ISO 14001 common mistakes: the ten that fail audits, where auditors find them, and the fix for each

How an ISO 14001 certification audit goes wrong

An environmental management system is judged on whether it controls what the site does to air, water, land and resources. Auditors test the registers against the ground: they walk the chemical store, read the discharge consent, then ask for last quarter's effluent results. Where the two stories diverge, findings follow.

The outcomes are predictable. The certification body's Stage 1 readiness review can conclude that the system is not ready, so Stage 2 moves. Stage 2 can raise a major nonconformity, and under ISO/IEC 17021-1 a major that is not verified as corrected within six months of the last Stage 2 day means Stage 2 is carried out again.

The ten below are the patterns we see most often behind those outcomes; the nonconformities guide covers grading and closure, the Stage 1 and Stage 2 guide the audit days.

Mistakes 1 to 3: the aspects register, the legal register and compliance evaluation

1. An aspects register that is a list, not an assessment

• Why: it was filled in from a sector template, so every site shows the same entries and nobody can say why one aspect is significant.
• In the audit: the auditor asks for the criteria used to decide significance (6.1.2), then walks the site looking for activities the register missed, such as a solvent wash or a generator, and for the life cycle perspective.
• Fix: assess each site with the people who run it, against written criteria, so every significant aspect leads to a control. The aspects and impacts guide shows how.

2. A legal register copied from a generic list

• Why: a national list of laws is easier to obtain than the conditions in the site's own permits.
• In the audit: the auditor picks a permit off the wall and looks for its limits, reporting dates and renewal in the register (6.1.3). Absent conditions, or laws that do not apply, show nobody has worked out what the site must meet.
• Fix: compile obligations site by site, starting from the permits. See the compliance obligations guide.

3. Obligations identified but never evaluated

• Why: the register is treated as the finished article.
• In the audit: the auditor asks for the most recent evaluation of compliance and its result (9.1.2). With none on record, the EMS cannot show it knows where it stands.
• Fix: evaluate each obligation at a set frequency, record the result and act on any gap.

Mistakes 4 to 6: monitoring, operational control and contractors

4. Monitoring data held by someone else

• Why: the laboratory holds the sampling results and the waste contractor the manifests, so nobody sees the numbers together.
• In the audit: the auditor asks for recent results against the permit limits and the calibration record for the meter behind them (9.1.1).
• Fix: hold the data in one place, compare each result with its limit on arrival, and keep calibration evidence.

5. Operational controls that stop at the procedure

• Why: the control was written as a document task and never shown to the people in the store or the yard.
• In the audit: the site tour raises most EMS findings: drums without secondary containment, hazardous waste in a general skip, an empty spill kit (8.1).
• Fix: set operating criteria where each significant aspect occurs, train the people there and inspect routinely.

6. Contractors and external providers left outside

• Why: waste haulers and maintenance contractors are seen as someone else's responsibility once the contract is signed.
• In the audit: the auditor asks how requirements reach externally provided processes, products and services (8.1) and follows a waste load to its disposal record.
• Fix: put environmental requirements into contracts and inductions, and verify licences before work starts.

Mistakes 7 to 9: emergencies, internal audit and corrective action

7. Emergency plans that cover people but not the environment

• Why: the fire and evacuation plan is assumed to cover the environmental scenarios.
• In the audit: the auditor asks what happens if a tank leaks into the storm drain, and what changed after the last drill (8.2).
• Fix: plan for the environmental emergencies, test the plan by drill and revise it.

8. An internal audit designed to pass

• Why: it is squeezed in before Stage 2, covers head office but not the sites, and is done by the person who wrote the system.
• In the audit: the certification body checks that the programme reached every site and process in scope, that auditors did not audit their own work and, under the 2026 edition, that each audit had defined objectives as well as criteria and scope (9.2).
• Fix: base the programme on significant aspects and past findings, with trained, independent auditors. See the internal audit guide.

9. Exceedances and spills corrected but never investigated

• Why: cleaning up the spill or re-sampling the discharge feels like the end of the matter.
• In the audit: the auditor picks a closed incident and asks for its cause and proof it has not recurred (10.2); a repeat exceedance puts the corrective action process itself in question.
• Fix: act on the cause and close the record only when later results show it worked.

Mistake 10: booking Stage 2 before the EMS has a record

• Why: a tender or customer deadline fixes the date before anyone asks what evidence will exist.
• In the audit: Stage 1 looks at whether internal audits and management review have been planned and performed and whether the organisation is ready for Stage 2. A few weeks of monitoring, no drill and an undecided review leave the body little choice.
• Fix: plan backwards from the evidence: monitoring long enough to show a trend, one compliance evaluation, one drill, a full internal audit and a management review with recorded decisions. The timeline guide explains the operating period, and the management review guide the record.

Why shortcuts make the ten worse

When a buyer wants the certificate before the next contract round, an offer promising it within days is tempting. Each version leaves the ten mistakes in place and adds new risk.

• The ready-made EMS pack. A template aspects register and a national list of laws are mistakes 1 and 2 delivered in a folder. They collapse when compared with the site.
• The certificate with no accreditation behind it. It fails when a customer checks who accredited the issuing body. Read how to verify a certificate and choose a certification body.
• The date fixed before the site is seen. Monitoring, a drill and an internal audit take months; a genuine ISO 14001 certificate cannot be produced in ten days.

Our approach: a realistic range in the proposal, then a firm audit date once the gap analysis shows what the sites need.

ISO 14001 common mistakes: questions buyers ask