Introduction
ISO 14001:2015 requires organisations to create and maintain documented information—both documents (procedures, policies, instructions) and records (evidence of implementation and compliance). Many organisations find documentation overwhelming; this guide breaks it down into what’s mandatory vs. recommended, lists each by clause, and explains retention and best practice.
The standard does not prescribe how you document (paper, digital, templates); it prescribes what you must document. This flexibility is intentional—your documentation approach should suit your organisation size, sector, and IT capability.
This guide covers all mandatory documents and records by clause, with practical examples and a summary of retention periods.
Documented Information vs. Records: Key Distinction
Documented information is any information that your organisation must control and maintain as part of its EMS. ISO 14001:2015 replaced the old terms “documents” and “records” with “documented information” to reflect that this could be digital, paper, photo, video, or another format.
However, it’s practical to distinguish:
| Category | Purpose | Typical Format | Examples |
|---|---|---|---|
| Documents (static procedures/policies) | Describe how your EMS works; provide instruction; set requirements | Policies, procedures, work instructions, registers, templates | Environmental policy, waste handling procedure, significant aspects register, training template |
| Records (evidence of action) | Show that you’ve done what you said you’d do; provide evidence of compliance | Signed/dated records, logbooks, test results, photographs, certificates | Training attendance sheet, audit minutes, inspection report, monitoring data, incident investigation |
The distinction matters for management. Documents should have version control, approval, and review cycles. Records should be retained for defined periods and be readily retrievable.
Complete List of Mandatory Documents by Clause
Here’s a comprehensive table of all mandatory documented information required by ISO 14001:2015:
| Clause | Document/Record | Mandatory? | Purpose | Typical Retention |
|---|---|---|---|---|
| 4.4 | Legal and regulatory compliance register | Y | List all applicable environmental laws, regulations, and permits | Ongoing; update when legislation changes |
| 5.2 | Environmental policy (documented) | Y | Statement of environmental commitment and principles; must be approved by top management | For life of organisation; retain in archive |
| 6.1.1 | Context analysis—internal and external factors | Y | Document factors affecting EMS (stakeholders, risks, opportunities, compliance obligations) | Ongoing; update annually or when context changes |
| 6.1.2 | Interested parties and their relevant needs | Y | List key stakeholders (customers, regulators, neighbours, employees) and their environmental expectations | Ongoing; update when stakeholders change |
| 6.2 | Environmental aspects and impacts register | Y | Identify all activities, products, services; assess environmental aspects; determine significance | Ongoing; annual review minimum |
| 6.3a | Environmental objectives | Y | What the organisation aims to achieve environmentally; must be linked to significant aspects | For duration objectives are active; archive when superseded |
| 6.3b | Planning of changes to achieve objectives | Y | How you’ll achieve environmental objectives; who’s responsible; timeline; resources | Track throughout year; document outcomes in management review |
| 7.1 | Resources (budget allocation for EMS) | Y | Evidence that adequate resources (people, money, technology) are allocated | Ongoing; document in annual budget |
| 7.2a | Competence requirements (by role) | Y | Define what knowledge, skills, training needed for each EMS-relevant role | Ongoing; update when roles or requirements change |
| 7.2b | Competence assessment (per individual) | Y | Record that staff have been assessed against competence requirements | Retain 3+ years; demonstrate current competence at audit |
| 7.2c | Training records | Y | Date, topic, duration, attendees, trainer; demonstrate all relevant staff have been trained | Retain 3+ years minimum |
| 7.2d | Awareness programme records | Y | Evidence of induction, toolbox talks, posters, communications (not formal training) | Retain 12 months minimum; longer for safety-critical roles |
