meets the relevant ISO 14001 requirements
An ISO 14001 Internal Audit is one of the most important checks within an Environmental Management System.
It determines whether the EMS meets relevant ISO 14001 requirements, meets the organisation’s own requirements, is actually being followed and is effectively implemented and maintained.
The Internal Audit should therefore do much more than prepare the business for an external certification auditor.
Done properly, it gives management an objective view of where environmental controls are working, where weaknesses exist and where improvement is required.
For organisations preparing for certification, it is also one of the best opportunities to identify and correct problems before the independent certification body assesses the system.
The goal is simple: determine whether the EMS genuinely works.
meets the relevant ISO 14001 requirements
meets your organisation's own EMS requirements
is actually being followed; and
The internal audit is therefore much more than preparation for the external certification auditor.
Done properly, it gives management an independent view of where the Environmental Management System is working, where controls are weak and where improvement is needed.
An ISO 14001 internal audit is one of the most important checks in your Environmental Management System.
A functioning internal-audit process should address the following areas.
The purpose of these requirements is not administrative control.
They create a reliable process for evaluating whether the EMS can be trusted.
An ISO 14001 internal audit is a systematic and objective assessment of the organisation's Environmental Management System.
It evaluates whether the EMS conforms to:
It also evaluates whether the system is effectively implemented and maintained.
An internal audit can be conducted by:
The important requirements are competence, objectivity and impartiality.
Someone should not simply audit their own work and declare it effective.
These are different audits.
The internal auditor helps the organisation understand itself.
The certification auditor independently determines whether the management system meets certification requirements.
Internal audit forms part of the performance-evaluation requirements of ISO 14001.
An organisation preparing for certification should have implemented its internal-audit process before the external certification assessment.
That means more than creating an audit schedule.
The organisation should be able to demonstrate that:
A certification body will normally want to see evidence that the internal-audit process is functioning.
If the internal audit has not been implemented meaningfully, the organisation is unlikely to be genuinely certification-ready.
The purpose is not simply to check whether every clause has a corresponding document.
A useful internal audit answers practical questions.
Are the environmental controls being followed?
Are significant environmental aspects properly managed?
Are employees doing what the EMS says they should do?
Are environmental objectives being monitored?
Are compliance-management processes working?
Are incidents and nonconformities properly addressed?
Are records reliable?
Is management receiving useful environmental information?
The audit should identify the difference between:
what the organisation says it does
and
what actually happens.
That gap is often where the most valuable audit findings sit.
A good audit starts before the auditor arrives.
The organisation needs an audit programme that reflects the Environmental Management System and its environmental priorities.
The internal-audit programme is the broader plan covering the organisation's audits over a defined period.
It should consider issues such as:
This means the audit programme does not need to treat every area equally.
A process involving significant environmental risk may deserve more frequent or detailed auditing than a low-risk administrative activity.
A mature audit programme directs more attention towards areas where failure would matter most.
For example:
may reasonably require greater audit focus than lower-risk activities.
It is to build enough coverage and evidence to understand whether the EMS works.
ISO 14001:2026 places clearer emphasis on defining audit objectives.
The audit objective explains what the audit is intended to achieve.
Examples could include:
A clear objective keeps the audit focused.
Without one, audits can become generic document reviews that produce little useful information.
Audit criteria are the requirements against which evidence will be evaluated.
Depending on the audit, criteria might include:
The auditor needs to know what they are testing.
Otherwise an audit finding becomes an opinion rather than an evidence-based conclusion.
The audit scope defines the boundaries of the audit.
This may include:
For example:
Audit objective: Evaluate implementation of waste-management controls.
Audit scope: Johannesburg warehouse and dispatch operations.
Audit criteria: EMS waste procedure, relevant internal controls and applicable ISO 14001 requirements.
This is far clearer than simply scheduling an "ISO 14001 audit".
The auditor needs enough competence to conduct an effective audit.
That includes appropriate understanding of:
The exact competence required depends on the audit.
An auditor assessing a relatively simple office process may require different technical knowledge from someone auditing hazardous chemical controls in an industrial operation.
ISO 14001 does not prescribe one specific personal certification that every internal auditor must hold.
The organisation needs to determine what competence is appropriate.
Competence can come from a combination of:
Formal internal-auditor training can be valuable.
But possessing a certificate does not automatically make someone an effective auditor.
The audit process needs objectivity and impartiality.
In a large organisation, this may be straightforward.
An employee from one department can audit another.
In a smaller business, maintaining complete organisational separation can be more difficult.
The important principle is that auditors should not be put in a position where they are simply approving their own work.
Possible approaches include:
An external consultant can conduct the internal audit on behalf of the organisation.
It is still considered an internal audit because it is performed for the organisation's own management-system purposes.
