ISO 14001 Internal Audit Checklist: 43 Questions Organized by Clause

ISO 14001 Internal Audit Checklist: What Auditors Actually Ask

An ISO 14001 Internal Audit is only as good as the questions on it. A generic checklist item that says "verify environmental aspects are identified" tells you nothing about what to actually look for. The questions that surface real findings are specific, and they are different for every clause of the standard. This checklist gives you the actual audit questions, organized by clause, that assess whether your Environmental Management System is genuinely working or just documented well enough to look like it is.

Each clause also lists a common finding: the gap to check for before an external auditor finds it. For the process side of Internal Audits, scheduling, sampling, and what to expect, see our guide to ISO 14001 Internal Audits; for the standard itself and how we implement it with clients, see ISO 14001 consulting services.

How to Use This Checklist

You do not need to ask every question in a single audit session. ISO 14001 lets you split the Internal Audit program across multiple sessions throughout the year, covering the full scope over time. What matters is that nothing gets permanently overlooked. For each clause, ask for evidence rather than a yes: a record, a walked process, or an employee explaining their environmental responsibilities in their own words.

Clause 4: Context of the Organization

1. Have internal and external issues relevant to the EMS been identified, documented, and reviewed periodically?

2. Have interested parties and their environmental expectations been identified?

3. Is the EMS scope documented, current, and an accurate reflection of what the organization does and where it operates?

4. Are exclusions from scope justified in writing and defensible to an auditor?

5. Does the scope account for a life cycle perspective where relevant?

Common finding: the scope was written during initial implementation and never revisited. Check the scope statement against today's sites and activities, including any locations added since initial certification. The standard requires the scope to be maintained as documented information, which means it needs to track current reality.

Clause 5: Leadership

6. Can Top Management articulate commitment to the EMS beyond reading the Environmental Policy?

7. Is the Environmental Policy documented, signed, dated, and communicated?

8. Does the policy include commitments to protection of the environment, compliance obligations, and Continual Improvement?

9. Are roles, responsibilities, and authorities for the EMS defined and communicated?

10. Is there evidence that management provides the resources the EMS needs to function?

Common finding: the policy exists and is posted, and nobody outside the EMS coordinator can describe what it says. At multi-site organizations, confirm that site management knows the corporate EHS policy exists; a policy published only on the parent company's website can go unseen at the sites it governs. External auditors ask random employees about the policy; personnel do not need to memorize it, but they should know it exists and how their role connects to it. Policies signed by a previous executive and never re-communicated after leadership changes are the version of this finding that recurs.

Clause 6: Planning

11. Is there a documented process for identifying environmental aspects and determining significance?

12. Does the Aspect Register reflect current operations, or the operations at the time of the last certification?

13. Have new processes, chemicals, and waste streams since the last review been added to the register?

14. Are compliance obligations identified, tracked, and current?

15. Are Environmental Objectives measurable and linked to significant aspects?

16. Do objectives have action plans with defined resources, responsibilities, and timeframes?

17. Is there evidence of progress toward the objectives?

Common finding: the Aspect Register was created during implementation and has not been updated since. Check that every process added since the last review appears in the register, such as a new coating line that emits volatile organic compounds. Operations change constantly: new equipment, modified processes, new chemicals, shifted waste streams. A stale register is an easy target for any external auditor.

A related pattern: air permits lag behind installed equipment. Check every unit in service against the air quality permit, including equipment installed after the permit was issued. The audit question is to reconcile the fixed asset list and recent capital projects against the compliance obligations register, line by line.

Clause 7: Support

18. Are resources adequate for the EMS to function?

19. Is competence defined for personnel whose work affects environmental performance?

20. Are training records available for environmentally significant roles?

21. Do records demonstrate role-specific competence, or only generic awareness?

22. Can personnel explain the significant aspects relevant to their own work?

23. Is there a process for internal and external communication on environmental matters?

24. Is documented information controlled, with obsolete versions removed or marked?

Common finding: training records show generic environmental awareness with no connection to the aspects and impacts of each role. The standard separates awareness (Clause 7.3) from competence (Clause 7.2). A warehouse worker handling hazardous materials needs demonstrably different training from an office administrator, and slides covering the policy and the recycling bins do not demonstrate competence for chemical handling, waste management, or emergency response.

