Preparing for Your ISO 14001 Internal Audit (Free Clauses 4-10 Checklist)
Here is the part most articles make you trade an email address for: the complete, ungated ISO 14001 internal audit checklist for clauses 4 through 10, with the audit question and the evidence to show for every requirement. It is further down this page as a single table you can read, copy, or print. No form, no download wall. I built it from the clause-by-clause requirements of the 2026 edition, and I have flagged the questions that are new or reworded for 2026 so you do not audit the old standard by accident.
A quick orientation before the table. An internal audit checks whether your environmental management system (EMS) actually meets the requirements of ISO 14001 and your own rules, and whether it is working in practice. Under clause 9.2 you have to run one at planned intervals. It is also the gate before any external assessment: a certification body will expect to see a completed internal audit and a management review before it certifies you, and the same applies if you are moving to the 2026 edition. ISO 14001:2026 was published on 15 April 2026; certification bodies stop issuing new certificates to the 2015 edition on 31 October 2027, and all 2015 certificates must have migrated by 30 April 2029. So if you are transitioning, the internal audit you prepare with this checklist is the one that proves you are ready.
In my consulting work, the single biggest reason an internal audit adds no value is that it never decided what it was for. People photocopy a checklist, walk the floor, tick boxes, and file the report. That is not an audit, it is a tour. Let me give you the framing that turns this list into a real audit, then the full table, then how to close what you find. If you want the underlying requirements in narrative form, our ISO 14001:2026 requirements guide walks through every clause; this page is the operational audit companion to it.
How to run the internal audit before you open the checklist
Clause 9.2.2 asks you to define three things for each audit, and in the 2026 edition this is explicit: the objectives, the criteria, and the scope. The objectives are new wording you should not skip. Criteria are what you audit against (ISO 14001:2026, your procedures, your permits). Scope is what you cover this time (which sites, which processes, which clauses). Objectives are why you are doing this particular audit, for example “confirm the EMS is ready for the 2026 transition audit” or “verify operational controls at the coating line after last year’s spill”. Write all three at the top of your audit plan. An auditor who knows the objective asks sharper questions.
The internal audit is the “Check” in Plan-Do-Check-Act. You are not redesigning the EMS, you are gathering objective evidence and comparing it against the criteria. For each line in the checklist below, the job is the same: ask the question, look for the evidence, and record what you saw, not what you were told. “We have a procedure” is a claim. The procedure, dated and approved, with records showing it was followed, is evidence. Where most internal audits get this wrong is interviewing instead of sampling. Pull three real records, not one. Trace one significant aspect from the register all the way to an operational control and a monitoring result.
When the evidence does not meet the requirement, raise a nonconformity. Clause 10.2 is your method for handling it: react to the nonconformity and correct it, evaluate whether you need to act on the cause so it does not recur, take corrective action, review whether that action worked, and keep documented information on the nonconformity and what you did. A finding is not closed when you write the corrective action; it is closed when you have evidence the action was effective. Grade findings honestly. A major nonconformity is a clause requirement that is missing or has broken down; a minor is a lapse against a requirement that is otherwise in place; an opportunity for improvement is neither, so do not pad your report with them to look thorough.
How to use the checklist below
The table is organized by clause, 4.1 through 10.2, in three columns: the clause, the audit question to ask, and the evidence to look for. Work through it in order, or jump to the chapter you are auditing this round. I have marked the questions that are new or changed for the 2026 edition with [2026] so you give them extra attention, since these are exactly where an external auditor will probe and where 2015-era checklists fall silent. Three areas carry most of the change: climate and the broadened environmental conditions in clause 4, the reorganized planning clause 6 (a dedicated risks-and-opportunities sub-clause at 6.1.4 and a brand-new change-management clause at 6.3), and the wording shifts in clauses 8 and 9. For the full transition picture and dated plan, see our ISO 14001:2026 implementation guide.
