ISO 9001 audits whether a company consistently delivers products and services that meet customer needs. ISO 14001 audits how it manages its effect on the environment. ISO 45001 audits how it protects the health and safety of people at work. All three share one structure, so the audit method is the same. What changes is the question the auditor asks and the evidence behind it.
Last reviewed: 17 October 2026. Facts checked. A web search on the three standards found descriptions from the ANSI webstore, an NPC India webinar document and an academic paper. They give: ISO 9001:2015 for quality management; ISO 14001:2015 for an environmental management system covering aspects the organisation can control or influence, from a life cycle view; ISO 45001:2018 for an occupational health and safety management system aimed at preventing work-related injury and ill health. They also say the three share a high-level structure and the Plan-Do-Check-Act cycle. We did not open the standards, which are paid documents, so the audit prompts below are our own, not quoted clauses.
Edition note (17 October 2026). ISO 9001:2026 was published on 16 September 2026 and replaces ISO 9001:2015 after a transition of about three years. Sources give slightly different end dates (around September 2029), and the International Accreditation Forum and your certification body set the rules, so ask yours. ISO 14001:2026 was published in April 2026 with a similar three-year transition. This guide uses the 2015 clause structure, because we could not verify the 2026 clause numbering. If you audit to a 2026 edition, check each reference against it.
The one-line difference
| ISO 9001:2015 | ISO 14001:2015 | ISO 45001:2018 | |
|---|---|---|---|
| Subject | Quality | Environment | Occupational health and safety |
| Main concern | Customer requirements met | Environmental performance and compliance | Preventing injury and ill health |
| Who is protected | Customers | The environment and communities | Workers and others on site |
| Special focus | Processes, customer satisfaction | Environmental aspects, life cycle view | Hazards, risks, worker participation |
What they share
All three follow the same ten-clause layout: scope, references and terms, then context, leadership, planning, support, operation, performance evaluation and improvement. Each requires a policy, objectives, risk-based planning, competence and awareness, documented information, internal audit, management review and corrective action.
That is why many companies run one integrated system. Our guide to auditing an integrated management system covers that case. This article is about what is different.
What the auditor tests in each
ISO 9001: are customer needs met, every time?
The auditor follows the product or service from order to delivery. Typical questions:
- How are customer requirements captured and checked?
- How are suppliers chosen and watched?
- What happens when a product fails or a customer complains?
- Are the quality objectives measured?
Typical evidence: order records, inspection results, complaints, supplier evaluations. See the ISO 9001 clause-by-clause checklist.
ISO 14001: does the company know and control its environmental effects?
The auditor starts from the list of environmental aspects, meaning the parts of the company's activity that interact with the environment, such as emissions, waste and water use. Questions:
- Which aspects are significant, and how was that decided?
- Does the company know which environmental laws apply to it, and does it comply?
- Are emergencies such as spills planned for and practised?
- Are controls applied to contractors and suppliers where relevant?
Typical evidence: aspect register, legal list, monitoring data, waste records, emergency drill reports. ISO 14001 sets no performance criteria of its own, according to the ANSI description. The company sets its own and must meet its legal duties. See our ISO 14001 audit guide.
ISO 45001: are people protected from harm?
The auditor starts from hazards and incidents. Questions:
- Are hazards identified and risks assessed for each job?
- Do workers take part in safety decisions, and can they report hazards without fear?
- Are incidents investigated, and are causes fixed?
- Are contractors and visitors covered?
Typical evidence: hazard register, incident and near-miss reports, training and permit records, worker consultation minutes. See our ISO 45001 audit checklist.
Where the audits differ in practice
| Audit habit | 9001 | 14001 | 45001 |
|---|---|---|---|
| Where to walk | Production line, service desk, dispatch | Waste area, storage, discharge points | Work areas, machinery, site entry |
| Who to talk to | Process owners, inspectors | Facility and compliance staff | Workers, safety reps |
| Typical trap | Records say pass but the product was reworked | Legal list out of date | Incidents investigated but not prevented |
| Legal link | Customer and product rules | Environmental law | Health and safety law |
We have not listed specific Indian laws here. Check which ones apply to the site you audit.
Which standard does a company need?
Start from the customer or the risk. A buyer who asks for quality assurance points to ISO 9001. A company handling waste or emissions may want ISO 14001. A site with machinery or hazards may want ISO 45001. None is required by law in general terms, as far as we found, so check contracts and any sector rules. Certification is voluntary.
Frequently Asked Questions
Can one audit cover all three?
Yes, if the system is integrated and the auditors are competent in all three. Many certification bodies offer combined audits. Ask yours.
Is ISO 45001 only for factories?
No. Any organisation with workers has health and safety risks. An office has different hazards from a plant, but the system still applies.
Does ISO 14001 guarantee legal compliance?
No. It requires the company to know and meet its legal requirements, and the audit tests that. A certificate does not replace compliance.
Which is easiest to start with?
There is no verified answer. Start with the one your customers or risks demand, and build the shared parts so the others are easier later.
Do the three need separate internal auditors?
An auditor needs to know the standard they audit. Our guide to running an ISO internal audit explains competence and independence.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error