Exemplar Global EMS Lead Auditor cheat sheet

ISO 14001 follows the Plan-Do-Check-Act cycle: Plan = aspects, compliance obligations, risks and objectives (clauses 6); Do = support and operation (7-8); Check = monitoring, internal audit, management review (9); Act = improvement (10).

The standard is built on three core concepts: protecting the environment, fulfilling compliance obligations, and continual improvement of the environmental management system to enhance environmental performance.

Context of the organization (clause 4) requires determining external and internal issues, interested parties, and the scope of the EMS; the scope must be documented and available to interested parties.

Leadership (clause 5) requires top management to be accountable for EMS effectiveness, integrate EMS requirements into business processes, and ensure resources; a management representative is no longer mandated.

Clause 6.1.2 requires determining environmental aspects and associated impacts from a life-cycle perspective, including changes, abnormal conditions and reasonably foreseeable emergencies.

Clause 6.1.3 requires determining compliance obligations and other requirements, and evaluating how they apply; documented information of obligations and evaluation is required.

Clause 6.2 requires environmental objectives at relevant functions and levels, consistent with policy, measurable where practicable, monitored, and communicated.

Clause 8.1 requires operational planning and control using operating criteria, and control of outsourced processes; clause 8.2 requires emergency preparedness and response with planned responses and testing where practicable.

Clause 9.1 requires monitoring, measurement, analysis and evaluation with documented evidence of results, plus evaluation of compliance and use of calibrated or verified equipment.

Seven audit principles per ISO 19011: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach.

Audit types by subject: system audit, process audit, product audit; by relationship: first-party (internal), second-party (supplier/customer), third-party (certification, accreditation, regulatory).

Audit objectives define what the audit is meant to achieve (e.g., conformity, effectiveness, certification); audit criteria are the set of requirements used as a reference; audit scope is the extent and boundaries.

Audit findings are classified as conformities or nonconformities; nonconformities may be graded major or minor depending on the certification scheme's rules.

Auditor competence comprises personal behaviour plus knowledge and skills: audit principles and methods, management system standards, organizational context, applicable legal requirements, and technical knowledge of the audited activity.

Competence is demonstrated through education, training, work experience, audit experience and audit-specific knowledge; certification schemes (e.g., ISO/IEC 17024-based) add examination and continuing professional development requirements.

An audit team leader needs additional competence in managing the audit, representing the team, and reaching audit conclusions; technical experts support but do not audit as auditors.

Independence means the auditor is not part of the activity being audited; internal auditors must not audit their own work.

Risk-based auditing means allocating audit effort proportional to the significance of processes, aspects and impacts, and the likelihood of nonconformity.

An audit programme is a set of one or more audits planned for a specific time frame, directed at a specific purpose; it is managed by a person competent in audit programme management.

ISO 19011 clause 5 covers programme management: establishing objectives, risks and opportunities, extent, resources, and then implementing, monitoring, reviewing and improving the programme.

Programme risk considerations include competence of auditors, sampling coverage, schedule slippage, confidentiality, and availability of auditee personnel and information.

An audit plan (per audit) states objectives, criteria, scope, dates, locations, expected time and duration, audit team roles, and allocation of resources; it is agreed with the auditee.

Planning inputs include the audit objectives and criteria, the auditee's context and processes, previous audit results, aspects and impacts, compliance obligations and risk register.

Sampling during planning should target high-risk processes, significant environmental aspects, prior nonconformities, and processes with weak controls rather than random coverage alone.

Document review before the audit examines the environmental policy, aspects register, legal register, objectives, monitoring records, previous findings and management review outputs.

The plan should be flexible: changes during the audit (e.g., significant findings, unavailable personnel) are agreed with the audit client and auditee and recorded.

Programme monitoring uses indicators such as audit completion, nonconformity trends, timeliness of corrective action closure, and auditor performance feedback.

The opening meeting confirms the audit plan, scope, criteria, schedule, communication channels, audit methods, availability of records, and confidentiality; attendance is recorded.

Audit evidence comes from interviews, observation of activities and conditions, and review of documents and records; evidence must be verifiable and recorded.

Evidence is evaluated against audit criteria to determine findings; evidence not meeting criteria becomes a nonconformity, and evidence meeting criteria supports conformity.

Sampling must be planned and representative: increase sample size where risk is high, controls are weak, or results are inconsistent; document the sample basis.

Interview technique: ask open questions first, then probing and closed questions; verify statements against records and observation rather than accepting them at face value.

Triangulation means confirming a finding through at least two independent evidence sources (e.g., interview plus record plus observation).

Observations of site conditions (spills, containment, waste segregation, labelling, storage, emissions, noise) are valid audit evidence.

