ISO 14001 Audit Evidence Explained

What is audit evidence?

Audit evidence is the information gathered during an audit and used to support audit conclusions.

It may come from:

• documents and records;
• interviews;
• observations;
• site walkarounds;
• samples of completed work;
• monitoring and measurement data;
• photographs or screenshots where appropriate;
• system records;
• physical conditions seen during the audit.

Audit evidence should be relevant, reliable and sufficient for the auditor to make a fair judgement. The aim is not to collect everything. The aim is to collect enough suitable evidence to evaluate whether the audit criteria are being met.

Audit evidence, audit criteria and audit findings

These three terms work together.

Audit criteria

Audit criteria are the requirements the auditor is auditing against.

In an ISO 14001 audit, criteria may include:

• ISO 14001 requirements;
• the organisation’s EMS procedures;
• the environmental policy;
• environmental objectives and action plans;
• operational control requirements;
• compliance obligations;
• contractual or customer requirements;
• internal audit programme requirements.

Audit evidence

Audit evidence is what the auditor collects to compare against the criteria.

Audit findings

Audit findings are the conclusions reached after comparing evidence with the criteria.

Why audit evidence matters in ISO 14001

Audit evidence matters because audit findings should be based on facts, not feelings.

Without good evidence, audits become weak, inconsistent and easy to challenge.

Good audit evidence helps the auditor:

• confirm whether EMS requirements are being met;
• identify nonconformities fairly;
• avoid overreacting to isolated issues;
• avoid missing systemic problems;
• support clear audit reports;
• explain findings to auditees and management;
• show why corrective action is needed;
• give top management useful information about EMS performance.

A good audit finding should be traceable back to evidence. If an auditor cannot explain what evidence supports the finding, the finding is probably wobblier than a camping chair in a gale.

Types of audit evidence

ISO 14001 audits normally use several types of evidence.

Documented information

This includes procedures, records, registers, forms, reports, plans and electronic system records.

Examples include:

• aspect and impact registers;
• compliance obligation records;
• environmental objectives and action plans;
• training and competence records;
• communication records;
• operational procedures;
• inspection records;
• waste transfer records;
• monitoring data;
• internal audit reports;
• management review records;
• nonconformity and corrective action records.

Interview evidence

Interviews help the auditor understand what people know, what they do, and whether the EMS works in practice.

Interview evidence may come from:

• top management;
• EMS or QHSE managers;
• process owners;
• operators;
• supervisors;
• contractors;
• internal auditors;
• people responsible for compliance, maintenance, waste, purchasing or emergency response.

Observation evidence

Observation evidence comes from what the auditor sees.

Examples include:

• chemical storage conditions;
• spill-kit availability;
• waste segregation;
• emergency equipment location;
• drain protection;
• contractor activities;
• signage and labelling;
• actual working practices;
• housekeeping and containment;
• use of operational controls.

Data and performance evidence

Data helps the auditor evaluate environmental performance and whether the EMS is producing useful results.

Examples include:

• energy use;
• water use;
• waste volumes;
• recycling rates;
• fuel use;
• emissions or discharge monitoring;
• incident trends;
• objective progress;
• audit findings trends;
• corrective action closure times.

Audit evidence should be relevant

Relevant evidence is evidence that relates directly to the audit criteria and audit scope.

For example, if the auditor is checking emergency preparedness and response, relevant evidence may include:

• identified potential emergency situations;
• emergency response plans;
• spill-kit checks;
• drill records;
• training records;
• incident records;
• interviews with people expected to respond;
• observations of emergency equipment and access routes.

An impressive spreadsheet about something unrelated is still unrelated. Audit evidence needs to answer the audit question being asked.

Audit evidence should be reliable

Reliable evidence is evidence the auditor can reasonably trust.

Reliability may be affected by:

• who provided the evidence;
• whether the evidence is current;
• whether the evidence is complete;
• whether the evidence is consistent with other evidence;
• whether records are controlled;
• whether data has been checked, verified or approved;
• whether the auditor observed the activity directly;
• whether interview evidence is supported by records or observation.

One person saying “I think we do that” may be a useful lead. It is not always enough by itself to support a strong audit conclusion.

Audit evidence should be sufficient

Sufficient evidence means enough evidence to support the audit conclusion.

The auditor rarely checks everything. Instead, they sample.

The size and depth of the sample should depend on factors such as:

• environmental risk;
• significance of the aspect;
• compliance importance;
• previous audit findings;
• process complexity;
• number of sites, shifts, records or people involved;
• recent changes;
• whether evidence is consistent or contradictory.

A single record may be enough for a low-risk check. A repeated issue, high-risk process or compliance obligation may need a deeper sample.

Audit evidence and sampling

Auditors use sampling because it is normally impossible to check every record, interview every person or observe every activity.

