ISO 14001 clause 9.2.2: organise an effective internal audit programme

What clause 9.2.2 requires in practice

Clause 9.2.2 asks the organisation to establish, implement and maintain one or more internal audit programmes. A programme sets out how often audits occur, the methods used, who is responsible, what planning is needed and how results are reported. When building it, the organisation takes into account:

• how much the processes in question matter environmentally;
• any changes that affect the organisation;
• the results of previous audits.

For every audit the organisation defines the objective, criteria and scope, selects auditors and conducts the audit so that the process is objective and impartial, and makes sure results are reported to relevant management. In the 2026 text, the programme itself must be available as documented information, together with evidence that it was implemented and evidence of the audit results. That is three related things, not one calendar.

Build coverage around significance and change

Identify the processes and interfaces that need examination to provide information on EMS conformity and effectiveness. Consider where environmental consequences are important, where recent changes may affect controls and where earlier audits revealed weaknesses. A stable process and a newly outsourced activity may warrant different methods or timing.

Coordinate the programme with operational realities while preserving its purpose. Auditing a construction activity after the relevant work has ended may leave limited evidence. Auditing only during a convenient day shift may miss important differences. Plan access to people, records and work that can answer the audit questions.

Define each audit clearly

For each audit, define objectives, criteria and scope. Objectives state what the audit intends to establish; criteria provide the requirements used for evaluation; scope sets the boundaries. These distinctions help prevent a broad title from concealing an audit that examined very little.

Select auditors and conduct audits to ensure objectivity and impartiality. Consider competence and potential conflicts. In a small organisation, external support or cross-functional arrangements may help, but no single organisational model is prescribed. The arrangement should support an accurate evaluation of evidence.

Why the internal audit programme matters to the business

An audit programme decides where the organisation looks for weakness. If it simply rotates through departments, serious risks may go unexamined for long periods while stable, low-consequence areas are checked repeatedly. A programme tied to environmental importance and change directs scarce audit effort to the places where failure would cost most. It also gives top management confidence that the picture they receive is balanced and independent. For businesses preparing for an independent assessment, a defensible programme is often what separates a calm assessment from a scramble to explain gaps in coverage.

How to implement clause 9.2.2

Treat the programme as a plan for gathering evidence, and the calendar as only one of its parts. Keep the programme short enough that managers can read it, and revisit it whenever a significant change or a repeated finding shifts where the risk lies.

1. Map processes and interfaces by environmental importance, recent change and past findings to decide where audit effort should go.
2. Time audits so evidence exists, for instance after a new provider has delivered real work, or while the relevant activity is under way.
3. State objective, criteria and scope for each audit so a broad title cannot hide a narrow examination.
4. Choose auditors for competence and independence, and use external support or cross-functional pairing where a small team lacks objectivity.
5. Define how findings are classified, who receives the report and how quickly they are expected to respond.
6. Review how the programme performed: were audits completed, did methods produce useful evidence and were recurring issues examined?
7. Keep the programme, its implementation records and the audit results as related but distinguishable information.

Evidence an auditor expects for clause 9.2.2

An auditor will compare what was planned with what was done. Useful evidence includes: Interviews and observation of the audit process itself help show that the programme was applied in practice, not just filed.

• the audit programme, showing how importance, change and earlier results shaped coverage;
• audit plans and records proving the programme was carried out;
• audit reports showing objectives, criteria, scope and conclusions;
• records of how auditors were selected and why they were suitably independent;
• interviews with auditors and managers about how results reached decision-makers.

Common nonconformities with clause 9.2.2

Findings under clause 9.2.2 typically show a programme that exists as a timetable only. Typical examples include: These are the weaknesses most often found when an assessor follows an audit from programme to report and asks what changed as a result; each one reduces the value of the programme to management.

• audits with no stated objective, criteria or scope;
• auditors who assess their own work or report only to their own line;
• coverage that ignores changes or earlier weak areas;
• the programme itself not retained as documented information;
• results that never reach the managers who control the processes.

Two illustrative programme decisions

Report results to the people who can act

Ensure relevant management receives the results. Reports should distinguish evidence-based nonconformities from other observations and explain the scope and limitations of the work. Connect findings with the organisation’s response and improvement processes so that the audit has a practical consequence.

Review programme performance too. Were planned audits completed, did methods provide useful evidence and did recurring issues receive appropriate attention? Changes to the programme should be reasoned, especially when postponement would leave an important area unexamined.

Required documented information

The 2026 requirement includes documented information on the audit programme itself, evidence that it was implemented and audit results. Keep these related but distinguishable. A schedule can contribute to the programme, an audit record can demonstrate execution and a report can preserve conclusions. One integrated arrangement can hold them without requiring three separate systems.

Common weaknesses include unclear criteria, missing audit objectives, biased auditor selection and reports that do not reach the responsible managers. Another is showing completed calendar entries as the only evidence of an audit. Records should support what was examined and concluded.