ISO 14001 internal audit: how to plan, conduct and report audits of your environmental management system

What ISO 14001 clause 9.2 asks of you

An ISO 14001 internal audit is a planned, evidence-based check, carried out by your own people or by auditors you appoint, of two things: whether the EMS meets your own requirements and those of the standard, and whether it is effectively implemented and maintained. Clause 9.2 sets it within a programme rather than as a one-off event. The programme fixes how often audits happen, the methods, who is responsible, how audits are planned and how results are reported, and it takes account of the importance of the processes concerned and what earlier audits found.

The 2026 edition makes one point explicit in 9.2.2: each audit needs defined objectives as well as criteria and scope. An objective such as "confirm that waste leaving site B is segregated, licensed and recorded to the permit conditions" tells the auditor what the audit is for; a scope of "the waste area" does not.

Three duties follow from the clause. Auditors are chosen and audits run so that the process stays objective and impartial. Results reach the managers concerned and feed the management review of clause 9.3, which has its own guide. Nonconformities go into the corrective action process of clause 10.2. Documented information must be available as evidence that the programme ran and what it found.

Internal audit, compliance evaluation and the certification audit

Environmental teams often merge these three checks. They answer different questions, so keep them apart in the programme and the records.

The internal audit does check the compliance evaluation: that it was done at the planned frequency, covered every obligation in the register and led to action where a limit was missed. It does not replace it. How the obligations are identified site by site belongs to the compliance obligations guide.

Planning a risk-based programme

ISO 14001 sets no audit frequency. What auditors expect is a programme that visits the areas with significant aspects, recent incidents or complaints, permit exceedances or new processes more often than the office that orders stationery. A change planned under clause 6.3, such as a new chemical or contractor, is a good reason to add an audit.

As an illustration, a single manufacturing site with a wastewater discharge permit, a solvent store and outsourced waste collection might plan its year like this:

Before initial certification, compress the plan so that one audit of the full scope is finished, and its findings acted on, some weeks before the certification body's Stage 2.

Who audits: independence and competence

ISO 14001 does not name an internal auditor qualification. Auditors fall under the competence requirements of clause 7.2 like anyone else whose role affects the EMS: competence determined, gained through education, training or experience, and evidenced. The practical rule for impartiality is that nobody audits their own work, so the environmental lead who wrote the aspects procedure does not audit it; a trained colleague from another function, or an appointed external auditor, does.

An EMS auditor needs more than audit technique. They should be able to read a permit, recognise poor chemical storage, question a monitoring result that looks too steady and follow a waste stream beyond the gate. Who needs which training, and how to evidence it, is covered in the ISO 14001 training guide.

ISO 19011, Guidelines for auditing management systems, is the reference for method and auditor competence. Its fourth edition, ISO 19011:2026, was published in May 2026 and replaced the 2018 edition, with expanded guidance on remote auditing and digital tools. It is guidance and cannot be certified. Its principles include independence and an evidence-based approach: conclusions rest on information someone else could verify.

Conducting an EMS audit on site

Prepare

Read the aspects entries, the relevant permit conditions, the last audit report and any recent exceedances or complaints for the area. Send the plan to the process owner in advance, with the objective, the criteria and the records you will ask for.

Walk, observe and sample

Start where the impacts happen, not in the meeting room. Walk the drains, open the chemical store, look at the skips. Pick your own samples across months and shifts: six monthly effluent results, three waste consignments traced from the skip to the collector's disposal record, two contractors checked for induction and licence. Ask the operator what happens if the pH meter alarms, and compare the answer with the procedure.

Trace one thread end to end

Follow a single significant aspect through the whole system: its score in the register, the obligation it triggers, the operating control, the monitoring, the result evaluated, and the corrective action when it went wrong. A break anywhere in that chain is the finding that matters most.

Reporting findings and following them up

Write every finding in three parts, with evidence another person could check:

• Requirement: the site's discharge permit requires the effluent flow meter to be calibrated every twelve months.
• Evidence: the last calibration certificate for the meter is dated fifteen months before the audit; the six monthly load calculations sampled all rely on its readings.
• Gap: monitoring equipment used to demonstrate permit compliance is not calibrated at the required interval.

ISO 14001 prescribes no grading scheme, so define one in your audit procedure that mirrors the certification body's language: a major nonconformity affects the system's ability to achieve its intended results, a minor one does not, and an opportunity for improvement records a better way where nothing is wrong. The report states the objective, scope, criteria, auditors, what was sampled, the findings and a conclusion, and goes to the process owner and top management within days.

Follow-up is where most programmes fail. The process owner records the correction, the cause and the corrective action; the auditor then checks the action worked, for example by seeing the next two calibrations done on time. How nonconformities are graded and closed in the certification audit itself is explained in the nonconformities guide.

ISO 14001 internal audit: questions buyers ask