Last updated 6 October 2026
An ISO 14001 auditor tests legal compliance by testing the system, not by giving a legal opinion. The auditor checks that the site has determined its compliance obligations and how each one applies (clause 6.1.3), built them into its controls, evaluates compliance at a frequency it has set (clause 9.1.2) and knows its status. Then the auditor samples obligations from the register to the floor and back.
At a beverage plant in Gauteng the SHEQ manager handed me a compliance evaluation spreadsheet: 86 rows, every one marked “Compliant” in green, signed off in January. I asked for the evidence behind the trade effluent permit row. The answer was “we assume so, the municipality has never complained”. That single row told me more about clause 9.1.2 than the other 85.
Learn to audit compliance from the register to the floor with ISO 14001:2026 Internal Auditor. You audit every clause, including 6.1.3 and 9.1.2, on a case site evidence pack and write the findings. About 14 hours online. R3 850 on a limited period special, normally R4 670.
What is the auditor testing under clauses 6.1.3 and 9.1.2?
Three things: that the site knows what its obligations are and how they apply, that it has controls for them, and that it checks itself against them on a schedule and acts on what it finds.
| Clause | What the site must do | What the auditor samples |
|---|---|---|
| 4.2 c) | Decide which interested party requirements become compliance obligations | Interested party register against the obligations register |
| 6.1.3 a) and b) | Determine and have access to obligations related to its aspects, and determine how they apply | Register entries traced to the permit, licence, Act or by-law, with the specific conditions that apply |
| 6.1.3 c) | Take obligations into account across the EMS | Operating criteria, objectives and training that reflect the obligations |
| 9.1.2 a) to c) | Set evaluation frequency, evaluate compliance, act if needed, know the status | Evaluation records at the stated frequency, with evidence behind each judgement |
| 7.4.3 | Communicate externally as obligations require | Reports to the municipality or the department, sent on time |
Clause 6.1.3 asks for the obligations to be available as documented information. Clause 9.1.2 asks for documented evidence of the evaluation results. Both are records the auditor can read. The skill is in testing whether they are true.
What may an auditor write when a permit condition looks breached?
Write what the system has not done and cite the evidence. Say the site has not determined or has not evaluated how the obligation applies. Never write that the site is acting illegally, because you are not the authority and you rarely have the full picture.
Compare two versions. “The site is in breach of its trade effluent permit” is a legal conclusion. “The site has not evaluated compliance with the pH and sampling conditions of trade effluent permit TE-0412. No results were available for March to August, and the compliance evaluation dated January records the permit as compliant without evidence” is an audit finding. The second one can be checked line by line, and it sends the site to find out its real legal position.
Annex A.9.1.2 adds an important point. A failure to meet a legal requirement is not automatically a nonconformity if the EMS has identified it and is correcting it. If the site found the problem in its own evaluation, told the municipality and is working an agreed plan, the system is working. Annex A.9.1.2 also says an action plan agreed with a regulator becomes a compliance obligation in its own right, so audit progress against it.
There is one exception to staying in your lane. If you see something that could cause pollution right now, such as caustic reaching a stormwater drain, stop and tell relevant management at once. NEMA section 30 deals with emergency incidents, and it is the site’s job to decide what it must report. Record that you raised it.
How do you trace one obligation from the register to the floor?
Pick one obligation linked to a significant aspect and follow it through every place it should touch the system. One complete trail beats ten ticked rows.
- Choose an obligation linked to a significant aspect, for example the trade effluent permit.
- Read the source document itself, not the register summary. Note each condition: limits, sampling, reporting, notification.
- Check that the register says how each condition applies to this site.
- Find the control: the operating criteria at the effluent pit, the grease trap cleaning frequency, the CIP dump procedure.
- Go to the floor and watch the control work. Talk to the operator.
- Read the monitoring results and compare them with the permit conditions, checking units.
- Read the compliance evaluation for this obligation. Is the judgement backed by the results you just read?
- Check that any gap became an action under clause 10.2 and that relevant management knows the status.
This is the audit side only. Building the register in the first place is a different job, covered in the ISO 14001 legal register for South Africa.
Which South African obligations come up most on food sites?
Trade effluent permits, waste storage and classification, hazardous waste manifests, water use from boreholes, boiler emissions, extended producer responsibility for packaging, and ammonia under the Major Hazard Installation Regulations.
| Source | Typical obligation | Evidence to sample |
|---|---|---|
| National Environmental Management Act 107 of 1998 | Section 28 duty of care. Section 30 emergency incidents | Spill controls, incident records, decisions on reporting |
| National Environmental Management: Waste Act 59 of 2008 | Classification (GN R.634 of 2013), storage norms and standards (GN R.926 of 2013) | Classification records, storage area condition, manifests, disposal certificates |
| Extended Producer Responsibility Regulations (2020) | Paper and packaging, lighting, electrical and electronic equipment where they apply | The site’s determination of whether and how it is affected |
| National Environmental Management: Air Quality Act 39 of 2004 | Atmospheric Emission Licence for listed activities, national emission standards for boilers declared controlled emitters, otherwise the municipal air quality by-law | Licence or by-law conditions, emission tests, boiler records |
| National Water Act 36 of 1998 | Section 21 water uses, licence or general authorisation. Sections 19 and 20 on pollution and emergencies | Borehole abstraction records, authorisation, irrigation of wastewater |
| Municipal trade effluent by-law | Discharge permit conditions | Permit, sampling results, grease trap records |
| Occupational Health and Safety Act 85 of 1993 | Major Hazard Installation Regulations 2022 where ammonia plants qualify | The site’s determination, risk assessment, emergency plan |
Notice the evidence column keeps asking for the site’s determination. Your job is to test that the site has worked out how each obligation applies to it, not to work it out on its behalf. For a plain overview of the Acts themselves, see the South African environmental laws behind ISO 14001.
