.
6.2.5 When legal requirements change, is the register updated within a timely timeframe? (Check recent changes; dates)
– Guidance: This is a control to prevent compliance gaps. For critical obligations, updates should happen within 2–4 weeks of the change becoming known. For less critical, within 3 months.
6.2.6 Are compliance obligations communicated to relevant staff? (Check training records; interview staff)
– Guidance: A chemical handling procedure should reference the applicable chemical storage standard. A discharge operator should know the discharge limits. Not everyone needs to know all laws, but each person should know the laws that affect their work.
6.2.7 Is there a process to evaluate compliance with each registered obligation? (Check Clause 9.1.2 evaluation process)
– Guidance: This is the link between legal register (Clause 6.2) and compliance evaluation (Clause 9.1.2). The register lists obligations; the evaluation process tests whether you meet them.
6.3 Environmental Objectives and Planning to Achieve Them
6.3.1 Does the organisation have documented environmental objectives? (Check objectives document)
– Guidance: Objectives should be for significant environmental aspects (from Clause 6.1). They should be: specific, measurable, achievable, relevant, time-bound (SMART). Example: “Reduce energy consumption by 10% by 31 Dec 2026 against 2025 baseline.”
6.3.2 Are objectives aligned with the environmental policy and EMS context? (Compare objectives to policy; check strategy)
– Guidance: If policy commits to “preventing pollution” and “compliance,” objectives should include pollution prevention (e.g., waste minimisation) and compliance targets (e.g., zero non-compliances with discharge limits).
6.3.3 Do objectives address significant environmental aspects? (Check list of significant aspects; compare to objectives)
– Guidance: If waste, energy, and emissions are significant aspects, you should have objectives for each. Gaps are red flags (e.g., if you generate significant waste but have no waste-reduction objective, why not?).
6.3.4 ISO 14001:2026 — Are objectives defined with clarity about what is to be achieved, who is responsible, and how success will be measured? (Check objectives documentation)
– Guidance: NEW in 2026: Objectives must be “defined,” meaning clearer and more specific than in 2015. Example: OLD: “Reduce waste.” NEW: “Reduce waste to landfill from 45 tonnes per year to 30 tonnes per year by 31 Dec 2026 (Operations Manager responsible; monthly waste reporting; success = <30 tonnes in final quarter 2026).”
6.3.5 Have targets been set for objectives (baselines, interim targets, final targets)? (Check targets in objective documents)
– Guidance: Example: Energy objective baseline = 2025 consumption = 1,200 MWh. Interim target = 1,140 MWh (5% reduction) by end 2026. Final target = 1,080 MWh (10% reduction) by end 2027.
6.3.6 Are objectives realistic and achievable given resource constraints? (Review objectives in context of budget, staffing, technology)
– Guidance: An objective that is impossible to achieve becomes demotivating. An objective that requires no effort provides no improvement. Well-set objectives require stretch but are achievable with reasonable effort.
6.3.7 Has the organisation planned how to achieve objectives (action plans, responsibilities, resources, timelines)? (Check plans)
– Guidance: Each objective needs an action plan. Example: Energy reduction objective → Action plan: (1) Energy audit (Q1, Facilities Manager); (2) Motor replacement (Q2, $50k budget); (3) Staff awareness campaign (Q1–Q4, EHS Coordinator); (4) Monthly consumption monitoring (ongoing, Site Manager).
6.3.8 Are resources allocated to support objective achievement? (Check budget allocation, staffing, equipment)
– Guidance: If an objective requires $100k investment and the budget allocated is $20k, the objective will fail. Resources should match commitment.
6.3.9 Are responsibilities for objective achievement clearly assigned? (Check delegation)
– Guidance: Named people should be accountable for specific objectives or action plans. Diffused responsibility = no responsibility.
6.3.10 Is progress toward objectives monitored and reported (at least quarterly, minimum)? (Check monitoring reports; management review minutes)
– Guidance: Quarterly review is a minimum. Monthly review is better for high-priority objectives. Progress should be measured against the baseline and targets.
6.3.11 Are objectives reviewed and adjusted if circumstances change? (Check review records)
– Guidance: If a planned motor replacement is delayed due to supply chain disruption, the timeline should be adjusted. If a new significant environmental aspect is discovered, new objectives may be needed.