Trace processes end-to-end: follow an activity from input through operation to output and waste, checking operating criteria and controls at each step.

Do not audit your own work or a process where you have a conflict of interest; record objective evidence precisely (document reference, date, location, sample size).

A nonconformity is the non-fulfilment of a requirement; an observation or opportunity for improvement is not a nonconformity but may be reported separately.

A major nonconformity typically indicates a systemic failure, absence of an required control, a significant environmental impact risk, or a legal non-compliance; a minor is an isolated lapse not indicating system breakdown.

Classification rules belong to the certification scheme or audit client; the auditor applies the scheme's definitions consistently across the audit.

Each nonconformity record should state the requirement (criterion), the objective evidence (what was found, where, when, sample), and the significance.

Auditors report nonconformities, not prescribe corrective actions; the auditee determines root cause and corrective action.

Audit conclusions summarize conformity with criteria, effectiveness of the EMS, and suitability; they consider all findings, not only nonconformities.

Where audit objectives cannot be met (e.g., insufficient evidence, scope limitations), the report must state this and the audit conclusion must reflect the limitation.

Audit team review before the closing meeting consolidates findings, removes duplicates, verifies evidence, and agrees classification and conclusions.

Conclusions should distinguish conformity of the management system from environmental performance outcomes; certification audits assess the system, not absolute environmental results.

The audit report is the property of the audit client; distribution and retention are controlled by the client and confidentiality requirements.

Report content typically includes objectives, scope, criteria, dates, locations, team, findings, conclusions, and any scope limitations or unresolved divergences.

Findings in the report must be traceable to objective evidence; the report should be factual, clear and free of unsupported judgement.

The report is issued within the time agreed in the audit plan; the auditee receives it and may comment on accuracy before or after issue depending on scheme rules.

Corrective action requires root cause analysis, action to eliminate the cause, implementation, and verification of effectiveness; correction alone addresses the symptom.

Follow-up verifies implementation and effectiveness; verification may be by document review, remote evidence, or on-site verification depending on risk and scheme rules.

Closure is recorded only when evidence shows the corrective action is implemented and effective; overdue actions are escalated in the audit programme.

The audit is complete when all planned activities are done and the report is issued; follow-up may be part of the programme rather than the individual audit.

Records of the audit, including reports and follow-up evidence, are retained per scheme and client requirements, with confidentiality maintained.

An environmental aspect is an element of an organization's activities, products or services that interacts or can interact with the environment; an impact is the change to the environment, adverse or beneficial, wholly or partly resulting from the aspect.

Aspects must be determined for normal, abnormal and emergency conditions, and across the life cycle (raw material, design, production, distribution, use, end-of-life).

Significance is determined using criteria the organization defines (e.g., severity, likelihood, scale, legal requirement, interested party concern, sensitivity of the location).

Significant aspects drive operational controls, monitoring, objectives and emergency preparedness; the aspects register must be kept as documented information.

Compliance obligations include legal requirements and other requirements the organization subscribes to (permits, industry codes, customer requirements, voluntary commitments).

Compliance evaluation must be periodic and recorded; the auditor checks both the evaluation process and evidence of compliance with specific requirements.

Risk-based thinking (clause 6.1) covers risks and opportunities related to aspects, compliance obligations and other issues that can affect the EMS; it is not a separate risk management standard.

The auditor tests whether the aspects and impacts register is current: new processes, changed materials, new legal requirements, incidents and complaints should trigger updates.

Life-cycle perspective does not require a full life-cycle assessment; it requires considering stages the organization can control or influence.

Integrity: the auditor performs work honestly, accurately and responsibly, and reports findings truthfully, including inconvenient ones.

Fair presentation: findings, conclusions and reports reflect the audit activities truthfully; significant obstacles and unresolved divergences are reported.

Due professional care: the auditor applies the diligence and judgement expected of the task, and exercises care proportional to the importance of the task and confidence placed in the audit report.

Confidentiality: information obtained during the audit is not disclosed without authorization; it is used only for the audit purpose and protected appropriately.

Independence: the auditor is independent of the activity audited and free from bias and conflict of interest; the auditor must disclose any potential conflict.

Evidence-based approach: conclusions are based on verifiable evidence; the auditor does not accept gifts, hospitality or inducements that could influence judgement.

Professional conduct includes courtesy, punctuality, respect for auditee personnel, and avoiding behaviour that undermines the credibility of the audit.

Auditors must not provide consultancy to the auditee that compromises impartiality; certification body rules restrict consultancy to certified clients for a defined period.

The auditor must not audit their own work and must maintain objectivity where prior employment or personal relationships exist.