The complete ISO 14001 internal audit checklist: clauses 4 to 10
| Clause | Audit question | Evidence to show |
|---|---|---|
| Clause 4 – Context of the organization | ||
| 4.1 | Have you determined the external and internal issues relevant to the purpose of the EMS and to your ability to achieve its intended outcomes? | Documented context analysis (PESTEL or SWOT) tied to the EMS purpose. |
| 4.1 [2026] | Do those issues explicitly include the environmental conditions affecting or affected by the organization, namely pollution levels, availability of natural resources, climate change, biodiversity and ecosystem health (or a documented judgement that one is not material)? | Context analysis covering the named environmental conditions, with a recorded materiality judgement for each. |
| 4.2 | Have you determined the interested parties relevant to the EMS, their relevant needs and expectations, and which of these become compliance obligations addressed through the EMS? | Interested-party map; needs-and-expectations matrix; compliance obligations register. |
| 4.2 [2026] | Does the expectations matrix capture environmental expectations of interested parties linked to those conditions (climate, pollution, resources, biodiversity)? | Expectations matrix showing environmental topics and the check on whether each became a compliance obligation. |
| 4.3 | Is the scope of the EMS determined from the issues, compliance obligations, units and functions, physical boundaries, activities/products/services, and your authority and ability to control and influence across the life cycle? | Documented scope statement, dated and current. |
| 4.3 | Is the scope kept as documented information and made available to interested parties, with all activities inside the boundary included in the EMS? | Published, available scope statement; evidence all in-boundary activities are covered. |
| 4.4 | Have you established, implemented, maintained and continually improved the EMS and its processes and their interactions, taking account of the knowledge gained from context (4.1) and interested parties (4.2)? | EMS process map; record of context review feeding the EMS. |
| Clause 5 – Leadership | ||
| 5.1 | Does top management take accountability for the effectiveness of the EMS, ensure policy and objectives fit the strategic direction, integrate EMS requirements into business processes, provide resources, and ensure intended outcomes are achieved? | Management review minutes; approved policy and objectives; allocated EMS budget; environmental dashboard. |
| 5.1.i [2026] | Does top management demonstrate personal involvement beyond a signed policy, and support other relevant roles so they can show leadership in their areas of responsibility? | Evidence of management involvement; mission or responsibility letters for managers. |
| 5.2 | Is there an environmental policy appropriate to the context that provides a framework for objectives and commits to protection of the environment, satisfying compliance obligations, and continual improvement? | Signed environmental policy. |
| 5.2 [2026] | Where relevant to your context, does the policy reflect the broadened specific commitments, for example conservation of resources, climate, biodiversity and ecosystems, and is it communicated and available to interested parties? | Policy text with the relevant commitments; proof of distribution and availability. |
| 5.3 | Are responsibilities and authorities for relevant roles assigned and communicated, including responsibility for EMS conformity and for reporting EMS performance to top management? | Organization chart; job descriptions; EMS RACI matrix. |
| Clause 6 – Planning | ||
| 6.1.1 [2026] | Do you have the planning process(es) needed to meet 6.1.2 to 6.1.5, reorganized so that determination of risks and opportunities now sits in 6.1.4 rather than inside 6.1.1? | Updated planning procedure with corrected internal cross-references. |
| 6.1.2 | Have you determined the environmental aspects you can control or influence and their impacts, considering a life cycle perspective, taking into account normal and abnormal conditions, change, and potential emergency situations? | Environmental analysis; aspects register covering normal, abnormal and emergency conditions. |
| 6.1.2 [2026] | Is the determination of potential emergency situations anchored here in 6.1.2, and does the aspects analysis link change to the change-management clause (6.3)? | List of potential emergency situations established in 6.1.2; procedure referencing 6.3 for changes. |
| 6.1.2 | Have you determined which aspects have or can have a significant environmental impact using established criteria, communicated them, and kept the aspects, criteria and significant aspects as documented information? | Significance criteria; register of significant aspects; evidence they were communicated. |
| 6.1.3 | Have you determined and have access to the compliance obligations related to your aspects, determined how they apply, and taken them into account in the EMS? | Legal and other requirements watch; compliance obligations register with applicability. |