| 7.4a | Internal communication (documented) | Y | How you’ll communicate EMS info internally (e.g., toolbox talk schedule, newsletter template, intranet) | Retain plan ongoing; retain evidence of execution 12 months |
| 7.4b | External communication process (documented) | Y | How you’ll engage with external parties on environmental issues (e.g., website policy, complaint response procedure) | Retain plan ongoing; retain evidence 12 months |
| 7.5.1 | Document control procedure | Y | How you’ll control documents (version, approval, distribution, retention, archiving) | Ongoing; retain as your central procedure |
| 7.5.2 | List of controlled documents | Y | Document register showing all EMS documents, versions, approval status, location | Ongoing; maintain as living record |
| 7.5.3 | Records management procedure | Y | How you’ll manage records (storage, access, retrieval, retention, disposal) | Ongoing; retain as your central procedure |
| 8.1 | Operational controls (documented procedures) | Y | For each significant aspect, document the control procedure (energy, waste, water, emissions, etc.) | Ongoing; update when processes change |
| 8.1 | Work instructions or SOPs | Y | Step-by-step guidance for staff on how to implement environmental controls | Ongoing; update when processes change |
| 8.2 | Contractor/supplier requirements (documented) | Y | Specify environmental requirements that external providers must meet (in contract or induction) | Ongoing; retain in supplier file |
| 8.2 | Contractor induction/briefing record | Y | Evidence that contractors have been informed of environmental requirements | Retain 3+ years; show at each contractor site visit |
| 8.3 | Emergency preparedness procedure | Y | Describe how you’ll prepare for and respond to environmental emergencies (spills, releases, etc.) | Ongoing; retain procedure |
| 8.3 | Emergency contact list (internal and external) | Y | Names, phone numbers, roles (emergency response lead, environmental agency contacts, etc.) | Keep current; update quarterly |
| 8.3 | Emergency drill records | Y | Date, scenario, participants, outcomes, improvements identified | Retain 3+ years; demonstrate annual drills |
| 9.1a | Monitoring and measurement plan | Y | What you’ll monitor (energy, waste, water, emissions); frequency; method; responsibility | Ongoing; update annually |
| 9.1b | Baseline data (initial measurements) | Y | Historical or current data on energy use, waste generation, water consumption, emissions; shows starting point | Retain indefinitely; needed for trend analysis |
| 9.1c | Monitoring records (raw data) | Y | Actual measurements taken (meter readings, waste logs, test results, etc.) | Retain 3+ years minimum; longer for legal compliance |
| 9.1d | Performance against objectives | Y | Tracking data showing progress towards environmental objectives | Retain annually; review in management review |
| 9.2a | Internal audit schedule (annual programme) | Y | Planned dates, scope, responsible auditors, criteria; covers all clauses and significant aspects | Retain as ongoing programme; archive old schedules |
| 9.2b | Internal audit checklist/plan | Y | Questions or areas to check during each audit; tailored to your organisation | Retain ongoing; archive past checklists |
| 9.2c | Internal audit findings report | Y | What was found (conformances, nonconformities, observations); recommendations; sign-off | Retain 3+ years |
| 9.3a | Management review agenda (template) | Y | Topics to cover (compliance, significant aspects, objectives, internal audit findings, etc.) | Retain template ongoing |
| 9.3b | Management review minutes | Y | Recorded discussion, decisions made, actions assigned, follow-up dates | Retain 3+ years; evidence of follow-up crucial |
| 9.3c | Management review input checklist | Y | Evidence that management considered: compliance status, objectives progress, audit findings, stakeholder feedback | Often part of agenda; retain with minutes |
| 10.1 | Nonconformity register/log | Y | Environmental incidents, breaches, or control failures; date; description; severity | Retain 3+ years; analyse for trends |
| 10.2a | Corrective action procedure | Y | How you’ll identify root causes, implement fixes, and verify effectiveness | Ongoing; retain as your central procedure |
| 10.2b | Corrective action requests/forms | Y | Individual CAs logged; issue, root cause, action taken, person responsible, due date, evidence of closure | Retain 3+ years; show closure evidence at audit |
| 10.3 | Continual improvement register | Y | Improvement ideas, suggestions, projects; status; outcomes achieved | Retain ongoing; show progress towards objectives |
Mandatory Records Summary Table
For quick reference, here are all mandatory records (evidence of action):
| Record Type | When Created | Typical Retention |
|---|---|---|
| Training attendance sheet | After each training event | 3+ years |
| Competence assessment form | When staff assessed | 3+ years (life of employment) |
| Internal audit report | After audit completion | 3+ years |
| Management review minutes | After annual review meeting | 3+ years |
| Monitoring data (energy, waste, water) | Per monitoring schedule (daily/weekly/monthly) | 3+ years minimum; longer for legal compliance |
| Nonconformity/incident report | When incident/breach occurs | 3+ years |
| Corrective action form | When CA initiated | 3+ years + evidence of closure |
| Contractor induction record | When contractor inducted | 3+ years; per contractor engagement |
| Emergency drill report | After drill conducted | 3+ years |
| Calibration certificate | When equipment calibrated | Duration of equipment use + 3 years |
Recommended Non-Mandatory Documents
While not explicitly required, these documents support certification and smooth operations:
| Document | Why Recommended | Example |
|---|---|---|
| EMS manual | Central reference document describing your entire system | 20–40-page overview of all clauses, key processes, and roles |
| Risk and opportunity register | Beyond mandatory context analysis; tracks strategic risks/opportunities | Identifies business risks and ties to environmental objectives |
| Significant aspects impact matrix | Detailed analysis of which aspects are most significant | Helps prioritise controls and investment |
| Emergency scenarios register | Identifies specific credible scenarios (spill size, chemical type, location) | More detailed than mandatory procedure; guides preparedness |
| Staff EMS awareness guide | Simple, visual summary of environmental policy and expectations | Poster or one-pager for staff; supports induction |
| Stakeholder engagement log | Track communication with external parties (complaints, feedback, requests) | Shows responsiveness and helps maintain relationships |
| EMS effectiveness metrics dashboard | Visual KPI tracking (objectives progress, audit findings, incidents) | Supports management review and continuous monitoring |
| Supply chain environmental scorecard | Assessment of supplier environmental performance | Supports “external providers” clause and supplier improvement |
| Annual EMS report | Summary of annual performance, achievements, and plans | Useful for internal and external communication |
Format Requirements: Paper vs. Digital
ISO 14001 does not mandate format. You may use:
- Paper: Printed procedures in physical binders, handwritten records
- Digital: Word documents, PDFs, databases, EMS software
- Mixed: Some documents paper, some digital (common in hybrid organisations)
Practical considerations:
| Format | Pros | Cons |
|---|---|---|
| Paper | Simple; no IT barriers; auditors can read immediately | Bulky to store; hard to update; revision control challenging; environmental cost |
| Digital (shared drive) | Easier updating; version control possible; searchable; less paper | Requires IT infrastructure; requires access controls; needs backup |
| EMS software | Integrated; audit trail; automatic reminders; role-based access; scalable | Cost; training required; requires ongoing IT support |
Most organisations now use a combination: core procedures and records in digital form (shared drive or software), with some paper records (e.g., signed contractor induction sheets).
Document Control Essentials
ISO 14001 requires you to “control” documented information. This means:
Version Control
Every document must have:
– Document ID (e.g., “EMS-OP-001”)
– Version number (e.g., “v1.0”, “v1.1”, “v2.0”) that changes with updates
– Date created and date last updated
– Approval signature/date (who signed off this version)
– Author and reviewer names
– Distribution list (who has copies)
Example header:
DOCUMENT: Waste Management Procedure
DOCUMENT ID: EMS-OP-003
VERSION: 2.0
CREATED: 1 Jan 2025
UPDATED: 15 Mar 2026
APPROVED BY: General Manager
REVIEWER: EMS Coordinator
EFFECTIVE DATE: 1 Apr 2026
NEXT REVIEW: 31 Mar 2027
