ISO 14001 LA cheat sheet

An environmental management system is the part of an organization's management system used to manage environmental aspects, fulfil compliance obligations, and address risks and opportunities.

ISO 14001:2015 maps to PDCA: Plan = Clause 6, Do = Clauses 7-8, Check = Clause 9, Act = Clause 10.

Three intended outcomes: enhancement of environmental performance, fulfilment of compliance obligations, and achievement of environmental objectives.

Aspect = element of activities, products or services that interacts or can interact with the environment; impact = change to the environment, adverse or beneficial, resulting from aspects.

Life cycle perspective spans raw material acquisition, design, production, transport and delivery, use, end-of-life treatment and final disposal; it does not require a detailed life cycle assessment.

Significant environmental aspects are decided by the organization using its own criteria and drive operational control, monitoring and emergency preparedness arrangements.

Compliance obligations = legal requirements plus other requirements the organization subscribes to, such as industry standards, customer agreements or community commitments.

Protection of the environment includes prevention of pollution and other specific commitments relevant to the context, such as sustainable resource use and climate change mitigation.

Continual improvement is a recurring activity to enhance performance; ISO 14001:2015 does not require improvement beyond the defined scope of the EMS.

The EMS scope (4.3) must be maintained as documented information, be available to interested parties, and consider 4.1 issues, 4.2 interested parties, compliance obligations, and authority to control and influence.

Clause 5.1: top management is accountable for EMS effectiveness and must ensure policy and objectives are compatible with strategic direction and that EMS requirements are integrated into business processes.

The environmental policy (5.2) must be documented and include commitments to protection of the environment, fulfilment of compliance obligations, and continual improvement.

Clause 6.1.2 requires determining aspects and impacts with a life cycle perspective, defining criteria for significance, and maintaining documented information on aspects, impacts, criteria and significant aspects.

Objectives (6.2.1) must be consistent with policy, measurable if practicable, monitored, communicated and updated, with documented information maintained.

Clause 8.1 requires establishing operating criteria, controlling processes in line with them, controlling planned changes and reviewing consequences of unintended changes, and controlling or influencing outsourced processes.

Clause 9.1.1 requires criteria and appropriate indicators for monitoring and measurement, plus evidence of calibration or verification of monitoring and measuring equipment.

Management review (9.3) inputs include audit results, compliance status and extent of objectives met; outputs include decisions on improvement, changes, resources and integration into business processes.

Clause 10.2 requires reacting to nonconformity, evaluating the need to eliminate the cause, implementing action, reviewing effectiveness, and retaining documented information.

Seven audit principles (ISO 19011:2018): integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach.

Audit = systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria.

Audit objectives state what the audit is meant to achieve; audit scope defines extent and boundaries; audit criteria are the requirements used as a reference.

Audit types: first-party (internal), second-party (by an interested party such as a customer or supplier), third-party (independent certification or accreditation body).

Findings are the outcome of evaluating audit evidence against criteria and include conformities, nonconformities and opportunities for improvement.

Only verifiable information qualifies as audit evidence: records, statements of fact or observations that can be corroborated; unverifiable opinion is not evidence.

Audit evidence is drawn from representative samples, so audit conclusions carry inherent uncertainty that must be weighed before reporting findings.

Independence means auditors do not audit their own work; for internal audits, independence should be achieved as far as practicable.

The risk-based approach allocates audit planning, frequency and focus according to the significance of risks to the auditee's objectives and environmental performance.

Preparation begins by confirming audit objectives, scope and criteria with the client and confirming feasibility: sufficient information, adequate resources and cooperation from the auditee.

The audit plan states audit objectives, scope and criteria, locations, dates, durations, team roles and the auditee functions and processes to be audited.

Planning is risk-based: time and attention are allocated to higher-risk processes, significant environmental aspects, compliance obligations and areas with prior problems.

Work documents may include checklists, sampling plans and forms; checklists must not restrict the audit to listed items and must remain flexible during fieldwork.

Pre-audit document review typically covers the policy, EMS scope, aspects and impacts information, objectives, monitoring data, internal audit results and management review outputs.

Team selection considers the competence required by the audit scope, including environmental technical knowledge, applicable legal requirements and language.

Technical experts, interpreters, observers and guides may accompany the team but do not audit; observers and guides do not influence or interfere with the audit.

A stage 1 certification audit assesses readiness: documentation, site-specific conditions, understanding of requirements, and whether stage 2 can proceed.

Multi-site sampling requires similar activities, processes and a central function; sites with significantly different processes or higher risk are audited individually.

The opening meeting confirms the audit plan, scope and criteria and establishes communication arrangements, safety rules, guide roles and reporting methods.

Information is collected through interviews, observation of activities and conditions, and review of documents and records; each finding must be traceable to evidence.

The audit trail runs from criterion to evidence to finding to conclusion, so that a third party can retrace how each finding was derived.

Nonconformities are classified as major or minor; a major nonconformity seriously affects the capability of the management system to achieve intended results.

Significant or critical findings should be communicated to the auditee during the audit rather than being withheld until the closing meeting.

Where within the audit scope, auditors verify that corrective actions from previous audits have been implemented and are effective.

Guides act on behalf of the auditee to facilitate the audit; they do not answer on the auditee's behalf or influence sampling and evidence collection.

The closing meeting presents findings, conclusions on conformity with criteria and EMS effectiveness, and any recommendation on certification or follow-up.

If evidence is limited or access restricted, the auditor records the limitation and its effect on the audit conclusions.

The audit report is issued within the agreed timeframe and includes objectives, scope, criteria, team, dates, findings, conclusions and any unresolved issues.

The audit is complete once all planned activities are performed and the report is distributed; follow-up, if any, is a separate activity.

The report should distinguish major and minor nonconformities, conformities, observations and opportunities for improvement, referencing objective evidence.

Audit records and reports are retained as evidence of programme implementation and are subject to confidentiality requirements.

For certification, major nonconformities must be corrected and corrective actions verified before certification is granted; verification typically occurs within a defined period, commonly up to 90 days.

Verification of corrective action may be by document review or on-site follow-up and evaluates effectiveness, not merely whether the action was implemented.

The auditee determines root cause and corrective action; the auditor verifies effectiveness and does not design or prescribe the action.

If corrective actions are not effective, the certification body may require a further review, re-audit, suspension or withdrawal depending on severity.

An audit programme is one or more audits planned for a specific time frame and directed at a specific purpose, covering internal audits or certification audits.

Establishing a programme addresses objectives, risks and opportunities, scope, frequency, duration, resources, competence and procedures.

ISO 19011 programme cycle: establish (5.2), implement (5.3), monitor (5.4), review (5.5) and improve (5.6).

Audit frequency and duration should reflect the size, nature, complexity, risks, significant aspects, compliance obligations and results of previous audits.

Programme monitoring uses indicators such as audit timeliness, auditor performance, feedback from auditees and achievement of audit objectives.

Programme review by top management identifies needed changes and improvement actions that feed back into programme improvement.

Programme records include audit plans, reports, nonconformity records, and auditor competence and evaluation records.

A certification cycle of three years typically includes initial certification (stage 1 and stage 2), surveillance audits at least once a year, and a recertification audit before expiry.