CLAUSE 7: SUPPORT (12 Questions)
7.1 Resources
7.1.1 Are adequate resources allocated to establish, implement, and maintain the EMS? (Check budget allocation; interview managers)
– Guidance: Resources include: people (auditors, coordinators, subject-matter experts), budget (for equipment, training, contractors), facilities, technology. Evidence: approved EHS budget, staffing levels, systems/tools in place.
7.1.2 Is the resource level sufficient to achieve environmental objectives and maintain EMS compliance? (Assessment)
– Guidance: If you have one part-time EHS coordinator for a 500-person facility, resources are likely inadequate. If you have insufficient auditors to audit all significant aspects annually, this is inadequate.
7.2 Competence
7.2.1 Does the organisation identify competence requirements for roles with EMS responsibilities? (Check competency matrices, job descriptions)
– Guidance: Example: Internal Auditor Competence = ISO 14001 knowledge + understanding of facility operations + audit skills + training completion. Environmental Officer Competence = knowledge of applicable legislation + technical knowledge + ability to manage registers and evaluations.
7.2.2 Are staff with EMS responsibilities assessed for competence? (Check assessment records, certifications)
– Guidance: Assessment can be: formal qualifications (Lead Auditor certification), formal training (internal audit course), demonstrated experience (job history), or on-the-job assessment. Evidence should be retained.
7.2.3 Are gaps in competence identified and addressed through training, hiring, or development? (Check training plans; look for targeted action)
– Guidance: If an internal auditor lacks knowledge of ISO 14001, provide training. If no staff understand environmental aspects assessment, hire or develop someone. Track competence gaps and closure.
7.2.4 Is competence maintained through refresher training or continued professional development? (Check training records; frequency)
– Guidance: Internal auditors should refresh their ISO 14001 knowledge every 2–3 years. Environmental legislation changes; training should follow. Document the frequency and completion.
7.3 Awareness
7.3.1 Are all staff aware of the environmental policy? (Check training records; interview staff)
– Guidance: Induction training should cover the environmental policy. Staff should be able to state basic commitments (compliance, prevention, improvement).
7.3.2 Are staff aware of the significant environmental aspects and impacts of their work? (Interview relevant staff)
– Guidance: A waste handler should know waste segregation is a significant aspect and why it matters (compliance, cost, environmental impact). A truck driver should understand fuel consumption and emissions.
7.3.3 Are staff aware of their roles and responsibilities in the EMS? (Interview; check job descriptions)
– Guidance: A supervisor should know they are responsible for ensuring environmental controls in their area. A procurement officer should know they screen suppliers for environmental performance. Roles/responsibilities should be in job descriptions or delegation statements.
7.3.4 Are staff aware of the potential consequences of not conforming to the EMS? (Training content; interviews)
– Guidance: Staff should understand that environmental non-compliance can result in: regulatory penalties, reputational damage, operational disruption, personal liability. This motivates compliance.
7.3.5 Is awareness training provided to all new staff during induction? (Check induction checklist; training records)
– Guidance: New staff should receive EMS awareness training within their first week. Training should cover: environmental policy, significant aspects, their roles, how to report concerns.
7.3.6 Is awareness refreshed periodically (at least annually)? (Check training schedule and records)
– Guidance: Annual EMS refresher training for all staff (or at least all EMS-relevant staff) is best practice. This might be 30 minutes for general staff, longer for specialist roles.
7.4 Communication
7.4.1 Has the organisation determined what internal and external EMS communication is needed? (Check communication plan)
– Guidance: Internal: management review communications, objective status, incident reporting, suggestions. External: community notification, regulator reporting, customer requirements, stakeholder engagement.
7.4.2 Are there processes for internal communication of relevant EMS information? (Check: notice boards, email, meetings, systems)
– Guidance: Examples: monthly environmental performance email, EHS notice board, team briefings, suggestion box for improvement ideas. Different staff levels may need different communication (executives = strategic; operators = tactical).
7.4.3 Are staff encouraged and able to raise environmental concerns (incidents, hazards, suggestions)? (Check: reporting mechanism, feedback on suggestions, interview staff)
– Guidance: There should be a clear way to report an environmental concern (spill, chemical storage issue, waste disposal concern) without fear of retaliation. Feedback should be provided on what happened to the report.
7.4.4 Are external communications about the EMS managed? (Check: policy on external disclosure, approval process)
– Guidance: Not all EMS information is for public disclosure. There should be a process for: handling regulator inquiries, responding to community concerns, disclosing environmental performance (e.g., in sustainability reports), managing incident communication.
7.4.5 Does the organisation communicate environmental performance to stakeholders as appropriate? (Check: sustainability reports, customer communications, regulator submissions)
– Guidance: Transparency builds credibility. Many organisations publish annual sustainability reports or environmental performance summaries. Communication should be accurate and based on monitoring data.
7.5 Documented Information
7.5.1 Does the organisation have a system to manage EMS documented information? (Check: document management procedure, repository)
– Guidance: Documented information should be: easily findable, version-controlled, regularly reviewed, approved before use, retained per legal/business requirements. It can be paper or electronic; a system should exist.
7.5.2 Is documented information maintained and readily available to staff who need it? (Check accessibility; interview staff about finding documents)
– Guidance: A waste segregation procedure should be posted at the waste collection point or readily accessible online. Staff should be able to find the EMS documents they need without excessive searching.
7.5.3 Are documents reviewed and updated when procedures, legal requirements, or operations change? (Check version history; review dates)
– Guidance: Documents should show: date created, date last reviewed, date of revision, approval signature/initials. Out-of-date documents can mislead staff or auditors.
7.5.4 Are records of monitoring, compliance evaluation, internal audits, corrective actions, and management review retained? (Check retention system)
– Guidance: Records should be retained per legal requirement (typically 6–10 years for environmental records) or per business requirement. A system should track what records exist and where.
7.5.5 Are records protected from damage, deterioration, or loss? (Check storage method, backup systems)
– Guidance: Paper records should be stored in a secure, dry location. Electronic records should be backed up, password-protected if sensitive, and accessible to authorized personnel.
CLAUSE 8: OPERATION (16 Questions)
8.1 Operational Planning and Control
8.1.1 Has the organisation identified processes and operations that are related to significant environmental aspects? (Check process maps, operational procedures)
– Guidance: Link: significant aspect → critical operation → control needed. Example: Significant aspect = waste generation → Critical operation = waste segregation → Control = procedure, training, supervision, labelling.
8.1.2 Are operational controls documented for processes that can have significant environmental impacts? (Check procedure library; compare to aspects list)
– Guidance: Controls can be: preventive (prevent the impact: spill containment for chemical storage), detective (find the impact: monitoring), or responsive (manage the impact: spill cleanup kit). Most operations need all three.
8.1.3 Are operational procedures clear, specific, and implementable? (Review procedure content; observe implementation)
– Guidance: A good procedure specifies: what to do, who does it, when/how often, what success looks like, what happens if something goes wrong. Vague procedures are not controls.
8.1.4 Are operational procedures available to staff who need them? (Check accessibility; interview staff)
– Guidance: A waste management procedure should be at the point of use (not filed in an office). Staff should understand the procedure or be trained on it.
8.1.5 Are staff trained on operational procedures relevant to their roles? (Check training records; observe practice)
– Guidance: Training should include: why the procedure exists (environmental impact), what you must do, what happens if you don’t, how to handle exceptions. Training records should be retained.
8.1.6 Is performance of operational procedures monitored? (Check: monitoring records, observation, supervisor checks)
– Guidance: Evidence: daily checklists, supervisor sign-offs, periodic observation, automated monitoring. Someone should verify that the procedure is actually being followed.
8.1.7 Are operational controls reviewed and updated when operations, regulations, or environmental aspects change? (Check review dates; compare to operational changes)
– Guidance: If a new chemical is introduced, chemical handling procedures should be reviewed. If a new waste stream appears, waste classification should be reviewed. Controls should evolve with operations.
8.1.8 Are contractors and suppliers aware of EMS requirements applicable to their work? (Check: contract specifications, induction records, site rules)
– Guidance: If a contractor is performing work on your site (maintenance, cleaning, transport), they should understand environmental requirements (where waste goes, chemical storage rules, spill response). This should be in contracts and verified through induction.
8.2 Emergency Preparedness and Response
8.2.1 Has the organisation identified potential environmental emergencies (e.g., spills, fires, uncontrolled releases)? (Check emergency risk assessment)
– Guidance: Consider: what substances/situations could cause environmental damage? What is the worst-case scenario? Emergency planning should focus on high-consequence events.
8.2.2 Are there plans and procedures to prevent or mitigate environmental emergencies? (Check emergency procedures; review preventive controls)
– Guidance: Examples: spill containment (secondary containment for chemicals, absorbent pads, response kit), fire suppression in high-risk areas, procedures to shut down operations safely, backup systems for critical processes.
8.2.3 Are emergency response procedures documented and available to relevant staff? (Check procedures; observe location of plans)
– Guidance: Procedures should cover: detection of emergency, initial response, escalation, external notification (fire, police, environmental regulator if required), cleanup, investigation. Response procedures should be posted or readily accessible.
8.2.4 Are staff trained on emergency response procedures and their roles? (Check training records; verify recent training)
– Guidance: Training should be scenario-based if possible (not just reading). Staff should know: what to do first, who to notify, how to contain the emergency, when to evacuate. Training should be refreshed at least annually.
8.2.5 Is emergency response equipment maintained and accessible? (Check: spill kits, fire extinguishers, first aid kits, eyewash stations)
– Guidance: Equipment should be: inspected regularly (monthly minimum for spill kits, per manufacturer for extinguishers), accessible, stocked, and staff should know where it is and how to use it.
8.2.6 Are emergency procedures tested and updated? (Check: test frequency, test records, updates)
– Guidance: Annual drills or simulations are best practice. If a real emergency occurs, the response should be documented and used to update procedures. Procedures should be reviewed every 2 years minimum.
8.2.7 Is there a process to document and report environmental emergencies and near-misses? (Check: incident register, report forms)
– Guidance: Every incident (and near-miss) should be documented: what happened, when, what was the environmental impact/potential impact, what was done to stop it, how will you prevent it recurring.
8.2.8 Are environmental emergencies investigated to identify root causes and prevent recurrence? (Check: incident investigation reports)
– Guidance: Investigation should answer: what happened (facts), why it happened (root cause), what can be done to prevent it (corrective action). This is a Clause 10.2 process.
CLAUSE 9: PERFORMANCE EVALUATION (20 Questions)
9.1 Monitoring and Measurement
9.1.1 Has the organisation established what to monitor and measure in relation to significant environmental aspects? (Check: monitoring plan, KPIs)
– Guidance: For each significant aspect, identify: what indicator will measure performance (EPI or MPI), how will it be measured, how often, success criteria, who collects data.
9.1.2 Are monitoring and measurement methods appropriate to the aspect and operation? (Assess methods)
– Guidance: Energy consumption → automated meter readings. Water quality → laboratory analysis. Waste segregation accuracy → visual inspection + sampling. Methods should be appropriate to the risk and required accuracy.
9.1.3 Is monitoring data collected on the planned frequency? (Check monitoring records; assess timeliness)
– Guidance: If a monthly monitoring plan exists, data should be collected every month on schedule. Gaps suggest the plan is not realistic or is not managed.
9.1.4 Is monitoring data accurate and reliable? (Check: equipment calibration, data verification processes)
– Guidance: Instruments should be calibrated per manufacturer requirements. Data should be verified (if possible) by a second person. Suspicious data (inconsistent with trends) should be investigated.
9.1.5 Are monitoring records retained and maintained? (Check: retention system, accessibility)
– Guidance: Records should be: accessible for review, retained per legal requirements (typically 6+ years), organized by date and location, protected from loss/damage.
9.1.6 Is monitoring data analyzed to identify trends and trigger investigation/action? (Check: analysis reports, response to anomalies)
– Guidance: A spike in waste generation or a downward trend in energy consumption should prompt investigation. Data that just sits in files provides no value.
9.1.7 Are environmental performance indicators (EPIs) and monitoring performance indicators (MPIs) tracked? (Check KPI dashboards)
– Guidance: EPIs measure environmental impact (emissions, waste, water). MPIs measure system performance (% compliance with procedures, training completion rate). Both should be monitored.
9.1.8 Are baselines and targets for monitoring indicators established? (Check baseline documentation, target setting)
– Guidance: Example: Energy baseline = 2024 consumption = 1,200 MWh. Target = 10% reduction by 2026 = 1,080 MWh. Without baselines, trend analysis is impossible.
9.1.9 Is monitoring data used in management review and decision-making? (Check: management review minutes, strategic decisions)
– Guidance: Monitoring data should inform: objective setting, resource allocation, priority areas for improvement, strategic direction. Data-free decisions suggest monitoring is not being used.
9.1.2: Evaluation of Compliance
9.1.10 Has the organisation established a process to evaluate compliance with legal requirements and other obligations? (Check: compliance evaluation procedure, schedule)
– Guidance: Process should define: what obligations will be evaluated, how often (frequency), how evaluation will be done (testing, document review, observation), who will do it, how results will be documented.
9.1.11 Is compliance with legal requirements and other obligations evaluated according to the established frequency? (Check: evaluation records, dates)
– Guidance: If a monthly evaluation is planned, records should show compliance evaluations completed every month. Skipped evaluations risk undetected non-compliance.
9.1.12 Does the compliance evaluation process verify actual compliance, not just the existence of procedures? (Check: evaluation methodology)
– Guidance: Example: Legal obligation = “discharge BOD must not exceed 50 mg/L.” Poor evaluation = “procedure exists.” Good evaluation = “recent discharge test showed 32 mg/L” (evidence of actual compliance).
9.1.13 Are the results of compliance evaluation documented and retained? (Check: compliance evaluation records)
– Guidance: Records should document: obligation evaluated, evaluation date, method, result (compliant/non-compliant), evidence, any follow-up actions. Records should be retained per legal requirements.
9.1.14 Does the compliance evaluation process identify non-compliance with legal requirements? (Check: records for identified issues)
– Guidance: If the evaluation process is working, it should periodically find non-compliance issues (or confirm compliance is being maintained). If it never finds issues, either compliance is perfect (unlikely) or the evaluation is inadequate.
9.1.15 Are non-compliances with legal requirements managed as corrective actions? (Check: link between compliance evaluation and Clause 10.2)
– Guidance: When evaluation finds non-compliance (e.g., spill not cleaned up to standard), this should trigger a corrective action: why did it happen, what immediate action, what preventive action, follow-up verification.
9.2 Internal Audit
9.2.1 Does the organisation have an internal audit programme covering all of ISO 14001 (Clauses 4–10)? (Check: audit programme, schedule)
– Guidance: Annual programme should plan audits covering all significant areas, all clauses. Audits need not all happen in Q1; they can be distributed across the year.
9.2.2 Does the audit programme include defined objectives for each audit? (Check: individual audit plans)
– Guidance: ISO 14001:2026 requires “defined audit objectives.” Each audit should have a clear purpose (e.g., “verify compliance with waste management procedure WM-001” or “evaluate effectiveness of energy monitoring controls”).
9.2.3 Are auditors competent in ISO 14001 and the area being audited? (Check: auditor qualifications, training records)
– Guidance: Auditors should demonstrate: ISO 14001 knowledge (training certificate or demonstrated knowledge), knowledge of the area being audited (job experience or technical training), audit skills (audit training or demonstrated ability).
9.2.4 Are auditors independent of the area they are auditing? (Check: no conflict of interest)
– Guidance: An auditor should not audit their own department or their manager’s area. In small organisations, independence may be limited but should be documented.
9.2.5 Are internal audits conducted according to the audit programme schedule? (Check: audit records, dates)
– Guidance: If audits are planned for Q1 and Q2, audits should be completed by the end of Q2. Slipped audits suggest the programme is not being managed.
9.2.6 Do audits result in findings (non-conformances, observations, or opportunities for improvement)? (Check: audit reports)
– Guidance: Audits that find nothing suggest inadequate depth or auditor bias. A mature EMS should have some findings annually (not necessarily non-conformances, but observations or improvement opportunities).
9.2.7 Are audit findings documented clearly and provided to auditees? (Check: audit reports, documentation quality)
– Guidance: Findings should specify: what was found, evidence, why it matters, what clause or procedure applies, what corrective action (if any) is needed. Reports should be clear enough for an outsider to understand.
9.2.8 Are audit findings actioned (corrective actions, observations addressed, OFIs considered)? (Check: follow-up on findings, corrective action closure)
– Guidance: A non-conformity finding should have a corrective action with a target closure date. Observations should be reviewed; some should become corrective actions. OFIs should be evaluated for improvement priority.
9.3 Management Review
9.3.1 Does the organisation conduct management review of the EMS? (Check: meeting frequency, attendance, minutes)
– Guidance: Management review should occur at least annually. Attendees should include: top management, EHS leadership, operations leadership, other functional leaders as appropriate. Meeting should be documented (minutes).
9.3.2 Are the 9 mandatory inputs provided to management review? (Check: management review agenda and supporting documents)
– Guidance: The 9 inputs are: (1) status of actions from previous review, (2) external/internal changes, (3) stakeholder needs/expectations, (4) environmental performance (monitoring data), (5) compliance status, (6) internal audit findings, (7) contractor/supplier performance, (8) opportunities for improvement, (9) resource needs. All 9 should be addressed.
9.3.3 Are management review inputs based on recent and accurate data? (Check: dates of supporting documents, data currency)
– Guidance: Management review should not rely on data > 3 months old. Monitoring data should be current (this month or last month). Audit reports should be recent (last 3–6 months).
9.3.4 Does management review result in documented outputs and decisions? (Check: management review minutes, action register)
– Guidance: Outputs should include: decisions about environmental policy and objectives, decisions about resources, decisions about risk/opportunity management, decisions about improvement actions. These should be documented and assigned.
9.3.5 Are management review outputs communicated to relevant personnel? (Check: communication of review outcomes)
– Guidance: Staff should know what management decided about objectives, resources, improvement priorities. This drives engagement and alignment.
9.3.6 Are management review outputs actioned and tracked? (Check: follow-up on decisions)
– Guidance: If management decides to increase EHS budget or shift resource to waste reduction, this should be visible in action plans and budgets. Decisions that don’t lead to action signal a review that is not meaningful.
CLAUSE 10: IMPROVEMENT (12 Questions)
10.1 Continual Improvement
10.1.1 Is the organisation committed to continual improvement of the EMS? (Check: policy, strategy, evidence of improvement
– Guidance: Evidence: environmental objectives become more ambitious over time, processes are refined based on audit findings, staff suggestions for improvement are sought and evaluated, performance metrics show year-on-year improvement (or management has rationale for why not).
10.1.2 Does the organisation use monitoring data, audit findings, and stakeholder feedback to identify improvement opportunities? (Check: data analysis, improvement register)
– Guidance: Example: Monitoring shows energy consumption is not decreasing → investigation → identify inefficient equipment → improvement opportunity → investment decision. Sources of improvement ideas should include: data analysis, audits, staff suggestions, customer feedback, regulator guidance.
10.1.3 Are improvement opportunities assessed, prioritised, and acted upon? (Check: improvement register, prioritization criteria)
– Guidance: Not every opportunity can be pursued (resource constraints). Organisations should have criteria to prioritize: impact on environmental performance, compliance risk, cost-benefit, strategic alignment. Some opportunities become projects; others are implemented through continuous improvement processes.
10.1.4 Is there evidence of improvement actions being completed and verified to be effective? (Check: completion records, effectiveness assessment)
– Guidance: An improvement project should have: start date, completion target, responsible person, resources, success criteria, completion date, verification of effectiveness (did it achieve the intended outcome?).
10.2 Nonconformity and Corrective Action
10.2.1 Has the organisation established a process for managing nonconformities (including non-compliance with obligations)? (Check: corrective action procedure)
– Guidance: Process should define: how nonconformities are identified (audit, monitoring, incident, complaint), how they are documented, how root cause is determined, what corrective actions are, how effectiveness is verified.
10.2.2 Are sources of nonconformities identified (internal audit, monitoring, incident, customer complaint, external audit)? (Check: nonconformity register, sources)
– Guidance: A well-designed EMS catches problems through: internal audits (system failures), monitoring (performance drift), incident reporting (acute problems), customer feedback (external perspective), external audits (independent assessment).