Sampling may involve selecting:

• records from different dates;
• examples from different departments or sites;
• different shifts or teams;
• high-risk activities;
• recent changes;
• previous problem areas;
• contractor activities;
• evidence linked to significant environmental aspects or compliance obligations.

Sampling should be sensible and defensible. If the auditor finds a problem in one sample, they may need to widen the sample to understand whether it is isolated or systemic.

Following an audit trail

An audit trail is the path the auditor follows through evidence.

A strong audit trail often links several clauses together.

Good audit trails help students and auditors avoid treating ISO 14001 as disconnected clauses. The EMS should work as a system.

Audit evidence by ISO 14001 clause area

Different clauses call for different types of evidence. The table below gives practical examples.

Audit evidence for documented information

Documented information is one of the most common forms of audit evidence, but it should not be the only form.

Useful documented evidence may include:

• EMS scope;
• environmental policy;
• aspect and impact information;
• significance criteria;
• compliance obligations;
• risk and opportunity records;
• objective plans and progress updates;
• competence evidence;
• communication records;
• operational procedures and inspection records;
• emergency preparedness and response records;
• monitoring and measurement data;
• evaluation of compliance records;
• internal audit programme and results;
• management review results;
• nonconformity and corrective action records.

The auditor should check whether documented information is controlled, available where needed, suitable for use, and protected from unintended changes or loss.

Read the SQMC guide to documented information.

Audit evidence from interviews

Interviews are essential because they show whether people understand and apply the EMS.

Good interview questions are usually open and evidence-seeking.

For example:

• “What environmental controls apply to your work?”
• “What would you do if there was a spill?”
• “How do you know this inspection is due?”
• “What changed after the last incident?”
• “How are contractors made aware of site environmental rules?”
• “How do you know whether the objective is on track?”

Interview evidence is stronger when it is supported by observation or records. If three people describe the same process clearly, and the records and site conditions match, the evidence is much stronger than a lone “aye, probably”.

Audit evidence from observation

Observation is often where EMS audits come alive.

The auditor may look at:

• waste areas;
• chemical stores;
• bunds and containment;
• surface water drains;
• spill kits;
• emergency equipment;
• contractor activities;
• process controls;
• labelling and signage;
• storage conditions;
• housekeeping;
• actual work practices.

Observation helps verify whether procedures are actually being followed. A beautifully controlled document can say anything it likes; the yard tends to tell the truth.

Audit evidence and conformity

Evidence can support a finding that requirements are being met.

For example, conformity evidence might include:

• a relevant requirement has been identified;
• the organisation has planned how to meet it;
• people understand their responsibilities;
• controls are being implemented;
• records show the process is being followed;
• monitoring or review confirms the arrangement is working.

Good audits should recognise conformity as well as nonconformity. Conformity evidence helps the organisation understand what is working and where controls are effective.

Audit evidence and nonconformity

Evidence can also support a finding that a requirement is not being met.

A nonconformity should normally include:

• the requirement that was not met;
• the evidence showing it was not met;
• where and when the evidence was found;
• enough detail for the organisation to investigate and act.

A nonconformity should be written clearly and fairly. It should not be a personal attack, a vague complaint or an auditor’s pet preference wearing a fake moustache.

Read the SQMC guide to nonconformity and corrective action.

Evidence should support the wording of the finding

Audit findings should not overstate what the evidence proves.

For example, if the auditor checks one missing record, they should be careful about claiming that the whole system has failed unless wider evidence supports that conclusion.

More careful wording might be:

• “One sampled record was missing required information...”
• “Three of five sampled inspections were overdue...”
• “Operators interviewed were unable to explain the spill response procedure...”
• “No evidence was available to show that the March compliance evaluation had been completed...”

The evidence should be specific enough that the auditee can understand the issue and the organisation can investigate the cause.

Common weak audit evidence

Weak evidence can make audit findings unclear or unfair.

Common weak evidence includes:

• “I was told this happens” with no supporting records or observation;
• old records that do not reflect current practice;
• one isolated example used to make a sweeping conclusion;
• evidence outside the audit scope;
• evidence that does not relate to the audit criteria;
• vague statements such as “poor housekeeping” without examples;
• screenshots or photos with no context;
• unverified data used for major conclusions;
• failure to record where the evidence came from;
• opinions presented as facts.

Strong audit evidence examples

Stronger evidence is specific, relevant and traceable.

Audit evidence and objectivity

Auditors should evaluate evidence objectively.

This means:

• following evidence rather than assumptions;
• checking facts before drawing conclusions;
• being fair to the auditee;
• not turning preferences into requirements;
• recognising both conformity and nonconformity;
• being willing to change a view if new evidence appears;
• recording evidence clearly enough that another competent auditor could understand the basis of the finding.

