CQI/IRCA EMS Lead Auditor cheat sheet

ISO 14001:2015 is structured in clauses 4–10: Context of the organization, Leadership, Planning, Support, Operation, Performance evaluation and Improvement.

Clause 6.1.2 requires determination of environmental aspects and associated impacts from a life cycle perspective, limited to those the organization can control or influence.

Clause 4.3: the scope of the EMS must be maintained as documented information and be available to interested parties.

Clause 6.1.3: compliance obligations comprise legal requirements plus other requirements the organization subscribes to or chooses to comply with.

Clause 8.1: outsourced processes must be controlled or influenced; outsourcing never transfers responsibility for conformity with the EMS requirements.

Clause 9.1.1: measuring and monitoring equipment must be calibrated or verified, with evidence retained as documented information.

Clause 9.1.2: the organization determines the frequency of its evaluation of compliance; results are retained as documented information.

Clause 10.2 sequence: react to the nonconformity, evaluate the need for action, determine causes, implement action, review effectiveness, and update risks and opportunities from 6.1 if necessary.

ISO 14001:2015 requires no management representative and no mandatory documented procedures; only 'documented information' where the standard specifies it.

ISO 19011:2018 defines seven audit principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach.

An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria.

Audit types by relationship: first party (internal), second party (by an interested party such as a customer or supplier), third party (independent certification or regulatory body).

Audit programme management follows PDCA: establish (5.2), implement (5.3), monitor (5.4), review (5.5) and improve (5.6).

Establishing the programme considers organizational objectives, significant environmental aspects, compliance obligations, maturity, interested-party needs, risk and results of previous audits.

An audit programme is the set of arrangements covering a time frame; an audit plan is the description of activities and arrangements for one audit.

The risk-based approach allocates audit frequency, duration, sampling and resourcing in proportion to risk and importance of the process.

Records of the audit programme are retained to demonstrate implementation, including audit plans, reports and auditor competence evidence.

Objectives state what the audit is to accomplish; scope states the boundaries (locations, units, functions, processes, time period); criteria state the requirements used as reference.

The audit plan contains objectives, scope, criteria, dates and locations, expected time and duration, team roles, and report distribution and confidentiality arrangements.

The audit plan is agreed with the client and communicated to auditees; any change occurring during the audit is recorded.

Initial certification is two-stage: stage 1 evaluates readiness and documented information; stage 2 evaluates implementation and effectiveness.

Pre-audit document review checks conformity of documented information and identifies areas needing closer sampling; it does not close a nonconformity without verification of implementation.

Working documents include checklists, sampling plans, finding forms and copies of criteria; they support evidence gathering and are not evidence in themselves.

Sampling covers a vertical dimension (criteria down to records) and a horizontal dimension (process-based), and should span shifts, sites and outsourced activities.

The opening meeting confirms scope, criteria, schedule, methods, confidentiality, safety arrangements and channels of communication.

Evidence sources are interviews, observation of activities and conditions, and review of documents and records; two or three corroborating sources give a defensible finding.

Open questions elicit description and explanation; leading and closed yes/no questions are avoided when establishing facts.

Sample size increases with risk, complexity, number of nonconformities already found, poor performance history and criticality of the activity.

Finding categories are conformity, nonconformity (major or minor), observation/opportunity for improvement, and good practice.

The audit trail runs criteria → evidence → finding → conclusion, and must allow an independent person to retrace the auditor's reasoning.

An auditor verifies effectiveness of a control (does it work in practice) rather than existence only (is it documented).

Findings record the requirement reference, the objective evidence and the location or process, and are reviewed with the auditee before the closing meeting.

Team consensus is reached before findings are finalized; unresolved disagreement is recorded and reported.

Nonconformity is non-fulfilment of a requirement. Major: systemic failure, missing required element, significant environmental risk or legal breach. Minor: isolated lapse within a functioning control.

Several minor nonconformities in the same area may be aggregated into a major where together they indicate systemic failure.

Observations and opportunities for improvement are not nonconformities; they do not require corrective action, although the auditee may act on them.

A nonconformity report states the requirement, the evidence, the finding statement, and the auditee's correction, root cause and corrective action.

Corrective action = correction + root cause analysis + action on the cause + review of effectiveness; the audit team verifies implementation and effectiveness at follow-up.

The audit report contains objectives, scope, criteria, dates and locations, team, findings, conclusions, and a statement on the extent of conformity and audit confidence.

Report limitations, such as sampling-based evidence, must be stated so readers do not over-interpret the conclusions.

Certification is a decision of the certification body following satisfactory closure of nonconformities; the audit team only recommends.

Competence is the ability to apply knowledge and skills to achieve intended results, evaluated through education, training, experience and observed audit performance.

EMS auditor knowledge domains: environmental science and technology, environmental aspects and impacts, legal and other requirements, monitoring and measurement techniques, and EMS standards.

Ethical requirements are integrity, fair presentation, due professional care, confidentiality, independence and objectivity; conflicts of interest are declared.

An auditor does not audit their own work, and personnel who provided consultancy to a client cannot audit that client within the certification body's defined impartiality period.

Audit team leader duties: prepare the audit plan, assign tasks, brief and manage the team, liaise with client and auditee, resolve conflicts, and approve the report.

Communication techniques include active listening, paraphrasing, summarizing, and adapting technical language to the auditee's background.

Competence is maintained through continual professional development, with records of training and audit experience retained.

Auditor evaluation methods are records review, feedback from auditees and peers, interviews, observation and testing.

ISO/IEC 17021-1 sets requirements for bodies auditing and certifying management systems, covering impartiality, competence, and the audit and certification process.

Accreditation is formal recognition of a certification body by an accreditation body (e.g. UKAS, ANAB, DAkkS); IAF multilateral agreements give international recognition.

Certification follows a three-year cycle: initial certification audit, surveillance audits at least once a year, and recertification before the certificate expires.

IAF MD 5 determines EMS audit duration from number of personnel and complexity; IAF MD 1 covers multi-site sampling.

The certification decision is made by a competent person not involved in the audit, based on the audit report and other relevant information.

Certificates may be suspended, withdrawn or scope-reduced for failure to maintain conformity or to permit surveillance.

Typical regulatory compliance obligations audited: environmental permits and consents, waste duty of care, emission and discharge limits, and statutory reporting.

Stage 1 and stage 2 audits are mandatory for initial certification; the stage 1 outcome determines readiness to proceed to stage 2.