ISO 14001 clause 9.2: use internal audit to test the EMS
ISO 14001:2026 clause 9.2 requires internal audits at planned intervals to provide information about EMS conformity and effective implementation and maintenance. The audit assesses the organisation’s own EMS requirements and the standard’s requirements. It is a structured examination of evidence, not simply a review of whether documents have been written.
What clause 9.2 requires in practice
Clause 9.2 asks the organisation to carry out internal audits at planned intervals so that it learns whether the EMS meets its own requirements and the requirements of ISO 14001, and whether it is effectively implemented and maintained. It has two layers:
- 9.2.1 sets the purpose: audit results give information on conformity and on how well the system really operates;
- 9.2.2 requires an audit programme covering frequency, methods, responsibilities, planning and reporting, shaped by the environmental importance of processes, changes affecting the organisation and earlier audit results.
Each audit has its own objectives, criteria and scope. Auditors are selected, and audits conducted, so that the process is objective and impartial, and results reach relevant management. Documented information covers the programme, how it was carried out and what the audits found. Internal audit is a management tool, not a certification decision.
Connect audit purpose with the programme
Clause 9.2.1 establishes what internal audit needs to address. Clause 9.2.2 establishes the programme and individual audit arrangements, including objectives, criteria, scope, auditor selection, reporting and documented information. The programme should reflect environmental importance, changes and previous audit results.
An audit schedule is only one part of a programme. Useful planning also considers methods, responsibilities, preparation and reporting. The programme needs to direct attention where evidence will be most valuable, rather than assigning identical effort to every department regardless of environmental significance.
Follow a process through its interfaces
Select samples that test the connection between requirements and actual work. An auditor might follow a significant aspect into controls, competence, monitoring and action. Another sample may trace an obligation into operational responsibility and evaluation. Interviews, records and observation can provide complementary evidence.
Define the audit criteria and scope clearly. Distinguish a failure to meet a requirement from a preferred improvement method. An auditor’s favourite template is not automatically an audit criterion. Findings should be based on evidence and the relevant requirement, with enough clarity for the organisation to understand the issue.
Why internal audit matters to the business
Internal audit is the cheapest way to find a problem before a customer, regulator or independent assessor does. A good audit shows where procedures are ignored, where responsibilities have quietly moved and where a change has outpaced the controls. It also gives top management a view of the system that does not rely on the people who run it. Businesses that audit well usually see fewer repeat findings, calmer external assessments and faster correction of weak spots. A poor audit does the opposite: it creates comfort without information, and the first real test of the system becomes an incident or a lost contract.
How to implement clause 9.2
Design the audit approach around where evidence is most valuable. This is a practical route, not a prescribed format. Keep the effort proportionate to the size of the organisation, and make sure the audit asks something the business does not already know.
- Write down what the audit must establish: conformity with your own EMS arrangements, conformity with the standard, and effective operation.
- Build the programme from environmental importance, recent changes and earlier findings, and not from a rotation of departments.
- For each audit, state objectives, criteria and scope in terms that a manager can read.
- Choose auditors with the competence and independence to judge the work, using external support where internal objectivity is hard.
- Trace real activity through interviews, records and observation, following one process across functions and shifts.
- Report to relevant management with the evidence behind each finding and the limits of the sample.
- Feed findings into corrective action and management review, and keep programme, implementation and result records together.
Two illustrative audit trails
A manufacturer’s audit follows a recent process change. It checks whether the aspects assessment and obligations were considered, whether affected staff received current information and whether controls operated after the change. A signed approval form is one piece of evidence, but the auditor also examines whether the decision reached the work area.
A software company audits its equipment-disposal process. The sample follows a device group from retirement approval through provider transfer to the required destination evidence. The audit examines responsibilities and information control, and checks whether exceptions are addressed. It does not infer environmental performance merely from the existence of a provider contract.
Preserve objectivity and useful reporting
Select auditors and conduct audits so that objectivity and impartiality are supported. The organisation can use internal personnel or external support on its behalf, but the arrangement should manage conflicts that could weaken the conclusion. Auditor competence needs to match the system and the work examined.
Report results to relevant management. Findings should enable decisions, while limitations of the sample remain understood. An internal audit cannot establish a universal legal guarantee or replace the distinct compliance-evaluation process.
Evidence and common mistakes
The 2026 programme requirement includes documented information on the audit programme, evidence of its implementation and audit results. Keep these connected so that planned coverage can be compared with what actually occurred. A checklist can assist an auditor, but it is not itself proof of an effective audit.
Common weaknesses include auditing only the EMS coordinator, copying last year’s questions, closing findings on promises and failing to revisit recurring issues. Another is treating a clean internal audit as a certification decision. An independent certification body makes its own assessment and decision.
Explore each numbered part
9.2.1 · define what internal audit must establish
The general internal-audit requirement defines the questions that matter: does the EMS meet its requirements, and is it effectively implemented and maintained? This guide explains the role of the organisation’s own requirements, practical evidence and audit sampling. It helps teams avoid audits that only confirm document existence or promote an auditor’s preferred methods.
9.2.2 · organise an effective internal audit programme
An audit programme directs effort towards the processes and changes that matter to environmental outcomes. Clause 9.2.2 covers programme arrangements, individual audit objectives and boundaries, impartiality, reporting and records. This guide shows how to make coverage defensible and findings useful, including the 2026 requirement to document the programme itself as well as implementation and results.
Frequently asked questions
Must internal audits be performed by employees?
No. External support can conduct an internal audit on the organisation’s behalf, with suitable competence, objectivity and scope.
Does every audit need to cover every clause?
The programme must provide suitable coverage. Individual audits can have defined scopes and objectives within that programme.
Does an audit replace compliance evaluation?
No. They can use related evidence but address distinct requirements and conclusions.
Build an audit trail that tests implementation
Discuss environmental internal-audit support with Sterling, including programme design and evidence preparation. The ISO 19011 Auditing Management Systems course develops relevant auditing principles. Effivity ISO & GRC automation software can be scoped to agreed audit processes. See evaluation and the directory.