ISO 14001 audit: preparation, process and checklist
An ISO 14001 audit runs in two phases: a documentation review (phase 1) and an on-site audit (phase 2). An external auditor from an accredited certification body checks whether your environmental management system meets the requirements of ISO 14001 . You buy the official standard from NEN (Netherlands Standardisation Institute). Below you read the process, the internal audit, and the common findings.
An audit does not only review documents. It mainly checks whether your environmental management system works in practice. The auditor wants to see evidence of environmental improvements.
The ISO 14001 audit process in brief
| Part | What happens? | Result |
|---|---|---|
| Phase 1 | Documentation review | Ready or no-go for phase 2 |
| Phase 2 | On-site implementation audit | Certification recommendation |
| Surveillance | Annual check audit | Keep certificate |
| Recertification | Full reassessment in year 3 | Certificate renewed |
Still on ISO 14001:2015? Then link the switch to ISO 14001:2026 to a surveillance or recertification audit. In this transition audit, the auditor mainly looks at the new points, such as clause 6.3. NEN gives 15 April 2029 as the final transition date, so plan your own audit well before then.
The ISO 14001 audit process step by step
Phase 1: documentation review
In phase 1 the auditor checks whether you are ready on paper. They review your documentation, your environmental aspects analysis, your policy and objectives, and your compliance overview. The aim is to establish whether your environmental management system is developed enough to carry out phase 2.
Phase 1 can take place on site or remotely, depending on the certification body and your preference. For smaller organisations it typically takes half a day to a day.
After phase 1 you receive a report with findings. If there are shortcomings, you have time to fix them before phase 2 takes place. Sometimes the findings are so fundamental that phase 2 is postponed.
Phase 2: implementation audit
In phase 2 the auditor comes to your site. They check whether your environmental management system not only exists on paper, but also works in practice.
The auditor speaks with employees at different levels. They ask about their knowledge of the environmental policy, their role in the system, and how they handle environmental aspects in their daily work. A warehouse worker may be asked how they separate waste. A production worker may be asked what they do when there is a leak.
The auditor checks records. Energy consumption data, waste records, measurement results, training records, internal audit reports and management review minutes. They want evidence that you do what you say you do.
The auditor walks around the workplace. They observe how work is done, whether waste is separated correctly, whether instructions are present and readable, and whether the situation matches what is documented.
The auditor is not looking for perfection. They are looking for a working system that meets the requirements and leads to continual improvement. Small deviations are normal and can be resolved during the process.
Possible outcomes of the ISO 14001 audit
After the audit you receive a report with the findings. There are different types of finding:
Conformities are points where you meet the requirements. They confirm that things are going well.
Observations are improvement points that are not a deviation from the standard. The auditor sees opportunities to do something better, but it meets the minimum requirements. You are not obliged to act, but it is sensible to do so.
Minor nonconformities are shortcomings that must be resolved, but that do not fundamentally undermine the working of the system. The certification body decides which correction period and which evidence are needed. Ask whether they review an action plan first or also need to verify how it is carried out. The body then makes the certification decision.
Major nonconformities are serious shortcomings that fundamentally undermine the working of the system. With major nonconformities, the certificate cannot be issued until the nonconformities have been resolved and verified, often through a follow-up audit. For a step-by-step explanation of what to do about a major nonconformity, see major nonconformity with ISO 14001.
Most organisations receive a few minor nonconformities at the first audit. That is normal and not a reason to panic. You resolve them, provide evidence, and receive your certificate.
The internal audit for ISO 14001
Before the external auditor arrives, you carry out an internal audit yourself. This is a mandatory part of chapter 9 of the standard. You check whether your environmental management system meets the requirements of ISO 14001 and whether it works in practice. The full approach, a checklist per clause, and the trade-off between auditing yourself and outsourcing can be found on the page ISO 14001 internal audit.
The internal audit is not a formality. It is your last check before the certification audit takes place. If you find deviations here, you resolve them before the external auditor visits. That saves a lot of stress.
Who may carry out the internal audit?
The auditor may not check their own work. The environmental coordinator who set up the system may therefore not audit that system themselves. In small companies this is solved by having a colleague from another department audit, or by hiring an external auditor.
An external internal audit costs a few hundred to a few thousand euros, depending on the size. See the costs and timeline for an indication by company size.
What does the internal audit check?
You go through all the requirements of the standard. In concrete terms, you check whether the environmental aspects analysis is complete, whether objectives are measurable and monitored, whether the compliance overview is up to date, and whether employees know what their role is. You speak with people, review records, and check whether practice matches the documentation.
The result is a report with findings. As with the external audit, you distinguish conformities, observations and deviations. You follow up the findings with corrective actions.
ISO 14001 audit checklist per clause
Want to know what the auditor looks for in phase 2? The checklist below goes through the most important clauses: what the auditor wants to see and what evidence you have ready. Use it as a final check before your internal audit. If you want to go through all the sections of ISO 14001:2026, the full ISO 14001 checklist per chapter is available.
| Clause | What the auditor wants to see | Evidence to have ready |
|---|---|---|
| 4 Context | Insight into internal and external factors and interested parties | Context analysis, stakeholder overview, scope |
| 5 Leadership | Demonstrable commitment from top management | Environmental policy, minutes of management review, allocated resources |
| 6.1.2 Environmental aspects | Systematic assessment of significance | Environmental aspects register with criteria |
| 6.1.3 Compliance | Up-to-date overview of laws and regulations | Legal register, compliance evaluation |
| 6.2 Objectives | Measurable, monitored environmental goals | Objectives plan with progress |
| 7.2 Competence | Employees are competent for their task | Training and education records |
| 8.2 Emergency preparedness | Preparation for environmental incidents | Emergency plan, drill reports |
| 9.1 Monitoring | Measurement data for significant aspects | Energy, waste and emissions data |
| 9.2 Internal audit | Independent internal audit, followed up | Audit programme, report, corrective actions |
| 10.2 Improvement | Deviations investigated and resolved | Nonconformity records, root cause analysis |
Common findings in the ISO 14001 audit
Some shortcomings occur more often. Knowing about them helps you prevent them.
On environmental aspects
The environmental aspects register is incomplete or the significance assessment is not transparent. The auditor wants to see that you have systematically considered which aspects are significant and why. A list of aspects without clear criteria for significance is a common minor nonconformity.
On compliance
The overview of laws and regulations is not up to date or the evaluation of compliance is missing. You need to know not only which rules apply, but also be able to demonstrate that you check whether you comply with them.
On objectives
Objectives are not measurable or progress is not monitored. “We want to become more sustainable” is not a good objective. “We cut energy use by ten percent in twelve months” is, provided you track progress.
On awareness
Employees do not know what the environmental policy is or what their role in the system is. The auditor speaks with people on the work floor. If they cannot explain how they contribute to environmental management, that is a finding.
On the internal audit
The internal audit was insufficient or findings were not followed up. The internal audit must cover all requirements of the standard, and the auditor may not check their own work.
On management review
The management review was not carried out or the required topics are missing. The standard specifies which input and output the management review must have.
How do you prepare for an ISO 14001 audit?
Good preparation increases the chance of a smooth audit.
Check your documentation
Go through your documentation. Is everything up to date? Are there no contradictions between what you have written and what you do? Outdated documents that do not match practice are a red flag for auditors.
Prepare your employees
Inform employees that the audit is coming and what it involves. They do not need to be afraid of the auditor, but they must be able to explain what they do and why. A short briefing helps.
Tell them to answer honestly. If they do not know something, it is better to say so than to make something up. The auditor values honesty.
Check your records
Gather the records the auditor is likely to want to see: energy consumption, waste data, training records, audit reports, minutes of management reviews. Make sure they are complete and accessible.
Walk through your site
View your site through the eyes of an auditor. Are instructions present where they should be? Is waste separated correctly? Are there no visible violations? Small things stand out.
Plan time for the audit days
Make sure the relevant people are available during the audit. The auditor wants to speak with top management, the environmental coordinator, and employees on the work floor. Schedule this in.
Do not try to disguise or hide things. Auditors are trained to spot inconsistencies. Honesty about shortcomings and how you address them makes a better impression than trying to conceal them.
During the ISO 14001 audit
The audit usually begins with an opening meeting in which the auditor explains the programme and answers questions. The auditor then gets to work according to their audit plan.
Appoint someone to accompany the auditor and take notes on findings. This helps with follow-up.
Answer questions honestly and concisely. If you do not know something, say so and offer to provide the information later. Do not speculate.
If the auditor notes a finding, ask for clarification if you do not understand it. You do not have to agree with it, but you must understand what the problem is.
The audit ends with a closing meeting in which the auditor presents their findings. This is the moment to ask questions about anything unclear.
After the ISO 14001 audit
After the audit you receive the formal report. For minor nonconformities you are given time to resolve them. You provide evidence of the measures taken, and the auditor assesses whether this is sufficient.
Once all findings have been dealt with, you receive the certificate. It is valid for three years.
The annual ISO 14001 surveillance audit
After certification the auditor returns every year for a surveillance audit. This is shorter than the initial audit, typically a third to half of the time. The auditor checks whether you maintain and improve the system.
At the surveillance audit not the whole system is audited, but a selection of parts. Over the three years, everything must be covered.
If the surveillance audit reveals serious shortcomings, the certificate can be suspended or withdrawn. This rarely happens if you maintain the system seriously.
The ISO 14001 recertification audit
After three years a recertification audit follows. This is more extensive than a surveillance audit and resembles the initial audit. The whole system is reassessed.
If recertification is successful, you receive a new certificate for the next three years.
How do you choose a certification body for ISO 14001?
You choose yourself which certification body carries out the audit. Well-known bodies in the Netherlands include Kiwa , TÜV , DNV , Bureau Veritas , DEKRA , and LRQA .
Choose a body that is accredited by the Dutch Accreditation Council (Raad voor Accreditatie, RvA ). This guarantees that the body meets quality requirements and that your certificate is officially recognised.
Request quotes from several bodies and compare on price, lead time, and experience in your sector. An auditor who understands your industry can add more value than someone who only works through the checklist.
Next step after the ISO 14001 audit
Return to the step-by-step plan for the complete process, or read the frequently asked questions for answers to practical questions.
Practical next steps
Work out audit evidence in a targeted way with the compliance evaluation and the environmental emergency drill plan. Both examples link a commitment to implementation, checking and follow-up.