An effective audit generally follows a structured process.
Before the audit, review relevant information.
This might include:
Do not attempt to memorise the entire EMS.
Understand the process you are going to audit and identify areas worth following.
For larger or more formal audits, explain:
An internal audit should not feel like a trap.
Employees should understand that the purpose is to test the system and identify improvements.
Good auditors follow activities through the business.
For example, rather than asking:
"Do you have a waste procedure?"
follow the actual waste process.
Ask:
Where is waste generated?
How is it separated?
Who handles it?
Where is it stored?
Who removes it?
What records exist?
What happens when something goes wrong?
This approach reveals much more than simply reading the procedure.
Speak with people who perform the work.
Useful questions include:
Employees do not need to quote ISO clauses.
They need to understand how environmental requirements affect their work.
Go where the work happens.
Depending on the organisation, this could mean observing:
If the EMS says one thing and the site shows another, investigate further.
Internal auditing is normally based on sampling.
The auditor may examine:
The purpose is not to inspect every document ever created.
It is to gather enough reliable evidence to reach a reasonable conclusion.
Audit findings should be evidence-based.
Avoid vague statements such as:
"Waste management seems poor."
A stronger finding explains:
This makes corrective action much easier.
Audit results should be communicated to relevant management.
The report should be clear enough for people to understand:
A long audit report is not automatically a good one.
Clarity matters more than volume.
The exact audit should follow the defined scope and criteria, but a broader EMS audit may consider areas such as:
Yes, the audit process itself can also be evaluated.
A checklist can help structure an audit.
It should not replace auditor judgement.
Use questions such as:
A checklist can ensure coverage.
But an auditor should always follow evidence beyond the original checklist when something important emerges.
An audit finding is the result of evaluating audit evidence against the audit criteria.
Not every observation needs to become a nonconformity.
Findings might identify:
The organisation should define how findings are classified and managed.
A nonconformity exists where an applicable EMS requirement has not been fulfilled.
For example:
Requirement: Environmental inspections are required monthly under the organisation's EMS.
Evidence: No inspection was completed for the previous two months.
Finding: The organisation did not implement its own required inspection process.
That is specific.
It connects evidence to a requirement.
Internal auditors should not create requirements based on personal preference.
For example:
"I would prefer this form to be signed in blue ink."
is not a valid nonconformity unless there is actually an applicable requirement for that.
Auditors test requirements.
They do not redesign processes according to personal taste.
After an audit finding, distinguish between correction and corrective action.
Correction addresses the immediate issue.
Corrective action addresses the cause of the issue to prevent recurrence.
Example:
An environmental inspection was missed.
Correction: Complete the overdue inspection.
But that alone does not explain why it was missed.
The investigation may reveal that:
Corrective action addresses that underlying issue.
This distinction helps prevent repeat findings.
Not every minor issue requires an elaborate investigation.
But where a nonconformity indicates a systemic problem, understanding the cause is important.
Useful approaches can include:
Avoid automatically blaming employees.
"Human error" is often not the full root cause.
Ask what allowed the error to happen and why the management system did not prevent or detect it earlier.
ISO 14001 requires internal audits at planned intervals.
It does not prescribe one universal frequency for every organisation.
The audit programme should reflect factors such as:
Many organisations operate an annual audit programme, but that does not necessarily mean every process needs one large audit once a year.
A more useful approach might spread audits across the year.
For example:
Quarter 1: compliance-management processes
Quarter 2: waste and operational controls
Quarter 3: emergency preparedness and environmental objectives
Quarter 4: broader EMS readiness review
A high-risk process could also be audited more frequently than a stable low-risk one.
The audit frequency should make sense for the organisation.
ISO 14001 requires the organisation to establish an effective internal-audit programme, but it does not prescribe a simplistic rule that every clause must necessarily receive an identical standalone audit every year.
The audit programme needs to provide sufficient information about whether the EMS conforms and is effectively implemented and maintained.
When planning coverage, consider:
Over the audit programme, the organisation should achieve appropriate coverage of its EMS.
The focus should remain on effective assurance, not mechanically ticking clause numbers.
This requires careful distinction.
The internal audit assesses conformity of the Environmental Management System against its audit criteria.
ISO 14001 also separately requires organisations to evaluate compliance with applicable compliance obligations.
These processes can inform each other, but an EMS internal audit is not automatically the same thing as a legal-compliance audit.
For example, the internal auditor may evaluate whether:
A detailed legal opinion on whether every statutory requirement has been correctly interpreted may require separate specialist environmental or legal expertise.
This distinction is particularly important in South Africa, where environmental requirements can arise from multiple pieces of legislation, authorisations, permits and regulatory authorities.
For organisations pursuing certification, the internal audit is one of the strongest indicators of readiness.