| 6.1.4 [2026] | Do risks and opportunities have their own dedicated sub-clause and register at 6.1.4, covering aspects, compliance obligations and the issues from 4.1/4.2/4.3, including the potential for external environmental conditions to affect the organization? | Dedicated risks-and-opportunities register referenced 6.1.4, kept as documented information. |
| 6.1.5 [2026] | Have you planned actions to address significant aspects, compliance obligations and risks and opportunities, planned their integration into EMS or business processes, and how to evaluate effectiveness (note the renumbering from 6.1.4 in 2015)? | Environmental action plan with effectiveness indicators; internal references updated to 6.1.5. |
| 6.2.1 | Are environmental objectives set at relevant functions and levels, consistent with the policy, measurable if practicable, monitored, communicated, updated, and kept as documented information? | Documented table of environmental objectives. |
| 6.2.2 | For each objective, have you determined what will be done, the resources, who is responsible, when it is completed, and how results will be evaluated including indicators? | Action plan with resources, owners, deadlines and monitoring indicators. |
| 6.3 [2026] | For this brand-new clause, when a need for change that affects the EMS is determined, do you carry the change out in a planned manner and manage it so the EMS keeps achieving its intended outcomes? | Change-management procedure; change-evaluation records covering purpose, consequences, resources and responsibilities. |
| Clause 7 – Support | ||
| 7.1 | Have you determined and provided the resources needed to establish, implement, maintain and continually improve the EMS? | Resource plan or EMS budget. |
| 7.2 | Have you determined the competence needed for people whose work affects environmental performance and your ability to meet compliance obligations, ensured they are competent, determined training needs, acted, and kept evidence of competence? | Competence matrix; training plan; certificates or qualification records; effectiveness evaluations. |
| 7.3 | Are people working under your control aware of the policy, the significant aspects and impacts related to their work, their contribution to EMS effectiveness, and the implications of not conforming? | Awareness material and attendance or briefing records. |
| 7.4 | Do you have internal and external communication process(es) defining what, when, with whom and how to communicate, taking account of compliance obligations, with internal communication enabling people to contribute to continual improvement? | Communication plan; record of internal and external communications. |
| 7.5 | Does the EMS include the documented information required by the standard and what you judge necessary, with controlled creation, updating, identification, format, review, approval, distribution, access, storage, change control and retention, including documents of external origin? | Master document list; document control procedure and filing plan. |
| Clause 8 – Operation | ||
| 8.1 | Have you established and controlled the operational processes needed to meet EMS requirements and implement the clause 6 actions, with operating criteria, control of planned changes, and review of the consequences of unintended changes? | Operational procedures with operating criteria; operating records. |
| 8.1 [2026] | Do you control or influence externally provided processes, products and services relevant to the EMS, with the type and extent of control defined (the 2026 wording broadens the old “outsourced processes” to the wider supply chain)? | Supplier requirements and evaluations; defined control over externally provided processes, products and services. |
| 8.1 | Consistent with a life cycle perspective, do you address environmental requirements in design and development, in procurement, in communications to external providers including contractors, and in information on transport, use, end-of-life and disposal? | Design environmental requirements; purchasing criteria; contractual environmental clauses; product information or instructions. |
| 8.2 | Do you have processes to prepare for and respond to the potential emergency situations determined in 6.1.2, including planned response actions, periodic testing where practicable, review after tests and incidents, and relevant information and training? | Emergency response procedures; drill records; post-incident or post-drill reviews; emergency training records. |
| 8.2 [2026] | Does the emergency cross-reference now point to 6.1.2 (it pointed to 6.1.1 in 2015)? | Emergency plan citing emergency situations determined in 6.1.2. |
| Clause 9 – Performance evaluation | ||
| 9.1.1 | Have you determined what to monitor and measure, the methods, the criteria and indicators for environmental performance, when to monitor and evaluate, used calibrated equipment, and kept evidence of results? | Monitoring plan; performance indicators; calibration plan; performance dashboard or reports. |
| 9.1.2 | Have you established a process to evaluate compliance, determined its frequency, evaluated compliance, taken action where needed, and maintained knowledge and understanding of your compliance status? | Compliance evaluation procedure and results; compliance status register. |
