ISO 14001 internal audit report: template with example
An ISO 14001 internal audit report is the document in which you record what you checked, what you found and what you will do about it. It is the proof that your system checks itself. Clause 9.2 of ISO 14001 requires an audit programme and retained information on the audit results (ISO 14001 ). The external auditor asks for the report at the certification audit and wants to see that you act on it. Below you will find the structure, a completed example and common mistakes. Guidance for carrying out audits is in ISO 19011 . You can read more about the audit itself on ISO 14001 internal audit.
What must a report contain?
A good report is short. Five sections are enough, as long as they are correct. The standard does not prescribe the format. It does require that you keep the audit results as documented information and that management is aware of them.
| Section | What it contains | Why the auditor wants to see it |
|---|---|---|
| 1. General details | Date, location, auditor, audited department, scope | Shows what was checked and by whom |
| 2. Audit criteria | The clauses of the standard and your own procedures | Shows that you tested against the right requirements |
| 3. Findings | Per clause: conformity, observation or nonconformity, with evidence | The heart of the report |
| 4. Corrective actions | Per nonconformity: cause, action, owner, date | Shows that you resolve nonconformities |
| 5. Conclusion and approval | Summary, date and signature or approval from management | Shows that management knows the result |
The difference between conformity, observation and nonconformity
Three terms come up again and again. Use them precisely, as the external auditor does.
- Conformity: the requirement is met, and you have seen evidence. For example: the waste register is complete for the past six months.
- Observation: the requirement is met, but there is room for improvement. For example: the work instruction is present but hard to find on the shop floor.
- Nonconformity: the requirement is not met, or the system does not work. For example: the bund under the oil tank has not been inspected in the past year.
An observation is not a nonconformity, and the other way round. If you mix them up, the external auditor will notice quickly.
A completed example
The example below is fictional. It concerns a small printing company with 40 employees that carries out the internal audit in the purchasing and production departments. The table shows how to write down a finding.
| No. | Clause | Finding | Type | Evidence | Action | Owner | Due |
|---|---|---|---|---|---|---|---|
| 1 | 7.5 | Documents are dated and approved | Conformity | Sample of 5 work instructions | None | n/a | n/a |
| 2 | 8.1 | Chemicals list not updated after new ink was introduced | Nonconformity | Safety data sheet missing from the folder | Update the list and add the sheet | Purchasing manager | 15 January |
| 3 | 7.3 | Staff know the waste separation rules, but the sign is mounted too low | Observation | Conversations with 4 operators | Raise and relocate the sign | Production manager | 31 January |
Note three things in this example. Every nonconformity has a clause, a description and evidence. The conformity is also written down, so the reader can see that you checked it. And the observation receives an action, but is not recorded as a nonconformity.
Write the evidence down as a fact. “I looked” is not evidence. “Sample of 5 work instructions, all dated and approved” is.
How to build the report
Record the scope
Write down which departments, locations and clauses you checked. Refer to the audit programme if you have one. Without a scope, it is not clear what you did and did not test.
Note the evidence during the audit
Make notes per clause, while you walk around and talk to people. Write down what you saw, read or heard, and from whom. This is the source for the report.
Separate the findings
Place each finding in the right category: conformity, observation or nonconformity. Unsure? Ask the employee being audited to show you the evidence.
Turn nonconformities into corrective actions
For each nonconformity, record the cause, the action, the owner and the date. Root cause analysis is important here. The method is described in nonconformities and improvement under ISO 9001, which is the same for ISO 14001.
Show the report to management
The audit results feed into the management review (clause 9.3, see the requirements of ISO 14001). This way, management knows what is happening and can free up resources.
What the external auditor looks for
The external auditor does not only look at the report. They check whether the report matches practice. They probe a few points:
- Are the auditors independent of what they check? Someone who checks their own work produces a weak report.
- Have nonconformities been followed up? An open nonconformity from a previous audit with no action is a finding in itself.
- Were the actions actually carried out? They ask for evidence of the action, not just the line in the report.
- Was the report completed on time? If the audit took place months ago and the report is missing, that points to a weakness in the system.
Read more about what the external audit tests on the audit process and in the ISO 14001 checklist.
Common mistakes
- Everything is conforming. A report without a single finding or observation raises questions. Even a good system usually has points for improvement.
- Observations recorded as nonconformities. This makes your system look worse than it is, and you spend unnecessary work on it.
- No evidence for the finding. “Checked” is not evidence. Write down what you saw.
- Actions without an owner or a date. An action without a name and a date is never completed.
- The report is not followed up. A report that sits in a folder is not evidence of improvement.
Common doubts
Does the report have to be digital? No, the format is free. A digital document or a form works, as long as the evidence can be found.
How long should I keep the report? The standard does not state a fixed period. Keep it at least until the next audit is completed and all actions are closed, and record your own retention period in your procedure.
Can a colleague from another department audit? Yes, as long as they do not check their own work. The standard requires the auditor to be objective and impartial.
Next step
Use this format as a basis and adapt it to your own processes. If you want to go through the whole process from preparation to report, read the internal audit with checklist per clause. For the environmental aspects you examine, see determining environmental aspects.