ISO 14001 Internal Audit: How to Plan and Conduct Your EMS Audit

Internal audits are where your environmental management system meets reality. They reveal whether the EMS that exists on paper exists in practice. Yet most internal audits fail silently—auditors tick boxes, findings are written but not actioned, and the system slowly decays. This guide shows how to conduct audits that genuinely strengthen your EMS.

Why Internal Audits Fail in Most EMS Programmes

Before discussing how to audit well, understand where most programmes go wrong:

1. No clear audit objectives: Auditors don’t know what success looks like. They audit because the standard requires it, not because they are looking for anything specific.

2. Incompetent or biased auditors: An auditor who reports to the department being audited has compromised independence. An auditor who lacks EMS knowledge cannot judge whether processes are adequate.

3. Weak sampling: Auditors audit only what is easily accessible. They do not sample across the full scope of the operation or across time periods.

4. Superficial evidence gathering: Auditors ask questions and accept answers. They do not observe operations, verify records, or trace decisions to documented instructions.

5. Findings that don’t drive action: Non-conformities are written but corrective actions take months or never close. Observations are filed and forgotten.

6. No follow-up audit: The audit cycle ends when the report is filed. There is no follow-up audit to verify that corrective actions actually remedied the issue.

A meaningful internal audit is resource-intensive. It demands that your organisation accept the uncomfortable truth that the EMS has gaps. Most organisations prefer the theatre of compliance over the work of improvement.

The ISO 14001:2026 Change: Defined Audit Objectives

ISO 14001:2026 made one critical change to Clause 9.2: the internal audit programme must now include defined objectives for each audit.

Previously, organisations could audit “the EMS” with no clear goal beyond checking compliance with the standard. Now you must define what each audit is meant to determine:

• Compliance with the requirements of ISO 14001?
• Conformance with documented procedures and instructions?
• Effectiveness of environmental controls in key areas?
• Implementation status of corrective actions from prior audits?
• Compliance with specific legal obligations?

This change shifts internal auditing from a box-ticking exercise to a strategic tool. You audit because you want to know whether a specific system is working, not just because the calendar says audit is due.

Auditor Competence and Independence

Competence Criteria

An internal auditor must possess:

• Knowledge of ISO 14001: Understanding of the standard’s requirements and how they apply to your operations
• Knowledge of your operations: Understanding of processes, equipment, significant environmental aspects, legal obligations
• Audit skills: Ability to gather evidence, ask probing questions, evaluate findings, write clearly
• Technical knowledge in the area being audited: For example, an auditor of waste management systems should understand waste classification, storage, and disposal options

Organisations often assume “anyone can be trained to audit.” This is false. Some individuals lack the cognitive capability to evaluate complex systems. Others lack the courage to report what they find. Competence development takes months, not days.

Independence Requirement

An auditor should not audit their own work or their own department. This is not absolute—in very small organisations, some degree of internal auditing by insiders is acceptable—but the bias should be acknowledged and mitigated:

• The auditor’s supervisor should not be the person being audited
• The auditor should not have designed the procedure being audited
• If an auditor audits their own area, a second auditor should validate findings

Many organisations get around this by using external auditors to audit every area. This is expensive but minimises bias. A middle ground is to use trained internal auditors with clear independence, plus external auditors for high-risk areas.

Building Your Annual Audit Programme

Step 1: Define Audit Scope and Frequency

Clause 9.2 requires audits of “all functions and processes” relevant to the EMS. This means:

• All clauses 4–10 of ISO 14001: Every clause of the standard must be audited at least once in the cycle
• All significant environmental aspects: Identify which operations create significant aspects and ensure those areas are audited
• All legal obligations: Audit compliance evaluation results from Clause 9.1.2
• All locations: If you have multiple sites, each site must be audited at least once per cycle

Audit frequency is typically annual (one full cycle per year) but may extend to two years if you have a large scope and mature EMS. The key is that every significant area is covered within the cycle.

