ISO 14001 Stage 1 and Stage 2 audit: what auditors check at each stage, day by day

Why the ISO 14001 audit has two stages

Accredited certification bodies work to ISO/IEC 17021-1, and that standard requires every initial certification audit to be split in two. Stage 1 answers one question: is this environmental management system ready to be audited in full? Stage 2 answers a harder one: does it actually control the organisation's environmental aspects and keep it within its compliance obligations?

The split saves you from a full audit against an unfinished legal register. How to select the body is covered in choosing an ISO 14001 certification body; the whole route from decision to certificate sits in the certification process guide.

Stage 1: the readiness review for an EMS

ISO/IEC 17021-1 lists what Stage 1 must achieve. Translated into environmental terms, those objectives become a practical list of what to have ready.

Environmental risk lives in yards and drains, not documents, so an ISO 14001 Stage 1 normally includes time on site, announced in advance. The auditor ends Stage 1 with written conclusions and a list of concerns that could become nonconformities at Stage 2. It is not a gap analysis, which is Sterling's first engagement stage: the auditor points to concerns but does not design the remedy.

The interval between the stages

The certification body sets the gap between Stage 1 and Stage 2 with your need to resolve the concerns in mind, and it may change its Stage 2 plan because of them. Typical EMS concerns: an unconfirmed legal register, or no compliance evaluation result yet. Close each with evidence.

Stage 2: implementation and effectiveness

Stage 2 takes place at your sites and evaluates implementation, including effectiveness. Under ISO/IEC 17021-1 it must cover conformity with all the ISO 14001 requirements in scope, performance monitoring against objectives and targets, legal and other compliance obligations, operational control, internal audit and management review, and management's responsibility for the policy.

In an environmental system, auditors test effectiveness by following a chain. They pick a significant aspect, such as solvent use or wastewater discharge, and ask what control applies to it (8.1), what is monitored and with which calibrated equipment, how the results compare with the permit limit, and what the compliance evaluation (9.1.2) concluded. A break anywhere in that chain is where findings come from. They will also ask whether the emergency response (8.2) has been tested by a drill.

A typical Stage 2, day by day

Audit days are set by the certification body from headcount, sites and the environmental complexity of the activities, under accreditation rules; the cost guide explains what moves them. The table below is only an illustration for one manufacturing site, one auditor and three days. Your own audit plan fixes the real sequence.

Operators on the tour will be asked what they do if a drum leaks. Brief them on their own role, not on rehearsed answers.

How the auditor samples environmental evidence

ISO/IEC 17021-1 requires evidence to be collected by sampling and verified through interviews, observation and the review of documents and records. For an EMS that usually means:

• Records chosen by the auditor: a month of monitoring results, two waste consignments, one permit, one drill, picked from the lists you provide.
• Observation first, paperwork second: what is seen in the yard is compared with the operating criteria and the register.
• Cross-checks between registers: an aspect rated significant should appear in the controls, the monitoring plan and often the objectives.

A clean sample does not prove every site is in control. For multi-site organisations, accreditation rules decide which sites are visited. The questions auditors typically put, and the evidence that answers them, are collected in our audit questions guide.

Findings, the closing meeting and the decision

A nonconformity is written against a specific ISO 14001 requirement, with a plain statement of what is wrong and the objective evidence for it. The auditor discusses it with you before the closing meeting; that is the moment to produce a record the auditor has not yet seen. The auditor may not suggest the cause or the fix, because advising would compromise the body's impartiality.

• Major: the finding affects the system's capability to achieve its intended results, for example no evaluation of compliance at all.
• Minor: it does not affect that capability, for example one expired calibration on a secondary meter.
• Opportunity for improvement: not a nonconformity, recorded where the scheme allows it.

At the closing meeting you hear the conclusions and the recommendation, and you are told that the evidence was sampled, how findings are graded, and the deadline for your correction and corrective action plan. The report belongs to the certification body. Competent people there who did not audit you then decide, once corrections and corrective actions for any major have been reviewed, accepted and verified and the plans for minors accepted. A major not verified within six months of the last day of Stage 2 means repeating Stage 2. Closing findings properly is the subject of our nonconformities guide, and life after the certificate is covered in the surveillance and recertification guide.

ISO 14001 Stage 1 and Stage 2 audits: questions buyers ask