To audit an ISO 14001:2015 environmental management system, check that the company knows how its activities affect the environment, knows which laws apply, controls the significant impacts and checks its own compliance. Then test whether it improves. The proof is in site visits and records, not in the manual.
Last reviewed: 17 October 2026. Facts checked. This guide follows the published structure of ISO 14001:2015. The standard is a paid document, so we have not reproduced its text. Check the current edition and any amendments. We have not quoted environmental laws, limits or permit conditions, since they vary by industry and state. Check the laws that apply to the site you audit.
Edition note (17 October 2026). ISO 14001:2026 was published in April 2026 (most sources say 15 April) and replaces ISO 14001:2015 after a transition of about three years; sources differ on the exact end date, so ask your certification body. ISO 9001:2026 followed on 16 September 2026. This guide uses the 2015 structure, because we could not verify the 2026 clause numbering. If you audit to the 2026 edition, check each reference against it.
What ISO 14001 covers
An environmental management system (EMS) is the set of policies, processes and records a company uses to manage its environmental duties and reduce harm. ISO 14001:2015 has the same ten-clause layout as ISO 9001 and ISO 45001. The EMS clauses are 4 to 10, as set out in our ISO 9001 checklist. What is different is the content in planning and operation.
Terms to know
- Environmental aspect: an activity, product or service that can affect the environment, such as emissions from a boiler.
- Environmental impact: the change that results, such as air pollution.
- Compliance obligations: laws and other requirements the company must or chooses to meet, such as permits and customer commitments.
- Life cycle perspective: thinking beyond your gate, from raw materials to disposal.
Clause by clause: what to test
Clause 4: Context
Does the company understand outside issues such as climate, regulation and neighbours? Is the EMS scope and boundary clear and does it include all sites and activities?
Clause 5: Leadership
Is there an environmental policy that includes commitments to protect the environment, meet compliance obligations and improve? Are roles assigned?
Clause 6: Planning
This is the heart of an EMS audit.
- 6.1.2 Environmental aspects: Is there a list of aspects with a way to rate which are significant? Does it include abnormal situations and emergencies?
- 6.1.3 Compliance obligations: Is there a register of laws and permits, an owner, and a way to keep it current?
- 6.1.4 Planning action: Are risks and opportunities linked to significant aspects?
- 6.2 Objectives: Are they measurable and tracked?
Clause 7: Support
Competence of people whose work can affect significant aspects, awareness training, communication with outside parties, and document control.
Clause 8: Operation
- 8.1 Operational control: Are there controls for significant aspects, such as waste handling, chemical storage and effluent treatment? Are contractors and suppliers covered? Is there a life cycle view?
- 8.2 Emergency preparedness: Are likely emergencies identified, plans in place, drills held and plans updated after real events?
Clause 9: Performance evaluation
- 9.1.1 Monitoring and measurement: Are key characteristics measured and equipment calibrated?
- 9.1.2 Evaluation of compliance: Does the company check itself against its obligations and keep records?
- 9.2 and 9.3: Internal audit and management review.
Clause 10: Improvement
Incident handling, corrective action, and continual improvement of the EMS.
Evidence to ask for
| Area | Evidence |
|---|---|
| Aspects | Aspect register with significance method |
| Legal | Register of legal and other requirements, permits, return filings |
| Waste | Waste records, handover documents, authorised handlers |
| Chemicals | Storage areas, labelling, safety data sheets |
| Emissions and discharge | Monitoring results against limits |
| Emergencies | Drill records, spill kits, response plans |
| Training | Records for staff handling hazardous tasks |
Go to the plant. Look at the waste area, the chemical store and the effluent point. Compare what you see with what the register says.
Common findings
- Aspect register not reviewed after a process change.
- Legal register out of date or with no owner.
- Significant aspects with no operational control.
- Compliance evaluation done but not recorded.
- Emergency drill never carried out for a foreseeable spill.
- Contractors not briefed on site rules.
Reporting and next steps
Write each finding as requirement, evidence and gap. Grade it using your own criteria, as discussed in ISO audit nonconformities. If a breach of law is found, escalate it at once to management and not only in the report.
For disclosure of environmental data by listed companies, see our BRSR internal audit checklist. An EMS certificate does not replace those duties.
Frequently Asked Questions
Does ISO 14001 certification mean the company complies with environmental law?
No. It means the company has a system to identify and meet its obligations. The standard asks it to evaluate compliance, but certification is not a legal clearance.
What is a significant environmental aspect?
An aspect with a significant impact, as decided by the company's own criteria. Auditors check that the criteria exist and are applied consistently.
Do I need to audit contractors?
You need to check the company controls outsourced processes and that contractors follow its environmental rules where they could affect significant aspects.
How is ISO 14001 different from ISO 9001?
The structure is the same. ISO 14001 focuses on environmental aspects, legal compliance and emergency preparedness, while ISO 9001 focuses on customer requirements and product or service quality.
Can the EMS be audited together with other systems?
Yes. See auditing an integrated management system.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error