Step 2: Risk-Based Audit Planning

Allocate audit resources proportionately to risk:

Risk Level	Frequency	Auditor Type	Depth
Critical (High impact, complex controls, history of non-conformity)	Quarterly	External or experienced internal	Full audit (2–3 days)
High (Significant environmental aspect, moderate complexity)	Semi-annual or annual	Senior internal auditor	Full audit (1–2 days)
Moderate (Lower-risk process, stable controls)	Annual	Internal auditor	Focused audit (0.5–1 day)
Low (Administrative, well-understood procedure)	Every 2 years or by sampling	Junior internal auditor	Desk-top review

Step 3: Annual Audit Schedule Template

Clause/Area	Function	Significant Aspect	Risk	Q1	Q2	Q3	Q4	Auditor	Objectives
4: Context	Senior management	–	Low	–	–	–	X	Internal	Awareness of environmental obligations
5: Leadership	EHS coordinator	–	Moderate	–	X	–	–	Internal	Effectiveness of leadership commitment
6.1: Aspects	Operations	Energy, Waste	High	X	–	–	–	External	Adequacy of aspect identification; controls effectiveness
6.2: Compliance	All staff	–	High	X	–	–	–	External	Legal register up-to-date; obligations understood
8.1: Operations	Shift supervisors	Emissions	Critical	X	–	X	–	External	Adherence to operational controls; permit compliance
9.1: Monitoring	Site manager	All aspects	Moderate	–	X	–	–	Internal	Data accuracy; monitoring plan current
10.2: Corrective action	EHS team	–	Moderate	–	–	X	–	Internal	Root cause analysis quality; effectiveness of corrections

This schedule ensures every clause is audited annually, high-risk areas receive multiple audits, and auditor workload is distributed.

Planning an Individual Audit

Pre-Audit Planning (1–2 weeks before)

Define the audit scope and objectives:
“This audit will verify that the waste management procedure (WM-001) is implemented in Warehouse A and Warehouse B, and that waste is segregated, stored, and disposed according to the procedure and state environmental regulations.”

Select the auditor and verify competence:
– Has the auditor been trained on ISO 14001 and waste management?
– Is the auditor independent (not the warehouse manager)?
– Will the auditor need technical support (e.g., from the waste contractor)?

Notify auditees (the people being audited):
– Provide audit date, time, scope, and objectives
– Allow time for questions
– Confirm key personnel will be available
– Request that recent documentation be available for review (sampling is fine; request everything is excessive)

Prepare audit checklist:
Use your audit checklist (Article 3) as the basis. Customise it to your operation:
– What waste streams do you generate?
– Which regulations apply?
– What are the critical control points where waste could be mismanaged?

Collect background information:
– Copy of waste management procedure
– Last year’s audit findings and corrective actions
– Recent waste disposal records and invoices
– Any recent environmental incidents or complaints
– Changes to operations or regulations since last audit

The Opening Meeting (30 minutes)

Conduct this with the key people being audited. Purpose: establish rapport, clarify scope, confirm logistics.

Agenda:
1. Introduce yourself and the audit purpose (5 min)
2. Explain scope and objectives in their language (5 min)
3. Outline the audit methodology (observation, document review, interviews) (5 min)
4. Confirm timing, locations, and key people (5 min)
5. Clarify any questions about the audit process (5 min)

Tone matters. The opening should convey “I am here to understand how you work and identify where we can improve,” not “I am here to catch you out.”

Evidence Gathering: Techniques

1. Document Review

Review documented information (procedures, records, forms, permits, training records, monitoring data).

What to look for:
– Is the procedure current? (Check modification dates; is it consistent with current operations?)
– Are records being completed as required? (Full? Timely? Signed/dated?)
– Does the documented information show compliance with the standard?

Red flags:
– Blank fields on forms (suggests process isn’t working)
– Records with the same handwriting (suggests someone is completing them retrospectively)
– Procedures dated 5+ years ago (suggests poor maintenance)
– No evidence that records are reviewed (they are filed and forgotten)

2. Observation

Watch people perform the process.

Best practice:
– Observe at different times (not always the same shift or day of week)
– Observe when people are unaware you are watching (the first five minutes of an announced observation is often unrepresentative)
– Focus on critical control points: where are decisions made? Where could errors occur?

In waste management, observe:
– Is waste segregated into correct bins at the point of generation?
– Are signs clear about which waste goes where?
– When bins are full, is waste overflow managed properly?
– Are storage containers closed and properly labelled?
– Is the area clean or are spills evident?

Observation takes time. A 30-minute observation might reveal more than an hour of document review.

3. Interview

Ask open-ended questions, then listen.

Open-ended questions:
– “Walk me through what you do when you have hazardous waste.”
– “What happens if a waste bin overflows?”
– “How do you know which waste goes in which bin?”

Avoid:
– Leading questions: “You do segregate waste correctly, right?” (They will say yes.)
– Closed questions: “Is waste segregated?” (Yes/no answers reveal nothing.)
– Questions with embedded assumptions: “Since you follow the procedure…” (Presumes they do; they might not.)