A weak internal audit often creates false confidence.
A strong one tells you where the real problems are.
Before Stage 1 or Stage 2 certification audits, review whether internal audit has identified and tested:
Then ask:
Completing the audit report is not the end of the audit process.
The value comes from what the organisation does afterwards.
Internal audit should not be conducted the day before the certification body arrives simply to satisfy a requirement.
Allow enough time to:
If the audit reveals major weaknesses, that information should influence the certification plan.
It is better to correct a serious problem before the external audit than to knowingly proceed with an EMS that is not ready.
An organisation can use an external competent person to conduct its internal audit on its behalf.
This can be particularly useful where:
An outsourced internal audit should still serve the organisation's internal management-system needs.
The external auditor performing the internal audit is not issuing ISO 14001 certification.
Certification remains the role of the independent certification body.
External auditing can provide several advantages.
An external auditor may identify weaknesses internal employees have become accustomed to.
Experienced auditors may recognise common implementation weaknesses more quickly.
Your team does not need to maintain the same level of internal-auditor capacity.
An experienced internal auditor can help identify issues before the certification-body assessment.
However, outsourcing should not remove ownership from the organisation.
Management still needs to understand the findings, decide on actions and maintain the EMS.
Yes, where the organisation operates an Integrated Management System, internal audits can often be integrated.
The standards share common management-system processes such as:
Instead of conducting three separate audits of the same management process, an integrated audit can evaluate the relevant requirements together.
For example, one audit of contractor management might consider:
This can make internal auditing more efficient and provide a more complete view of how the business is actually controlled.
The audit team still needs appropriate competence across the disciplines being audited.
Clause coverage matters.
But auditing only by asking whether each document exists often misses whether the EMS works.
Follow processes and evidence.
This weakens objectivity.
Use an alternative auditor or an external resource where practical.
Internal audit is part of ongoing management-system performance evaluation.
It should not appear only when the certification body is due.
Employees do not need to know that environmental aspects sit under a particular clause number.
They need to understand the environmental controls relevant to their job.
Environmental controls happen where work happens.
Visit operations.
A procedure proves that a procedure exists.
It does not prove that employees follow it.
"Environmental controls need improvement" gives management little to act on.
Tie findings to evidence and requirements.
Auditor preferences are not requirements.
A finding that is closed administratively but not corrected in practice is still a business weakness.
Finding zero nonconformities does not automatically mean the audit was excellent.
Nor does finding ten mean the EMS is poor.
The test is whether the audit provides reliable information that helps improve the system.
An ISO 14001 internal audit is a systematic and objective assessment used to determine whether the Environmental Management System conforms to ISO 14001 and the organisation's own EMS requirements and whether it is effectively implemented and maintained.
Yes. Internal auditing is part of ISO 14001's performance-evaluation requirements and needs to be implemented as part of the Environmental Management System.
A competent employee or audit team can conduct the audit, provided sufficient objectivity and impartiality are maintained. An external competent auditor can also conduct the internal audit on the organisation's behalf.
ISO 14001 does not prescribe one specific personal auditor certification. The organisation needs to determine the competence required based on appropriate education, training or experience.
The standard requires audits at planned intervals rather than prescribing one universal frequency. The audit programme should consider environmental importance, process risk, previous audit results, organisational changes and the organisation's need for audit information.
The scope depends on the audit programme, but over time the organisation needs sufficient audit coverage to determine whether the EMS conforms to relevant requirements and is effectively implemented and maintained.
The audit programme should provide appropriate coverage of the EMS scope. Multi-site organisations need to plan audit coverage based on their processes, environmental significance, risks and management-system needs rather than assuming one site's evidence represents all locations.
No. ISO 14001 internal audit and evaluation of compliance are related but distinct activities. The EMS audit can evaluate whether the compliance-management process works, while detailed legal-compliance assessment may require additional specialist expertise.
Internal audits are conducted by or on behalf of the organisation to evaluate and improve its EMS. Certification audits are conducted independently by a certification body to determine whether certification can be granted or maintained.
Yes. Organisations can appoint an external competent auditor to perform internal audits on their behalf, which can be particularly useful where internal independence, competence or capacity is limited.
Yes. The internal-audit process should be implemented before certification, and organisations should allow sufficient time to address relevant findings before the external assessment.
Yes. Where systems are integrated, common management-system processes can often be audited together, provided the audit covers the relevant requirements and the auditors have suitable competence.
An internal audit should do more than help you survive the certification audit.
It should tell management whether the Environmental Management System can be trusted.
A good audit gives you a clear view of:
That is much more valuable than a completed checklist.
ISO Specialist South Africa can support organisations with ISO 14001 internal audits as part of implementation, certification readiness or ongoing management-system maintenance.
The aim is straightforward: