ISO 14001 internal audit: approach and checklist per clause
An internal audit is a mandatory part of ISO 14001 (clause 9.2). With it, you check for yourself whether your environmental management system meets the standard and works in practice. The internal audit is your last check before the external auditor arrives, and at the same time a tool for continual improvement. The official text of the standard is available from NEN . Below you will find the approach, a practical checklist per clause, and how to decide whether to audit yourself or outsource. See also the page the audit process for ISO 14001 for how the external audit runs.
Why an internal audit is mandatory
Clause 9.2 states that you carry out internal audits at planned intervals. The purpose: to determine whether the environmental management system meets the requirements of the standard and your own requirements, and whether it is effectively implemented and maintained.
The standard also sets out three conditions:
- you create an audit programme (a schedule over time)
- your auditors are objective, they do not check their own work
- you report findings to management and follow them up
The internal audit does not replace the external certification audit. It is an internal control tool. But a thorough internal audit considerably reduces the risk of surprises during the external audit.
The approach in five steps
Plan the audit programme
Draw up an audit programme for the year. Which clauses do you audit when? Over a three-year period, all clauses should be covered. Typically you audit the critical clauses (environmental aspects, compliance, objectives) every year.
Record the programme in a simple schedule: date, topic to be audited, auditor, department involved.
Set the audit criteria and scope
Before you start, decide what you will check and against which criteria. The criteria are the requirements of ISO 14001, but also your own procedures and work instructions. The scope is the boundary: which department, site or process step do you check?
Carry out the audit
An internal audit consists of three parts: document review, interviews, and a walk-through of the site.
During the document review, you check whether procedures and records are complete, up to date and consistent. In interviews, you talk to employees: do they know the environmental policy, do they know what their role is, and how do they deal with environmental aspects in their daily work? During the walk-through, you check whether reality matches what is documented.
Document findings
Note conformities (it is correct), observations (points for improvement without a non-conformity), and non-conformities (the standard or your own requirement is not being met). Use the same terminology as the external auditor.
For each non-conformity, note: the standard clause, the description of the non-conformity, and the evidence (what did you see or find?).
Follow up on findings
Set non-conformities as corrective actions. For each one: what is the cause, which action solves it, who is responsible, and when is it done? Keep the report and the follow-up actions for the external auditor. The structure of such a report, with a completed example, is on internal audit report for ISO 14001.
ISO 14001 internal audit checklist per clause
Use this checklist during your internal audit. Each row shows what you check, which documents you review, and which questions you ask.
Clause 4: Context
| Checkpoint | What you check | Questions for employees |
|---|---|---|
| Context analysis present and up to date | Document with internal and external factors | ”Have there been changes that affect the context analysis?” |
| Stakeholders and their requirements documented | Stakeholder overview | ”What new requirements have customers or regulators raised?” |
| Scope defined and realistic | Scope document | ”Do all activities with an environmental impact fall within the scope?” |
Clause 5: Leadership
| Checkpoint | What you check | Questions for employees |
|---|---|---|
| Environmental policy signed and up to date | Policy statement, date, signature of management | ”Do you know what the environmental policy says?” |
| Policy communicated | Evidence of communication (email, poster, toolbox meeting) | “Is the policy available to everyone?” |
| Management shows commitment | Minutes of management review, resources made available | ”How does management actively support the system?” |
Clause 6: Planning
| Checkpoint | What you check | Questions for employees |
|---|---|---|
| Environmental aspects register complete | Register with aspects, impacts and significance assessment | ”Are there new activities or processes that are not in the register?” |
| Significance assessment transparent | Criteria recorded, assessment per aspect traceable | ”How was it decided that this aspect is significant?” |
| Compliance register up to date | List of laws and regulations per environmental aspect | ”Are there new laws or permit requirements?” |
| Compliance evaluation carried out | Evidence that you checked per obligation whether you comply | ”How do you know you comply with the requirements of the Environment and Planning Act (Omgevingswet)?” |
| Environmental objectives measurable and monitored | Objectives plan with progress | ”How do you measure progress on your environmental objectives?” |
Clause 7: Support
| Checkpoint | What you check | Questions for employees |
|---|---|---|
| Competences defined and secured | Training matrix, training records | ”What training did you complete for your environmental tasks?” |
| Awareness demonstrated | Employees can name the environmental policy and their own role | ”What does your department contribute to the environmental objectives?” |
| Documented information controlled | Version control, accessibility, no outdated versions in circulation | ”Where do you find the current procedures?” |
Clause 8: Operation
| Checkpoint | What you check | Questions for employees |
|---|---|---|
| Operational control measures in place | Instructions, procedures per significant aspect | ”How do you deal with [specific environmental aspect] in your daily work?” |
| Emergency plan in place and tested | Emergency plan, report of exercise or incident | ”Do you know what to do in case of a leak or fire?” |
Clause 9: Performance evaluation
| Checkpoint | What you check | Questions for employees |
|---|---|---|
| Measurement data available | Energy, waste and emissions data over the measurement period | ”How is measurement data recorded?” |
| Objectives are monitored | Progress reports | ”How do you know whether you are on schedule?” |
| Management review held | Minutes with the required inputs and outputs | ”When was the last management review?” |
Clause 10: Improvement
| Checkpoint | What you check | Questions for employees |
|---|---|---|
| Non-conformities recorded and followed up | Non-conformity register, corrective actions with status | ”How do you report a non-conformity or incident?” |
| Improvements demonstrable | Comparison of performance over time | ”What improvements were achieved in the past year?” |
Make sure your checklist is not just a list of ticks. An auditor who only ticks off documents and does not talk to employees or walk around misses half the picture. The combination of document review, interviews and a site walk-through makes an audit valuable.
Audit yourself or outsource?
| Consideration | Audit yourself | Outsource |
|---|---|---|
| Costs | Lower (time only) | Higher (€500-€2,500 per day) |
| Objectivity | Risk of tunnel vision | Fresh outside perspective |
| Availability | Depends on internal capacity | Can be planned |
| Knowledge of the standard | Requires training or experience | External auditor is a specialist |
| Small organisations | Often difficult due to limited separation of duties | Logical choice |
| Combined audits | Easy to combine with ISO 9001 | External auditor can do both |
The golden rule: an auditor may not check their own work. If the environmental coordinator made the environmental aspects analysis, that same person may not audit that analysis internally.
At small companies, this creates a practical problem. Solutions are: train a colleague from another department as an internal auditor, hire an external internal auditor, or rotate the audit task.
An external internal audit typically takes half a day to a full day for a small company. The costs range from €400 to €1,500, depending on the size. See the costs and timeline for more cost overviews.
Frequency and recording in the audit programme
The standard asks for periodic internal audits but does not prescribe a frequency. In practice, for certification tracks, at least one full internal audit per year applies.
Draw up an audit programme that looks at least three years ahead. For each audit, record:
- which clauses or processes are audited
- who the auditor is
- when it takes place
- how findings are followed up
The external auditor will ask for this programme. An incomplete or unfollowed programme is a finding.
Next step
After the internal audit, the process continues with the management review and then the external certification audit. Read the complete step-by-step plan or see what the external auditor expects on the page the audit process for ISO 14001.