Ready to audit compliance with confidence? Start ISO 14001:2026 Internal Auditor today and finish with an audit programme, two practice audits and written findings. About 14 hours, R3 850 for a limited period.
What counts as a real compliance evaluation?
A dated judgement for each obligation, made at the frequency the site set, backed by evidence the auditor can see. “Compliant” with nothing behind it is a claim, not an evaluation.
Annex A.9.1.2 gives sites room. Frequency can differ between obligations, so a monthly effluent check and an annual review of the EPR position can both be right. Every obligation must still be evaluated periodically. The site can also use evaluations by external parties, such as a municipal inspection report, as long as they are current and cover the condition in question.
When I sample an evaluation I ask three questions. Who made the judgement, and are they competent to read the permit? What evidence did they look at? What happened when the answer was no? The third question is where systems fail. A gap found and filed is only half of 9.1.2 b), which also asks the site to take action if needed.
What about obligations that are not law?
Audit them the same way. Under clause 4.2, a customer, landlord or industry requirement becomes a compliance obligation once the site decides to comply with it.
On South African food sites these are often the obligations with the sharpest teeth. A retailer’s supplier code with an environmental section. An export customer’s request for packaging data. A shopping centre landlord’s grease trap rules for a restaurant tenant. At a restaurant group I audited, the mall leases set grease trap cleaning more often than the group’s own procedure. The register did not mention the leases, so no store manager knew. Annex A.6.1.3 lists agreements with customers, contractual obligations and industry standards among voluntary sources, so sample at least one in every compliance audit.
What findings come out of a compliance audit?
Mostly findings against clauses 6.1.3 and 9.1.2, written as requirement, evidence and statement. Here are two from patterns I see often.
- Packhouse borehole. Requirement: clause 6.1.3 b) requires the organisation to determine how its compliance obligations apply. Evidence: two boreholes with abstraction meters supply the packhouse. The register lists the National Water Act 36 of 1998 with no reference to section 21 water use or to any authorisation. Statement: the site has not determined how section 21 of the National Water Act applies to its borehole abstraction.
- Evaluation without evidence. Requirement: clause 9.1.2 b) requires the organisation to evaluate compliance and take action if needed. Evidence: the January evaluation marks the boiler emission conditions as compliant. No emission test result for the past two years was available. Statement: compliance with boiler emission conditions has not been evaluated against evidence.
Neither says the site broke the law. Both will make it find out. More worked examples are in how to write ISO 14001 audit findings. If the register itself needs building, ISO 14001:2026 Understanding and Implementation builds it with you, Act by Act. Not sure which ISO 14001 course fits your job? WhatsApp ASC on +27 61 483 0381.
Frequently asked questions
Does an ISO 14001 internal auditor need to be a lawyer?
No. The auditor needs enough knowledge of the Acts, permits and by-laws to recognise what applies and what evidence proves it. Legal interpretation stays with the site’s legal adviser or the authority.
Is a legal non-compliance always an ISO 14001 nonconformity?
No. Annex A.9.1.2 says it is not automatically a nonconformity if the EMS has identified it and is correcting it. Failing to identify or act on it is a nonconformity.
How often must compliance be evaluated under ISO 14001:2026?
At a frequency the organisation determines under clause 9.1.2 a). Different obligations can have different frequencies, but all must be evaluated periodically.
Can a municipal inspection report count as a compliance evaluation?
It can be used as part of the evaluation if it is current and covers the condition being evaluated. The site still owns the judgement and the follow-up.
Are retailer environmental requirements compliance obligations?
Yes, once the site decides to comply with them. Clause 4.2 then treats them as compliance obligations, and they should be audited like legal requirements.
Which ASC course trains you to audit compliance obligations?
ISO 14001:2026 Internal Auditor teaches you to test compliance obligations from register to floor, write findings that never stray into legal opinion, and judge the corrective action that follows.
R3 850 limited period special, normally R4 670. No VAT is charged, so the price shown is the price paid. Five or more learners: contact ASC for a team rate.
- About 14 hours, 6 modules, 31 lessons, self paced on phone or laptop
- Auditing aspects, compliance obligations and risks (6.1) in its own lesson
- What makes an environmental audit different, and the site walk
- Interviewing people, reading records and sampling evidence
- Two practice exercises and a three part assessment, marked automatically
- ASC certificate of completion with a verification code
- Is it for me? Yes if you audit, evaluate compliance or answer to a retailer, export customer or municipality on environmental matters.
- How long does it take? About 14 hours, a lesson at a time.
- Will it work at my site? Yes. The South African Acts are built in, and you can work on your own site.
Moving from the 2015 edition? Transition to ISO 14001:2026 covers every change. All four courses are on the ISO 14001 training hub.
ISO 14001 is copyright and is not reproduced here. ASC is not affiliated with ISO.
Sources
- ISO 14001:2026, Environmental management systems, ISO
- National Environmental Management Act 107 of 1998
- National Environmental Management: Waste Act 59 of 2008
- National Water Act 36 of 1998
- National Environmental Management: Air Quality Act 39 of 2004
- Occupational Health and Safety Act 85 of 1993, Major Hazard Installation Regulations 2022