Objectivity does not mean being cold or robotic. It means being fair, evidence-based and professional.

Audit evidence and documented information required by ISO 14001

ISO 14001 expects certain documented information to be available in different parts of the EMS. It also allows organisations to decide what additional documented information they need for EMS effectiveness.

Auditors should avoid assuming that every process needs a detailed procedure. Instead, they should ask whether enough documented information exists to support effective control and provide confidence that important processes are being carried out as planned.

In practice, the strongest audits do not ask only “is there a document?” They ask:

• Is the requirement understood?
• Is the process planned?
• Is it being followed?
• Is there evidence?
• Is the evidence reliable?
• Does the process achieve the intended result?

Audit evidence and management review

Management review is another important source of audit evidence.

Evidence may include:

• management review inputs;
• performance reports;
• objective progress updates;
• compliance status reports;
• audit results;
• communications from interested parties;
• resource decisions;
• management review results;
• actions and follow-up records.

Auditors should check whether management review is more than a meeting record. Good evidence shows what was reviewed, what was concluded, what decisions were made and what happened afterwards.

Read the SQMC guide to management review.

Audit evidence and corrective action

Corrective action evidence should show more than “done”.

Useful evidence may include:

• the nature of the nonconformity;
• the immediate correction or containment;
• how consequences were dealt with;
• cause analysis;
• consideration of whether similar issues exist or could occur elsewhere;
• the corrective action taken;
• evidence that action was completed;
• effectiveness review;
• changes made to the EMS where needed.

Corrective action evidence is especially important where the organisation claims the issue has been fixed. The auditor should check whether the fix actually addressed the problem.

Practical audit evidence checklist

When collecting audit evidence, auditors should ask:

• What requirement am I auditing?
• What evidence would show this requirement is being met?
• Is the evidence relevant to the audit criteria?
• Is the evidence current?
• Is the evidence reliable?
• Is the sample large enough for the level of risk?
• Does interview evidence match records and observations?
• Does the evidence show the process is implemented?
• Does the evidence show the process is effective?
• Have I recorded the evidence clearly?
• Does the finding fairly reflect what the evidence proves?

Weak example

Better example

Real-world example: auditing emergency preparedness

An auditor wants to check whether emergency preparedness arrangements are effective.

Useful evidence may include:

• identified potential emergency situations;
• emergency response plans;
• spill-kit inspection records;
• training records;
• drill records;
• incident records;
• observation of spill kits, drain covers and access routes;
• interviews with employees and contractors;
• evidence that drills or incidents led to review and improvement.

This gives a rounded view: records, observation, interviews and follow-up.

Real-world example: auditing compliance evaluation

An auditor wants to check whether compliance obligations are being evaluated.

Useful evidence may include:

• compliance obligation register;
• evaluation schedule or frequency;
• completed compliance evaluations;
• evidence used during evaluation;
• actions raised where gaps were identified;
• communications with regulators or other relevant parties;
• management review discussion of compliance status;
• follow-up evidence where action was needed.

A legal register alone is not enough. The auditor needs evidence that the organisation evaluates whether obligations are being fulfilled.

Real-world example: auditing competence

An auditor wants to check whether people doing work under the organisation’s control are competent.

Useful evidence may include:

• competence criteria for relevant roles;
• training records;
• experience or qualification evidence;
• contractor competence records;
• interviews with people doing the work;
• observation of work being carried out;
• evidence that competence actions were evaluated for effectiveness;
• records of retraining or briefing after incidents or changes.

A training certificate may be useful evidence, but it is not always enough by itself. Competence should be demonstrated in the way work is actually performed.

Auditor questions about audit evidence

• What audit criteria are being used?
• What evidence supports this finding?
• Is the evidence relevant to the requirement?
• Is the evidence reliable?
• Is the evidence sufficient for the conclusion?
• Was the sample appropriate for the risk and scope?
• Were records, interviews and observations consistent?
• Was contradictory evidence considered?
• Does the evidence show implementation?
• Does the evidence show effectiveness?
• Can the finding be traced back to a requirement?
• Is the finding written clearly enough for corrective action?

Related ISO 14001 clauses

• Clause 7.5 — Documented information
• Clause 8.1 — Operational planning and control
• Clause 8.2 — Emergency preparedness and response
• Clause 9.1 — Monitoring, measurement, analysis and evaluation
• Clause 9.1.2 — Evaluation of compliance
• Clause 9.2 — Internal audit
• Clause 9.3 — Management review
• Clause 10.2 — Nonconformity and corrective action

Continue learning

This page is part of SQMC’s ISO 14001:2026 guidance library for auditors, managers and QHSE professionals.

• Return to ISO 14001:2026 for Auditors
• Documented information explained
• Internal audit explained
• ISO 14001 audit programme template
• Management review explained
• Nonconformity and corrective action explained