Listen for:
– Hesitation or uncertainty (“Um, I think… we usually…”)
– Contradictions (between interviewees or between what they say and what you observed)
– Gaps (no one knows who is responsible for something)
– Workarounds (“We do it slightly differently because…”)

Interviews reveal whether people understand why the control exists. A person who says “We segregate waste because the law requires it” understands the obligation. A person who says “Because we were told to” may not recognise when an exception should be made.

4. Sampling Approach

You cannot check everything. Design a sampling strategy:

Temporal sampling: Review records from different times.
– Document review: Check waste records from February, May, and August (not just recent weeks)
– Observation: Audit on different days of the week and different shifts if possible

Spatial sampling: Check different locations.
– Waste segregation: Review 3 of 5 warehouse sections
– Compliance: Check permit compliance at discharge point and at two upstream process steps

Risk-based sampling: Focus on high-risk areas.
– If hazardous waste is a significant aspect, check hazardous waste handling more thoroughly
– If a specific waste stream has high disposal costs, sample that area more intensively

Document sampling within a batch: If a process generates 100 forms per month, sample 20 (20%) from across the month, not the last 20 (recency bias).

Writing Audit Findings

Audit findings fall into three categories:

1. Non-Conformity (NC)

A direct contradiction of a requirement.

Example NC: “Waste segregation procedure (WM-001 section 3.2) requires that hazardous waste be segregated from general waste. During observation on 15 March, paint containers (hazardous) were stored in the general waste bin in Warehouse B. This represents non-conformity with the procedure and potential violation of EPA Waste Guidelines.”

Why this is NC:
– The requirement is clear (segregate hazardous from general)
– The evidence is specific (paint in general waste bin, date, location)
– The non-conformity is observable (not a matter of interpretation)

Action required: Corrective action under Clause 10.2 within a defined timeline.

2. Observation (OBS)

A potential risk, gap in process, or area for improvement that does not yet represent non-conformity.

Example OBS: “Waste segregation signage above bins in Warehouse A is faded and difficult to read. Two of five interviewees were uncertain about which waste category specific items fell into. Signage should be replaced or clarified to reduce the risk of segregation errors.”

Why this is OBS, not NC:
– No clear procedure violation (the procedure exists and was mostly followed)
– The risk is potential, not current (most waste was segregated correctly)
– The solution is preventive (improve signage to avoid future errors)

Action required: Improve the process; may be addressed through a corrective action or through standard improvement procedures.

3. Opportunity for Improvement (OFI)

An area where performance could be enhanced beyond minimum requirements.

Example OFI: “The facility currently recycles 18% of waste. Industry leaders in similar operations achieve 35% diversion rates. Consider evaluating composting for organic waste and increasing cardboard recycling frequency.”

Why this is OFI, not OBS:
– Current performance is acceptable (compliance is being met)
– The opportunity is aspirational (not a risk, but a performance uplift)
– Success depends on business case, not compliance mandate

Action required: Optional; part of continual improvement under Clause 10.1.

Finding Write-Up Template

Finding	Details
Type	NC / OBS / OFI
Clause/Standard	Clause 8.1, ISO 14001:2015; WM-001 Section 3.2
Auditee	Warehouse Operations Manager
Observation	During audit on 15 March 2026, paint containers (hazardous waste) were stored together with general waste in Bin W-04 in Warehouse B.
Root Cause	Signage above the bin is faded and difficult to read. Staff member stated uncertainty about proper waste category.
Requirement	WM-001 Section 3.2 requires hazardous and general waste to be segregated. Clause 8.1 requires implementation of operational controls for significant aspects.
Evidence	Photograph of paint containers in general waste bin; interview with staff member; faded signage; WM-001 procedure
Risk	Improper segregation may result in non-compliant waste disposal, potential EPA enforcement action, and environmental release.
Corrective Action Required	Yes. Within 5 working days: (1) Replace or clarify waste segregation signage. (2) Provide targeted training to Warehouse B staff on hazardous waste classification. (3) Conduct observation on 22 March to verify correct segregation.

The finding should be specific enough that someone unfamiliar with your operation could understand exactly what was wrong and why it matters.

The Closing Meeting (45 minutes)

Summarise findings, confirm facts, and outline next steps.

Agenda:
1. Thank the auditees (2 min)
2. Overview of what was audited (2 min)
3. Summary of findings: number of NCs, OBSs, OFIs (2 min)
4. Discuss each finding, confirm facts, ask if they have context that changes the assessment (20 min)
5. Explain the corrective action process and timeline (10 min)
6. Confirm audit report distribution and follow-up process (5 min)

Tone here matters too. Auditees may be defensive if they feel criticized. Frame findings as “the system revealed this” not “you failed.” A finding that signage is faded is not a personal failing.