| 9.2.1 | Are internal audits conducted at planned intervals to determine whether the EMS conforms to your own requirements and to the standard, and whether it is effectively implemented and maintained? | Internal audit reports. |
| 9.2.2 [2026] | Does the audit programme exist and consider the environmental importance of processes, changes and prior results, and does each audit plan now define audit objectives, in addition to criteria and scope? | Audit programme; audit plans with an explicit objectives field alongside criteria and scope. |
| 9.2.2 | Are auditors selected to ensure objectivity and impartiality, results reported to relevant management, and documented information retained on the programme, its implementation and the results? | Auditor assignment showing independence; audit reports to management. |
| 9.3.1 [2026] | Does top management review the EMS at planned intervals to ensure it remains suitable, adequate and effective (management review is now split into 9.3.1 general, 9.3.2 inputs, 9.3.3 results)? | Management review schedule; review structured to the three sub-clauses. |
| 9.3.2 | Do the review inputs cover the status of prior actions, changes in issues, expectations and obligations, significant aspects and risks and opportunities, objective achievement, performance (nonconformities and corrective actions, monitoring, compliance, audits), adequacy of resources, communications and complaints, and improvement opportunities? | Management review input pack covering all required inputs. |
| 9.3.3 | Do the review results record conclusions on continuing suitability, adequacy and effectiveness, decisions on improvement, any change to the EMS including resources, actions where objectives were not met, and are they kept as documented information? | Management review minutes recording the required outputs. |
| Clause 10 – Improvement | ||
| 10.1 [2026] | Do you determine opportunities for improvement from clause 9 and 10.2 and continually improve the suitability, adequacy and effectiveness of the EMS (2015 clauses 10.1 General and 10.3 Continual improvement are merged into this new 10.1)? | Continual improvement plan and indicators; internal references updated. |
| 10.2 | When a nonconformity occurs, do you react to control and correct it and deal with the consequences including mitigating environmental impacts, then evaluate the need to act on the cause to prevent recurrence? | Nonconformity records; cause analysis. |
| 10.2 | Do you implement the corrective action needed, review its effectiveness, change the EMS if necessary, keep actions proportionate to the effects, and retain documented information on the nature of nonconformities, the actions taken and their results? | Corrective action records; effectiveness review; nonconformity and corrective action register. |
After the audit: closing findings and feeding the certification audit
The audit report is the start of the work, not the end. For every nonconformity, run the 10.2 loop properly. Correct the immediate problem, then ask whether the cause needs addressing so it does not recur, and check whether the same gap exists elsewhere. A missing audit-objectives field on one site’s audit plan is rarely a one-site problem; it usually means the template is wrong everywhere. Take the corrective action, then go back and verify it worked before you close the finding. Keep the records: the nature of the nonconformity, what you did, and the result. That paper trail is exactly what an external auditor samples.
Sequence matters. Run the internal audit, hold the management review with its 9.3.2 inputs and 9.3.3 results, then schedule the external assessment, not the other way around. A certification body will expect a completed internal audit and management review on the table before it recommends certification, and the same holds for the transition to the 2026 edition. Use this checklist as the dry run. If you can answer every question with real evidence, in particular the lines marked [2026], you are ready for the external auditor to ask the same things in a harder voice.
Where the checklist exposes missing documents, you do not have to build every register, procedure and record from a blank page. Our ISO 14001:2026 Documentation Kit gives you editable versions of the evidence in the right-hand column, including the dedicated 6.1.4 risks-and-opportunities register and the new 6.3 change-management procedure, so you close the gaps the audit found instead of starting over.
Frequently asked questions
One last piece of advice from years of sitting on both sides of the audit table. The organizations that breeze through certification are not the ones with the thickest manuals. They are the ones whose people can show you the evidence without hunting for it, because the EMS is how they actually work. Use this checklist honestly. Where you cannot produce the evidence today, that is not a failure, it is your action list. Work it down, close the findings, and the external audit becomes a confirmation rather than a verdict.