DISTRIBUTION: All operational staff, supervisors, contractors
Review Cycle
Establish a review cycle for each document:
– Annual review minimum: Even if no changes, document should be reviewed and approved annually to confirm it’s current
– Triggered reviews: Update immediately if processes change, legislation changes, or audit findings require it
– Archive old versions: Keep superseded versions for 3+ years for audit trail, but clearly mark as “superseded”
Access and Approval
- Who can access? Define who needs which documents (e.g., all staff see environmental policy; only ops staff see waste procedure)
- Who can edit? Typically, only the document owner or EMS coordinator
- Who must approve? Usually, the manager responsible for that area + EMS coordinator + (sometimes) general manager for strategic documents
Distribution
Maintain a document register listing:
– Document ID and title
– Current version number
– Approval date
– Distribution list
– Review date
Example document register:
| Doc ID | Title | Current Version | Approved | Distributed To | Review Due |
|---|---|---|---|---|---|
| EMS-PL-001 | Environmental Policy | 2.0 | 15-Mar-26 | All staff, external website | 15-Mar-27 |
| EMS-OP-001 | Energy Management Procedure | 1.2 | 1-Feb-26 | Operations, facilities, supervisors | 1-Feb-27 |
| EMS-OP-003 | Waste Management Procedure | 1.0 | 20-Jan-26 | Ops, site, contractors | 20-Jan-27 |
| EMS-TM-001 | Training Register | Live | Ongoing | HR, EMS coordinator | Quarterly update |
Records Retention Periods: Practical Guide
| Record Type | Why Retain | Typical Period | Legal Basis |
|---|---|---|---|
| Training records | Proof of competence; staff may challenge lack of training | 3+ years after training; life of employment for senior staff | Occupational health and safety law; fair work practices |
| Audit reports | Evidence of EMS function; baseline for future audits | 3+ years; keep last 3 years’ reports | ISO 14001 clause 9.2 |
| Management review minutes | Proof of review; trend analysis; board accountability | 3+ years | ISO 14001 clause 9.3; governance best practice |
| Monitoring data | Trend analysis; regulatory compliance; baseline for objectives | 3+ years minimum; longer for regulated sectors (e.g., mining, water) | Environmental regulations; business continuity |
| Incident/nonconformity reports | Root cause analysis; legal liability; trend identification | 3+ years + statute of limitations (often 6 years for environmental) | Environmental law; occupational safety law |
| Corrective actions | Evidence of closure; effectiveness verification | 3+ years + proof of effectiveness | ISO 14001 clause 10.2 |
| Compliance audit checklist | Reference for future compliance checks | 3+ years | Continuous improvement |
| Calibration certificates | Equipment accuracy; legal compliance for testing | Duration of equipment use + 3 years | ISO 14001 clause 9.1; environmental regulations |
| Contractor inductions | Proof of environmental brief; liability protection | 3+ years; per contractor relationship | ISO 14001 clause 8.2 |
| Regulatory correspondence | Proof of compliance; regulatory relationship | Duration of permit/requirement + 3 years | Environmental law; administrative law |
Practical Document Management System Options
Option 1: Shared Drive (Minimal Cost)
Use your organisation’s shared drive (OneDrive, SharePoint, Google Drive) as a central filing system.
Setup:
– Create folder structure mirroring ISO 14001 clauses (4, 5, 6, 7, 8, 9, 10)
– Subfolders for documents vs. records
– Naming convention: “YYYY-MM-DD_DocumentName_VX.X”
– Access controls: restrict who can edit
– Backup: rely on organisation’s standard IT backup
Pros: Free/minimal cost; simple; accessible anywhere
Cons: Version control relies on discipline; no audit trail; limited workflow
Option 2: EMS Software (Moderate Cost)
Dedicated EMS software (e.g., Envirobase, Enablon, Intelex, etc.) provides integrated document and records management.
Cost: AUD 2,000–8,000+ per year depending on users and features
Typical features:
– Document version control with approval workflows
– Records capture and automatic retention alerts
– Role-based access and audit trails
– KPI dashboards and reporting
– Mobile app for field staff
– Integration with other systems
Best for: Larger organisations, complex operations, multi-site, or those wanting integrated system
Option 3: Paper Filing (Low Tech)
Use physical binders and cabinets.
