ISO 14001 clause 9.2.1: define what internal audit must establish

What clause 9.2.1 requires in practice

Clause 9.2.1 is short, but it sets the questions every internal audit exists to answer. The organisation runs internal audits on a planned schedule, so that it knows whether the EMS:

• conforms to the organisation's own requirements for its EMS, meaning the arrangements it has chosen to put in place;
• conforms to the requirements of ISO 14001;
• is effectively implemented and maintained.

Two points follow. The organisation's own arrangements count as audit criteria alongside the standard, so a promise written into a procedure becomes something to test. And effectiveness is about operation, so checking that documents exist is not enough. How audits are planned, who performs them and what must be retained is covered in 9.2.2. The interval, too, is a planned choice, not a fixed calendar rule.

Recognise both sets of requirements

The organisation’s own EMS requirements can include the arrangements it has established to manage environmental work. Auditors need to understand those arrangements as well as the standard. A procedure that promises a particular review or control creates an internal expectation that should match practice.

At the same time, an organisation cannot replace a standard requirement with a weaker internal rule and then audit only against its own rule. Audit criteria should reflect the relevant requirements. Distinguish mandatory requirements from optional implementation choices, including methods suggested by a consultant or training course.

Examine implementation and maintenance

Conformity is not limited to the wording of documents. The audit needs evidence of how the system operates and remains effective. An approved instruction may be suitable on paper but unavailable to the people doing the work. A process may have worked initially but deteriorated after staff or provider changes.

Use an evidence trail that connects intention and practice. Ask what was planned, what happened, what result followed and how the organisation responded. Sampling should be appropriate to the audit’s objectives and scope, with its limits understood. No single sample can prove every activity was always performed correctly.

Why the purpose of internal audit matters to the business

Auditors who do not know what question they are answering tend to produce long checklists and little insight. A clear purpose keeps the business focused on two things that matter: whether people follow the arrangements the organisation set for itself, and whether those arrangements still deliver the environmental outcomes intended. This stops audits from becoming a paperwork exercise and makes the results useful to managers who must decide where to spend effort. It also protects credibility with customers and assessors, who often ask how the organisation knows its system works, not merely that it was audited.

How to implement clause 9.2.1

Start with the questions, then let the checklist follow. One way Sterling's teams do this is to restate the purpose at the top of every audit plan. Keep the purpose short enough to remember, since auditors who can state it in a sentence usually collect better evidence than those who rely on a long checklist.

1. Collect the arrangements your organisation has committed to, such as procedures that promise a particular review or control.
2. Separate what the standard requires from optional methods suggested by consultants or courses, so findings rest on real criteria.
3. Never replace a standard requirement with a weaker internal rule and then audit only against the rule.
4. Plan evidence trails that follow intention, action and result, for example a recent process change from decision to work area.
5. Sample across shifts, sites and providers, and note what the sample can and cannot show.
6. Write findings so the requirement, the evidence and the conclusion are each visible.
7. Review whether the audit told management something new about operation, rather than only confirming that records exist.

Two illustrative audit questions

Plan intervals intelligently

Clause 9.2.1 calls for planned intervals. The detailed programme under clause 9.2.2 considers environmental importance, changes and previous audit results. There is no universal rule in this clause that every process must be audited on an identical annual cycle.

The organisation should be able to explain how the programme provides useful information on conformity and effectiveness. Significant changes or recurring weaknesses may justify different attention from stable, lower-consequence activities.

Evidence and common mistakes