PCEA cheat sheet

ISO 14001 follows the harmonized structure: context of the organization, leadership, planning, support, operation, performance evaluation, and improvement; clauses 4-10 map one-to-one onto these elements.

ISO 14001 clause 6.1.2 requires determining environmental aspects and associated impacts from a life-cycle perspective, then identifying those that are significant using defined criteria.

Compliance obligations (clause 6.1.3) include legal requirements and other requirements the organization subscribes to; they must be documented and considered when establishing the EMS.

ISO 14001 has no absolute performance requirement beyond commitment to continual improvement and prevention of pollution; ISO 14004 provides non-certifiable guidance.

ISO 14001:2015 removed the requirement for a designated management representative but retains top-management accountability for EMS effectiveness.

Documented information replaces the older terms 'documents' and 'records'; the standard mandates only the documented information it names plus what the organization determines is necessary.

ISO 19011 is the guidance standard for auditing management systems, covering principles, program management, and auditor competence; it is not a certification standard.

ISO 17021-1 governs certification bodies performing EMS certification audits; ISO 14065 covers bodies validating environmental information.

The ISO 14000 family includes ISO 14031 (environmental performance evaluation) and ISO 14040/14044 (life cycle assessment), which supply data for aspect evaluation.

ISO 19011 audit principles: integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach, and a risk-based approach.

Independence means the auditor is free from bias and conflict of interest; internal auditors must not audit their own work, and impartiality is assessed at the team level for certification audits.

Objectivity requires evidence be verifiable; audit findings must be based on samples of information, and reports must state that sampling limits certainty.

Due professional care means applying diligence and judgment proportionate to the importance of the task and the confidence placed in the audit conclusions.

Confidentiality: audit information must not be disclosed without authorization unless required by law; certification bodies publish a binding code of conduct.

ISO 17021-1 requires certification body personnel to declare conflicts of interest, and the body must analyze threats to impartiality including financial self-interest and familiarity.

An auditor must decline or report an assignment where a relationship (prior employment, consulting, family) creates an unacceptable threat to impartiality.

Fraud or falsified evidence discovered during an audit must be reported per the audit program and certification rules; the auditor documents facts rather than assigning legal guilt.

Continuing professional development and competence evaluation (ISO 19011 clause 7) are required to maintain audit team capability.

Audit program: arrangements for a set of audits planned over a time frame, including objectives, scope, criteria, schedule, resources, and procedures; each individual audit is planned separately.

ISO 19011 clause 5 requires establishing program objectives, then determining processes, resources, and schedules; program performance is monitored and reviewed for improvement.

Audit scope defines boundaries (sites, processes, organizational units); audit criteria are the policies, procedures, standards, and legal requirements against which evidence is compared.

Risk-based planning prioritizes audits by significance of environmental aspects, compliance status, results of prior audits, complaints, and change in operations.

Audit plan contents: objectives, scope, criteria, dates and sites, team roles, allocation of time, and expected deliverables; it is agreed with the auditee before execution.

Audit duration for certification is determined by effective personnel count, complexity, and scope per IAF MD 5; duration cannot be arbitrarily reduced.

Stage 1 certification audit reviews readiness: documentation, scope, site conditions, and internal audit/management review; stage 2 verifies implementation and effectiveness.

Opening meeting confirms scope, criteria, schedule, communication channels, and work safety arrangements; closing meeting presents findings and audit conclusions.

Sampling plan: select a representative cross-section of shifts, sites, and processes; document the sampling rationale because conclusions rest on samples.

Evidence hierarchy: physical observation and measurement are strongest; interviews and document review corroborate; hearsay alone is insufficient for a nonconformity.

Nonconformity grading: major (systemic failure or legal breach, or no effective correction) versus minor (isolated lapse not indicating system breakdown); observations are improvement opportunities, not nonconformities.

A finding needs three parts: the requirement (criteria), the objective evidence (what was found), and the significance or impact.

Audit trails: trace from procedure to record to practice, and reverse; verify that records are contemporaneous, legible, and traceable to the activity.

Calibration records, monitoring data, and permit limits are compared to actual readings; record the specific value, date, and location observed.

Interview technique: ask open questions first, then probe with closed questions; verify claims against records rather than accepting statements at face value.

Sampling of records must be random or risk-targeted and documented; a single instance can support a major finding if it reveals systemic failure or legal noncompliance.

Evidence must be recorded during the audit (notes, photographs where permitted, copies of records) and retained per confidentiality rules.

Auditor must verify corrective action effectiveness at follow-up; closing a nonconformity requires evidence, not just a promised action.

Audit report contents: objectives, scope, criteria, dates and sites, team, summary of process, findings with evidence, conclusions on conformity and effectiveness, and distribution list.

Conclusions state whether the management system conforms to criteria and is effectively implemented and maintained; they do not certify unless the audit is a certification audit.

Nonconformity records include the requirement, evidence, classification, and the auditee's correction and corrective action with target dates and responsible person.

Corrective action must address root cause; correction fixes the instance, corrective action prevents recurrence; verification of effectiveness is a separate step.

Certification follow-up: major nonconformities require correction and corrective action verified before certificate issuance; minors may be closed by accepted plan with verification at next audit.

Report timeliness and factual accuracy are required; draft reports are cleared for factual accuracy with the auditee without altering findings.

Follow-up audits verify implementation of corrective actions; unresolved major nonconformities can lead to suspension or withdrawal of certification.

Records of the audit, report, and follow-up are retained by the audit program for the period defined by procedure or accreditation rules.

Compliance obligation register: identify applicable legal requirements (statutes, regulations, permits, and other requirements) and evaluate compliance periodically; ISO 14001 clause 9.1.2 requires this evaluation.

Permit conditions are legally binding: emission limits, monitoring frequency, recordkeeping, and reporting deadlines are auditable compliance criteria.

Common regulatory areas: air emissions, wastewater discharge, hazardous and solid waste, storage tanks, chemicals, noise, and emergency planning.

Waste duty of care: generators must classify waste, store it securely, use authorized carriers, and retain manifests or transfer records.

Spill reporting: many jurisdictions impose immediate notification duties for reportable releases with defined thresholds and timelines; late notification is itself a violation.

Enforcement tools include notices of violation, consent orders, administrative penalties, and criminal liability for knowing violations; directors can bear personal liability.

Regulatory inspection powers typically include site access, sampling, document production, and interview; obstruction is a separate offense.

Compliance audit privilege and self-reporting policies vary by jurisdiction; auditors must not assume confidentiality protections apply.

Regulatory change management: monitor amendments to permits and regulations and update the compliance register and EMS accordingly.