Key facts: ISO 14001:2015 clause 9.2 requires internal audits at planned intervals to confirm EMS conformance. Most certification bodies expect at least one full audit cycle per year. Auditors must be objective and impartial — they cannot audit their own work. Results feed the management review (clause 9.3) and drive corrective actions (clause 10.2).
What ISO 14001 Clause 9.2 Actually Requires
ISO 14001:2015 clause 9.2 has two parts: the audit programme (9.2.1) and the conduct of audits (9.2.2). Together they require you to plan, execute and follow up internal audits in a systematic way that demonstrates ongoing EMS conformance — not just compliance theatre before your annual certification visit.
The standard requires internal audits to determine whether the EMS: (a) conforms to the organisation's own requirements and to the requirements of ISO 14001, and (b) is effectively implemented and maintained.
The 8-Step ISO 14001 Internal Audit Procedure
- Establish the Annual Audit Programme
Define the scope, frequency, methods, planning considerations, reporting and criteria for all planned audits for the year. The programme must consider the environmental importance of processes, change management signals and previous audit results. Document it as a formal programme — a simple spreadsheet or table is fine, but it must be dated and retained. - Plan Individual Audits
For each planned audit, confirm the objective (e.g., clause 9.1 monitoring and measurement compliance for your wastewater process), scope (which process/department/site), criteria (which clauses, legal requirements, operational controls apply) and the audit team. Prepare a checklist tailored to the specific area being audited — not a generic checklist for every process. - Select Objective and Impartial Auditors
The auditor must not audit their own work. In a small organisation this is often the biggest practical challenge. Options include: cross-departmental swaps (production manager audits the EHS team, EHS manager audits production), using an external auditor for specific areas, or rotating staff who have been given internal auditor training. - Conduct the Opening Meeting
Brief the auditee team on the audit scope, method and timing. Confirm who will accompany the auditor, where records are held, and how findings will be communicated. Keep it brief — 10–15 minutes is typical. Document that it occurred. - Gather Audit Evidence
Evidence gathering uses three methods: document/record review, interviews, and observation of activities. For each checklist criterion, record both the evidence found and the conclusion (conforming/nonconforming/opportunity). Be specific — vague notes like "reviewed policy" are insufficient. Good evidence records a document reference, a name, and a date. - Identify and Classify Findings
Classify each finding as: Conformance (requirement met, evidence documented), Minor Nonconformance (isolated failure, single occurrence), Major Nonconformance (systematic failure, total absence of a requirement, or situation that risks EMS integrity), or Opportunity for Improvement (suggestion, not a nonconformance). - Conduct the Closing Meeting and Issue the Report
Present all findings to the auditee. Confirm nonconformances and agree target dates for corrective action. Issue the formal audit report within a defined timeframe (typically 5–10 working days). The report must be retained as documented information per clause 9.2.2(f). - Follow Up Corrective Actions and Verify Effectiveness
Each nonconformance triggers a corrective action per clause 10.2. The internal auditor (or a designated reviewer) must verify within the agreed timeframe that: the root cause was correctly identified, the corrective action was implemented, and the action was effective in preventing recurrence. Document this verification — auditors at certification audits will check it.
ISO 14001 Internal Audit Checklist: Key Clauses
The following clause areas must be covered across your annual audit programme. Not every clause needs to be audited in every cycle — but all must be covered at least once per certification period.
| ISO 14001 Clause | What to Audit | Common Findings |
|---|---|---|
| 4.1 / 4.2 | Context and stakeholder needs | Not reviewed since initial certification |
| 6.1.2 | Environmental aspects register | New activities not added, significance scoring not reviewed annually |
| 6.1.3 | Legal & compliance obligations register | New legislation not captured, compliance evaluation overdue |
| 7.2 / 7.3 | Training, awareness and competence | Training records missing, new joiners not induction-trained |
| 8.1 | Operational controls for significant aspects | Procedures not followed, controls inadequate for identified risk |
| 9.1 | Monitoring, measurement and evaluation | Metrics not tracked, environmental performance not reviewed |
| 9.1.2 | Compliance evaluation | No evidence of evaluation within required frequency |
| 10.2 | Nonconformance and corrective action | Previous NCs not closed, root cause analysis superficial |
Audit Programme Frequency: What Certification Bodies Expect
ISO 14001 does not prescribe a specific audit frequency. However, accredited certification bodies (TÜV, BSI, Bureau Veritas, SGS etc.) have consistent expectations:
- At least one complete audit cycle per year covering all EMS clauses
- Higher-frequency audits for processes associated with significant environmental aspects (e.g., monthly spot checks on waste segregation compliance)
- Evidence that the programme was adjusted based on previous results — a static annual plan with no response to findings signals a paper system
- Management review input: audit results must feed clause 9.3 management review and be documented
Major vs Minor Nonconformance: The Practical Difference
🔴 Major Nonconformance Examples
- No environmental aspects register exists
- Legal requirements have never been evaluated for compliance
- No internal audits conducted in the previous 12 months
- Significant environmental incident with no corrective action taken
- Operational control completely absent for a significant aspect
🟡 Minor Nonconformance Examples
- One employee training record missing from an otherwise complete file
- Environmental aspect register not updated to reflect a minor process change
- One corrective action overdue by 2 weeks with documented reason
- Monitoring frequency slightly below the specified interval on one parameter
Frequently Asked Questions
What does ISO 14001 clause 9.2 require for internal audits?
Clause 9.2 requires an audit programme (planned intervals, scope, methods, criteria) and conducted audits (objective auditors, reported results, documented information retained). Results must feed management review and drive corrective actions where nonconformances are found.
How often must internal audits be conducted for ISO 14001?
The standard doesn't fix a frequency, but requires the programme to consider process risk, environmental importance and previous audit results. In practice, certification bodies expect at least one full EMS audit cycle per year, with high-risk processes audited more often.
Can an internal auditor audit their own work under ISO 14001?
No — clause 9.2 requires auditors to be objective and impartial. An auditor cannot audit a process they are directly responsible for. Small organisations typically solve this through cross-departmental audits or using a trained external internal auditor for specific areas.
What is the difference between a major and minor nonconformance?
A major nonconformance is a systematic failure or complete absence of a required EMS element — it must be resolved before a certification audit can issue a certificate. A minor nonconformance is an isolated lapse — it requires a corrective action plan within an agreed timeframe but does not block certification.
Need an ISO 14001 Internal Audit or Pre-Certification Gap Assessment?
As a TÜV-Certified ISO 14001 Auditor, I conduct internal audits and pre-certification gap assessments for manufacturers — covering all clauses with full documented evidence ready for your certification body.
View ISO 14001 Service →