10.2.3 Are nonconformities documented clearly (what happened, when, where, why it matters)? (Check: nonconformity records)
– Guidance: Documentation should be specific enough that someone unfamiliar with the situation understands the problem and its significance. Vague descriptions (“Poor procedure compliance”) are not useful.
10.2.4 Is root cause analysis performed for nonconformities? (Check: corrective action records, root cause analysis)
– Guidance: Corrective actions should address root cause, not just symptoms. Methods: 5 Whys (ask why 5 times to go beyond the obvious), Fishbone diagram (explore multiple cause categories), failure mode analysis. Root cause should be documented.
10.2.5 Are corrective actions specific, assigned, and resourced? (Check: corrective action assignments, plans)
– Guidance: A corrective action should specify: what will be done, who will do it, by when, resources needed, how success will be measured. Vague actions (“improve procedure”) do not drive change.
10.2.6 Are corrective action timelines realistic but ambitious? (Assess)
– Guidance: A severe nonconformity (regulatory risk) might be corrected within 1–2 weeks. A moderate nonconformity within 4–8 weeks. Timelines beyond 8 weeks should be justified. Timelines that are regularly extended suggest either unrealistic setting or poor execution.
10.2.7 Is the effectiveness of corrective actions verified (e.g., through follow-up audit, observation, monitoring)? (Check: corrective action closure records)
– Guidance: Do not close a corrective action based on the assignee’s word that it is done. Verify: procedure change happened, training was completed, equipment was fixed, monitoring data shows the problem is resolved.
10.2.8 Are corrective actions tracked to closure? (Check: corrective action register, aging analysis)
– Guidance: Overdue corrective actions (those past the target date) should be escalated. An organization with multiple actions > 30 days overdue has a management system failure.
10.2.9 Are patterns of nonconformities identified and addressed? (Check: trend analysis, systemic actions)
– Guidance: If you keep finding the same type of nonconformity (e.g., waste segregation errors in Warehouse A), the issue is systemic (procedure, training, supervision) not just an individual error. Systemic issues require systemic solutions (procedure redesign, retraining, re-supervision).
10.2.10 Are lessons learned from nonconformities communicated to prevent similar issues elsewhere in the organisation? (Check: communication, learning capture)
– Guidance: If Facility A had a spill due to improper chemical storage, Facility B should learn from this. Lessons learned should be shared (toolbox meetings, procedure updates, training revisions).
How to Score and Interpret Results
Scoring Method
For each question:
– Conformant (C): Evidence shows full compliance with the requirement = 1 point
– Opportunity for Improvement (OFI): Process exists and is mostly working, but enhancement would strengthen the EMS = 0.75 points
– Observation (OBS): Gap identified that is not yet a non-conformity (risk is potential, not current) = 0.5 points
– Non-Conformity (NC): Clear contradiction of requirement = 0 points
Overall Score = (Total points / Maximum possible points) × 100%
Interpretation
- 95–100%: Ready for certification. Focus on minor refinements.
- 90–94%: Near-ready for certification. Address observations and minor non-conformities before applying.
- 80–89%: EMS is operational but has gaps. Plan a remediation timeline (typically 6–12 weeks). Target improvements before certification.
- 70–79%: EMS is under-developed. Significant work needed. Plan 3–6 months of development. Certification is not ready.
- Below 70%: EMS is ineffective or immature. Fundamental work required. Plan 6–12 months of development before certification consideration.
Difference Between Internal Checklist and Certification Body Audit
Your internal audit checklist is more detailed and comprehensive than a certification audit will be. Certification auditors will:
- Focus on high-risk areas and significant aspects
- Sample rather than exhaustively check everything
- Prioritize documented evidence over observation
- Spend 2–4 days for a medium-sized organisation (vs. your internal audits might span weeks)
- Look for systemic conformance, not just individual examples
Internal audits should be more rigorous than certification audits. If your internal audits find nothing, you are not auditing deeply enough.
Key Takeaway: This checklist is a tool for planning and conducting audits. Tailor it to your organisation. Use it to drive evidence gathering and consistent finding documentation. Remember: the goal of internal audit is improvement, not punishment. A well-executed audit identifies gaps early, allows time for correction, and strengthens the EMS before external auditors arrive.
Recent Comments