Audit Report Structure

Section	Content
Executive summary	Date, scope, objectives, overall assessment (compliant/non-conformances noted), auditor name
Audit details	Clauses/areas audited, methodologies used, sampling approach, people interviewed, documents reviewed
Findings summary	Table: # NCs, # OBSs, # OFIs
Detailed findings	For each NC: using template above; for OBSs/OFIs: brief description and suggested improvement
Corrective action tracking	Table showing NC, required corrective action, responsible party, target closure date
Auditor certification	Auditor signature, date, confirmation of competence and independence

Reports should be distributed to auditees, management review attendees, and EHS leadership. The report is a managed document; it should be tracked for revision and retention.

Follow-Up Audit

Set a follow-up audit date within 30–60 days of the original audit (depending on severity of findings). The follow-up audit verifies:

• Have corrective actions been completed on schedule?
• Is the corrective action effective (not just a band-aid)?
• Are there any new issues that have emerged?

If a corrective action was not completed, escalate (involve senior management; this is a system failure, not just an operator failure).

How Internal Audits Differ from Certification Audits

Your internal audits and certification body audits serve different purposes:

Aspect	Internal Audit	Certification Audit
Objective	Verify EMS is effective; drive improvement	Verify conformance with ISO 14001
Frequency	Annual (typically)	Every 3 years (surveillance every 1–2 years)
Depth	Deep in high-risk areas; lighter in low-risk	Consistent depth across all areas
Auditor independence	Internal (may know the facility well)	External (objective distance)
Focus	Process effectiveness; compliance; improvement	Standard conformance; documented evidence
Outcome	Findings drive corrective action	Non-conformances can block certification
Relationship with auditee	Collaborative improvement	More formal/inspectorial

Internal audits should be more rigorous than certification audits (you have more to gain from finding problems). If your internal audits find nothing, your EMS is either perfect (unlikely) or your audit programme is not effective (likely).

Clause 9.2 FAQ

Q1: Can contractors or customers audit our EMS?
Clause 9.2 specifies “internal audits”—conducted by your organisation. Second-party audits (by customers) or third-party audits (by certification bodies) are separate. Internal audits should be yours alone to ensure you can be candid about findings.

Q2: How do I audit a process I do not understand?
Audit the process as documented. Ask operators to explain their work. Focus on whether the documented procedure is being followed and whether it achieves its objectives. If you lack technical knowledge, partner with someone who has it (a subject-matter expert from your team or an external specialist).

Q3: Can the same person be auditor and auditee?
Not ideally. If your organisation is very small (fewer than 20 people), some overlap is unavoidable, but it should be minimized. At a minimum, ensure the auditor’s supervisor or another colleague observes key findings to provide a second opinion.

Q4: How many auditors do I need?
Depends on your size and complexity. A small organisation might train 2–3 competent internal auditors plus use external auditors annually. A large organisation might have 5–10 internal auditors plus external auditors for specific areas. The number should allow you to audit your full scope annually without exhaustion.

Q5: What if I find no findings?
Question your audit methodology. A mature EMS still has areas for improvement. If internal audits find nothing, auditors may be:
– Auditing too superficially
– Biased toward the areas they are auditing
– Lacking sufficient EMS knowledge to recognise gaps

Conduct a quality check: have an experienced external auditor observe one of your internal audits and provide feedback on audit quality.

Q6: How should I handle findings from external auditors (certification or customer audits)?
Treat them as if they were internal findings. Use the same corrective action process. External findings often reveal gaps in your internal audit programme (why did your internal auditor miss this?). After addressing the finding, review your audit checklist to ensure your internal auditors will catch similar issues in future.

Q7: What if a corrective action deadline is missed?
Escalate. Do not extend the deadline (that rewards non-compliance). Instead, investigate why the action was not completed and take a higher-level corrective action. This might involve additional resources, process redesign, or leadership intervention.

Q8: Should I share internal audit reports with our certification body?
Usually, yes. Many organisations include recent internal audit reports and corrective action status in their certification body surveillance packages. This demonstrates that you have an effective audit programme. However, check your certification contract—some auditors prefer to audit independently rather than rely on your internal results.

---

Key Takeaway: Internal audits are your organisation’s opportunity to discover and fix problems before external auditors or regulators find them. The quality of your internal audit programme is often the strongest predictor of certification outcome and EMS effectiveness. Invest in auditor competence, enforce independence, and make sure findings drive action.