ISO 14001 certification process, step by step: from scope to certificate

Who does what in ISO 14001 certification

Four parties take part. Your organisation owns the environmental management system and the environmental performance behind it. A consultancy helps you design, build and test that system. The certification body audits it against ISO 14001 and decides whether to grant a certificate; it must stay independent of whoever helped you implement. An accreditation body, recognised through the Global ACI arrangement that replaced the IAF and ILAC arrangements on 1 January 2026, assesses the certification body itself.

Two documents govern the route. ISO 14001 states what your system must do. ISO/IEC 17021-1 states what the certification body must do: audit in two stages, return every year for surveillance and run the certificate on a three-year cycle. An offer that skips a stage or never visits your sites has left those rules behind.

First-time implementers build to ISO 14001:2026, published on 15 April 2026; the transition guide covers existing 2015 certificates.

Steps 1 to 5: the work before the certification body arrives

Step 1: fix the scope, the sites and the boundaries

Decide which locations, activities and headcount the certificate will name against what the customer, regulator or parent company expects. The scope guide explains how to word it and what can stay outside it.

Step 2: gap analysis

Sterling's gap analysis looks at what already exists, from permits to emergency plans, and turns every shortfall into an action with an owner, a date and the resources it needs. It is neither the free online readiness check nor the certification body's Stage 1.

Step 3: build the registers and the controls

The core of an EMS is two registers. The aspects and impacts register scores what each activity does to air, water, land, resources and climate, taking a life cycle perspective, and marks the significant ones (6.1.2). The compliance obligations register lists the laws, permit conditions and commitments that apply at each site (6.1.3). Operating criteria for waste, chemicals, effluent and emissions follow from them (8.1), together with emergency plans for spills, fires and releases (8.2). The implementation plan guide sets out who does what.

Step 4: operate, monitor and evaluate compliance

Before Stage 2 you need monitoring results against your limits from calibrated equipment (9.1.1), a recorded evaluation of whether each obligation is being met (9.1.2), at least one emergency drill with its lessons applied, and nonconformities handled through to cause. Data held by a laboratory or contractor belongs in your own records.

Step 5: internal audit and management review

One internal audit covering the whole standard and every site in scope (9.2), and a management review that takes decisions (9.3), are the last things to finish. The Stage 1 auditor checks that both are planned and performed.

Step 6: apply to an accredited certification body

Approach certification bodies while the build is still under way. The application review fixes the audit dates, and experienced environmental auditors book up early. Check the accreditation in the accreditation body's directory and IAF CertSearch, confirm it covers your sector, and compare the audit days each quote proposes for your headcount, sites and environmental complexity. Our guide to choosing an ISO 14001 certification body covers accreditation, sector codes and how to compare quotes.

Steps 7 to 9: Stage 1, the gap between stages, and Stage 2

At Stage 1 the auditor reads your documented EMS, including the scope, the aspects register and the compliance obligations register, tests how well the team understands the requirements, confirms that internal audits and management reviews are planned and performed, and judges whether you are ready for Stage 2. Its areas of concern are not yet nonconformities; close each with evidence before the second visit.

Stage 2 evaluates whether the system is implemented and effective across the scope. For ISO 14001 that means walking the site: the chemical store, the effluent point, the waste yard. Auditors trace a significant aspect from the register to the control on the ground, pick a permit condition and ask for the evidence that it is met, and question operators about what they would do in a spill. The Stage 1 and Stage 2 guide goes through both visits in detail.

Steps 10 and 11: closing findings and the certification decision

Stage 2 findings come as major nonconformities, minor nonconformities and opportunities for improvement. For each nonconformity you send a correction, the cause you found and the corrective action, within the time the certification body states at the closing meeting. A major must be closed and verified before certification; for a minor, the body normally accepts your plan and checks it at the next visit. If a major cannot be verified within six months of the last day of Stage 2, ISO/IEC 17021-1 requires the body to repeat Stage 2. The nonconformities guide explains how to write and close them.

The auditor's recommendation at the closing meeting is not the certificate. The certification body decides after reviewing the report and the evidence that findings are closed, and the certificate then names your organisation, the scope and sites, the standard and edition, and the validity dates. It covers the management system, never a product.

Step 12: surveillance and recertification

The certificate lasts three years from the decision, on condition that surveillance audits take place at least once a calendar year outside the recertification year, the first within twelve months of the decision. A recertification audit before expiry starts the next cycle. Changes to sites, legal entity or activities must be reported to the certification body between visits, and adding a site is a scope extension with its own audit. The surveillance and recertification guide covers the cycle in full.

An EMS that stops between audits shows it quickly: monitoring gaps, a compliance evaluation a year out of date, a drill never repeated. Keeping those running is the purpose of Sterling's Sustain™ phase.

How long the ISO 14001 certification process takes

For most organisations, four to eight months from kick-off to Stage 2 is realistic. The pace is set by evidence. Each site needs its own aspects assessment and its own legal register, monitoring has to run long enough to show a trend against permit limits, and a drill and a full internal audit have to have taken place. The certification body's scheduling and the time to close findings come on top, and multi-site groups take longer. The timeline guide breaks the stages down, and a promise of certification in ten days describes something that is not accredited ISO 14001 certification.

ISO 14001 certification process: questions buyers ask