Pros: Simple; accessible to non-digital staff; quick physical reference
Cons: Bulky; hard to search; version control difficult; risk of loss
Recommended for: Very small organisations (<20 staff) or as supplementary storage for key documents
Hybrid Approach (Most Common)
Many organisations use:
– Core EMS documents (policy, procedures, registers) in digital form on shared drive
– Records (training, audit, management review) in EMS software or spreadsheets
– Site-level documentation in paper binders (e.g., work instructions, checklists, inspection logs)
– Backup physical copies of critical records in filing cabinet
Common Documentation Audit Findings
Auditors frequently find these documentation gaps. Avoid them:
| Finding | What Auditors See | Fix |
|---|---|---|
| Blank templates | Procedure exists but no evidence it’s been used (e.g., training template with no names/dates filled in) | Complete and sign off all records; maintain actual evidence not just templates |
| Outdated documents | Procedures last updated 2+ years ago; references old processes or staff roles | Establish annual review cycle; update immediately when processes change |
| No approval signatures | Documents exist but not formally approved; unclear who is responsible | Require sign-off by manager + EMS coordinator; date all approvals |
| Inconsistent version numbers | Some versions labeled “v1”, others “2.0”; unclear which is current | Use consistent versioning (e.g., “v1.0”, “v1.1”, “v2.0”); clearly mark superseded as “ARCHIVED” |
| Records scattered | Training kept by HR, audits by operations, incidents by safety; hard to find anything | Centralise in one system; create records index; train staff on where to file |
| No retention plan | Records kept indefinitely or discarded without plan; no evidence of what’s been destroyed | Define retention per record type; document destruction process; maintain destruction log |
| Staff unaware of procedures | Procedure exists but staff haven’t seen it; can’t explain their role | Distribute documents to staff; include in induction; reference in toolbox talks |
| Conflicting documents | Multiple versions in circulation; staff following different versions | Withdraw old versions; distribute current version to all; collect and destroy old copies |
8 Frequently Asked Questions
1. Do we have to print all documents, or can we keep everything digital?
All digital is fine. ISO 14001 does not require paper. The standard uses the term “documented information”—format is up to you. However, have a backup strategy (physical or cloud) in case you lose digital access.
2. How long must we keep records?
Minimum 3 years for most records. However, if records relate to legal compliance (e.g., emissions monitoring, permits), retain for the life of the permit plus 3 years. If they relate to potential liability (e.g., incident investigation), keep for 6+ years or your statute of limitations.
3. Can we delete or destroy records after the retention period?
Yes, after retention period expires you may dispose of records. Document your destruction (who destroyed, when, how—shredded, recycled, digital deletion). Keep a destruction log as evidence that you managed records properly.
4. Who should own document control?
Typically, your EMS coordinator or manager owns the process and maintains the central register. However, each document has a subject-matter owner (e.g., Operations Manager owns operational control procedures). The EMS coordinator ensures proper versioning and approval; the owner maintains content accuracy.
5. How do we handle contractors’ documents?
You don’t need to control their documents, but you must ensure they’ve been briefed on your requirements. Maintain a contractor induction record showing they received and understood your environmental requirements. Request evidence of their EMS (if they have one) but don’t need to audit their documentation unless you specify that in the contract.
6. Do we need both a “Document Control Procedure” and a “Records Management Procedure,” or can they be combined?
You can combine them into one “Information Control Procedure” or “Documentation Procedure.” However, it’s often clearer to separate:
– Document Control: Version, approval, distribution, review cycle
– Records Management: Creation, filing, access, retention, disposal
7. What if we use the same software for both ISO 14001 and ISO 45001?
Absolutely fine. Integrated management system (IMS) software often covers multiple standards. Just ensure your document and records structure is clear so you can identify which documents apply to which standards.
8. How do we ensure all staff know where to find documents?
Induction training should cover: 1) Your EMS documents are stored at [location/link]; 2) Key procedures that affect their job; 3) Who to ask if they can’t find something (usually EMS coordinator). Consider:
– Posting the document repository link on the intranet
– Printing key procedures and posting in work areas
– Including relevant procedures in staff handbooks
– Making the environmental policy accessible (intranet, notice board, handbook)
Conclusion
Documentation is foundational to ISO 14001 certification. The standard requires specific documents and records to demonstrate your EMS works. However, it’s flexible on format (paper, digital, hybrid) and gives you freedom to design a documentation system that fits your organisation.
The key is establishing:
1. Comprehensive documented information covering all mandatory clauses
2. Effective document control (version, approval, review)
3. Reliable records management (storage, retention, retrieval)
4. Clear ownership of who maintains what
Start with the mandatory documents list provided in this guide. Build your documentation incrementally. Establish version control and review cycles from the start. By the time you reach your Stage 2 audit, auditors will find a comprehensive, well-maintained set of documented information that demonstrates your EMS in action.
Recent Comments