Clause 8: Operation

25. Are operational controls in place for processes associated with significant environmental aspects?

26. Do the controls function as described? Walk the floor: spill kits stocked, containment intact, labeling current, waste segregation followed.

27. Are procurement and outsourced processes controlled where they can affect environmental performance?

28. Has a life cycle perspective been considered for products and services, from raw materials through end-of-life?

29. Are emergency preparedness procedures documented for environmental emergencies?

30. When was the last drill, and are the records available?

31. Were lessons from drills and incidents incorporated back into the procedures?

Common finding: emergency preparedness exists on paper and drills are inconsistent. This is where the gap between documentation and practice is widest. Ask for drill records for every year in the certification cycle, not only the most recent one. Open the spill kits rather than counting them: a kit can look complete on the floor after its supplies were taken to restock kits sent to job sites, with no record of what remains. A kit that looks ready and is not is worse than no kit, because nobody checks a kit that looks ready. Tamper seals, replenishment logs, and a physical walk of the floor are what verify this clause, not the procedure document.

Clause 9: Performance Evaluation

32. Are the key characteristics of operations with significant environmental impact monitored and measured?

33. Are monitoring methods defined, and is equipment calibrated where applicable?

34. Is compliance evaluated at planned intervals, and are the results documented with evidence?

35. Has the Internal Audit program covered the full EMS scope at planned intervals?

36. Have audit findings been addressed with appropriate actions?

37. Has Management Review been conducted at planned intervals with all required inputs?

38. Are Management Review outputs documented with decisions and actions?

Common finding: compliance evaluation is a single word, "compliant," with no evidence of how the determination was made. The depth of evidence needs to match the significance of the obligation: permit conditions checked against actual monitoring data, waste manifests reconciled against disposal facility receipts, emission monitoring confirmed at the required frequency. The standard requires the organization to evaluate compliance and retain records of the results; a checkbox is not a record of an evaluation.

Clause 10: Improvement

39. Is there a process for identifying and addressing Nonconformities?

40. Are corrections applied and controlled when Nonconformities are found?

41. Is Root Cause analysis performed, or does every investigation stop at the immediate cause?

42. Are Corrective Actions implemented and verified for effectiveness?

43. Is there evidence of Continual Improvement, and is the improvement log used between audits?

Common finding: the improvement log has entries and the Root Cause analysis is missing or superficial. "Employee didn't follow procedure" is not a Root Cause; it is a description of what happened. The investigation that matters asks why the procedure was not followed: inadequate training, an unclear or impractical procedure, or a requirement the employee never knew existed. Depth should be proportionate to the Nonconformity, but even minor issues need an explanation of why they occurred.

Red Flags That Signal Deeper Issues

Everything was updated the week before the audit. Document dates that cluster around the audit date are visible to the auditor, and an EMS that only gets attention at audit time is not effectively implemented.

Only one person can answer questions about the EMS. If every question gets redirected to the EMS coordinator, the system belongs to one person rather than the organization.

Documentation does not match reality. The procedure says waste is segregated into four categories and the floor has two bins. The procedure says spill kits are inspected monthly and the last inspection record is six months old. These disconnects carry the most weight in any audit.

Zero entries in the improvement log. No organization is perfect. An empty log does not mean there are no issues; it means the system for identifying them is not working.

Objectives with no evidence of progress. Documenting "reduce waste by 10%" with no data on current waste volumes, no action plan, and no monitoring tells the auditor the objectives are aspirational rather than operational.

Making the Checklist Work for You

Do not just check boxes; ask for evidence. If the answer to "are emergency drills conducted?" is yes, follow up with the records and read what they contain: date, participants, scenario, outcomes, lessons learned. Talk to people at different levels, because the operations supervisor's understanding of environmental controls often differs from what the procedure describes. Walk the facility, because physical verification takes minutes and reveals what document review cannot. And focus on the system rather than individual mistakes: one mislabeled drum is a correction, while inconsistent labeling across the facility is a systemic finding.

For a self-assessment before your audit, the free ISO 14001 gap analysis tool scores your EMS against the clause structure above. If you want an experienced outside auditor for your Internal Audit program, or help turning findings into improvements, our ISO 14001 consultants offer a free initial consultation.