Clause 9.2 of ISO 14001 asks an organisation to carry out internal audits at planned intervals. In plain English, this means the organisation must check whether its Environmental Management System conforms to requirements, is properly implemented, and is being maintained effectively.
Clause 9.2 is about using internal audit to test the EMS honestly and constructively.
Internal audits should provide information on whether the EMS:
The purpose is not to “catch people out”. The purpose is to provide useful, evidence-based information so the organisation can understand whether the EMS is working.
Internal audit is one of the EMS’s strongest checking tools.
It helps the organisation identify:
A good internal audit programme helps the organisation find issues before customers, regulators or certification auditors do. Much cheaper. Much less sweaty.
ISO 14001 expects the organisation to conduct internal audits at planned intervals.
The organisation should establish, implement and maintain an internal audit programme that includes:
The programme should consider the environmental importance of the processes concerned, changes affecting the organisation, and results of previous audits.
Clause 9.2.1 sets out the basic purpose of internal audit.
It asks whether the EMS conforms to:
It also asks whether the EMS is effectively implemented and maintained.
This means internal audit should not only check documents. It should test actual practice. Auditors should look for objective evidence that the EMS is working in real operations.
Clause 9.2.2 asks the organisation to establish, implement and maintain an internal audit programme.
An audit programme is the overall arrangement for internal audits over a period of time. It is not the same as an individual audit plan or checklist.
A good EMS audit programme should consider:
The programme should also consider environmental importance, changes affecting the organisation and previous audit results.
SQMC has prepared a practical ISO 14001 audit programme template to help organisations plan audits around ISO 14001 clauses, environmental aspects, compliance obligations, risk, operational importance and previous findings.
These terms are often confused, so it helps to separate them.
An audit programme is the overall schedule or system for audits over time.
An audit plan is the plan for a specific audit, including scope, criteria, timings, people and areas to visit.
An audit checklist is a working tool used during the audit to help gather evidence and structure questions.
The audit programme may say the warehouse will be audited in March. The audit plan says the March audit will cover waste segregation, chemical storage, contractor controls and Clause 8.1. The checklist contains the questions and evidence prompts the auditor will use during the audit.
A weak audit programme simply audits every clause once per year in the same order.
That may provide coverage, but it may not focus attention where the EMS needs it most.
A stronger audit programme considers:
Internal audit should help the organisation learn something useful. If the same checklist produces the same sleepy answers every year, the programme probably needs a strong coffee.
Each audit should have defined criteria and scope.
Audit criteria are the requirements the audit is checking against.
Criteria may include:
Audit scope defines the boundaries of the audit.
Scope may include:
Clear criteria and scope help prevent vague audits with vague findings.
Internal audits should use suitable methods to gather objective evidence.
Audit methods may include:
The method should suit the audit objective. For operational control, a site walkaround may be essential. For document control, a records review may be more appropriate. For competence and awareness, interviews can be invaluable.
ISO 14001 expects auditors to be selected and audits conducted in a way that ensures objectivity and impartiality.
In simple terms, auditors should not audit their own work where that would compromise independence.
Objectivity may be supported by:
Small organisations may have limited people available, so the approach should be practical. The key is to avoid marking your own homework and awarding yourself a gold star.
Internal auditors should be competent for the audits they carry out.
EMS internal auditors should understand:
Competence may be based on training, experience, supervised audits, mentoring, professional background or periodic review of audit performance.
Internal audit findings should be based on objective evidence.
Evidence may include:
Good auditors do not rely on opinion alone. They link findings to evidence and criteria.
Audit findings should clearly explain what was found and why it matters.
A strong nonconformity statement usually includes:
Requirement: spill kits are inspected monthly. Evidence: no inspection records were available for March or April for the loading bay spill kit. Gap: the required monthly inspections were not evidenced for that period.
Findings should be factual, clear and proportionate. The aim is to support correction and improvement, not to write dramatic prose.
Internal audit results should be reported to relevant management.
Audit reports may include:
The report should be useful to the people who need to act on the findings.
Internal audit does not end when the report is issued.
Where nonconformities or significant weaknesses are identified, the organisation should take appropriate action.
Follow-up may include:
Repeated findings are a useful warning sign. They may suggest that corrective action is treating symptoms rather than causes.
The organisation should retain documented information as evidence of the audit programme and audit results.
Evidence may include:
Records should be clear enough to show that audits were planned, conducted, reported and followed up.
A practical internal audit process should answer:
Internal audit should be planned enough to be reliable, but flexible enough to follow evidence when something interesting appears.
Auditors look for evidence that internal audits are planned, risk-based, objective, competent, reported and followed up.
Evidence may include:
Review the audit programme first, then sample an audit report. Check whether the audit was carried out as planned, whether evidence supports the findings, whether results were reported, and whether actions were completed and verified.
“The organisation audits all ISO 14001 clauses once per year using a standard checklist.”
This is weak if the programme does not consider environmental importance, previous results, changes, risks, operational processes or whether the audit method is suitable.
“The organisation maintains a risk-based EMS audit programme. High-priority audits focus on significant aspects, compliance obligations, operational controls, contractor activity and previous findings. Audit scope, criteria and methods are defined for each audit. Findings are reported to relevant managers and corrective actions are tracked to completion.”
This is stronger because it shows internal audit being planned and used as a meaningful EMS evaluation tool.
A warehouse and distribution company identifies fuel use, waste segregation, packaging waste, chemical storage and contractor activity as important EMS issues.
Its internal audit programme may include:
An auditor could test whether the programme reflects environmental importance and whether audit results have led to real improvements.
An office-based organisation may have a simpler audit programme, but Clause 9.2 still applies.
Its internal audits may cover:
The programme should still consider significance, previous findings and changes, even where the EMS is relatively low-risk.
This page is part of SQMC’s ISO 14001:2026 guidance library for auditors, managers and QHSE professionals.
SQMC’s ISO 14001 Internal Auditor course helps you move from understanding the Standard to auditing it with confidence. Over two practical days, you’ll learn how to plan EMS audits, gather evidence, ask better questions, write nonconformities and report findings clearly.
Learn from anywhere in our Virtual Classroom, attend one of our training centres, or arrange private in-company training for your team.
Find out more and get qualified!