Last updated 6 October 2026
Write every ISO 14001 nonconformity in three parts: the requirement (a clause of ISO 14001:2026, your own procedure or a permit condition), the objective evidence you saw, and a short statement of what is not met. Leave out opinion, blame and the fix. A finding built this way survives the closing meeting because the auditee can check every word of it.
At a citrus packhouse closing meeting I once watched a colleague defend a finding that read “Poor housekeeping in the waste area”. The packhouse manager asked which requirement, which skip and which day. Forty minutes later the finding was withdrawn. Three months on, the certification body raised the same problem as a nonconformity, written properly.
Write findings that stand with ISO 14001:2026 Internal Auditor. You plan and run two audits on a case site evidence pack, write the nonconformities and decide on the corrective action responses, all marked automatically. About 14 hours online. R3 850 on a limited period special, normally R4 670.
What are the three parts of an ISO 14001 nonconformity?
Requirement, evidence and statement. The requirement says what should happen, the evidence says what you found, and the statement joins them in one plain sentence.
| Part | What it contains | Weak version | Strong version |
|---|---|---|---|
| Requirement | Clause, procedure number or permit condition, paraphrased | “ISO 14001 waste requirements” | “Procedure WM-02 requires hazardous waste to be stored in the bunded store” |
| Evidence | What you saw, read or heard, with where, when and how many | “Waste not stored properly” | “Four 210 litre drums of used oil on bare soil behind the boiler house, 10:40 on 12 May” |
| Statement | What is not met, in one sentence | “Waste management is poor” | “Hazardous waste is not stored as WM-02 requires” |
Evidence is what makes a finding hard to argue with. Clause 3.4.1 points to ISO 19011 for the meaning of audit evidence, and Annex A.9.2 describes it as records, statements of fact or other information that are relevant to the audit criteria and can be verified. If the auditee can walk to the boiler house and see the drums, the debate is over.
What do nonconformities that hold up look like?
Each example below names the requirement, gives evidence another person could check, and states the gap without blame or a solution. They come from patterns I have seen on South African food plants, packhouses and restaurant groups, with the details changed.
Example 1: aspects under abnormal conditions (6.1.2)
- Requirement: clause 6.1.2 requires environmental aspects to be determined taking into account normal and abnormal conditions.
- Evidence: the aspects register (revision 4) lists CIP chemical use under normal operation only. At 14:10 on line 3, the CIP caustic tank was dumped to the floor drain during a product changeover. The supervisor confirmed this happens at every changeover.
- Statement: aspects arising from abnormal CIP operation have not been determined.
Example 2: a permit condition (6.1.3)
- Requirement: clause 6.1.3 b) requires the organisation to determine how its compliance obligations apply to it.
- Evidence: the compliance obligations register lists the municipal trade effluent permit by reference number only. The permit on file sets sampling and reporting conditions. The register does not mention them, and no sampling results were available for January to June.
- Statement: the site has not determined how the sampling and reporting conditions of its trade effluent permit apply to it.
Example 3: an external provider (8.1)
- Requirement: clause 8.1 requires externally provided processes relevant to the EMS to be controlled or influenced, as defined in the EMS. Procedure WM-02 requires a safe disposal certificate within 30 days of each hazardous waste collection.
- Evidence: of five hazardous waste manifests sampled between January and June, three had no safe disposal certificate on file. The contractor changed in June and no evaluation of the new contractor was available.
- Statement: control of the external hazardous waste provider defined in WM-02 is not implemented.
Example 4: an emergency response that was never tested (8.2)
- Requirement: clause 8.2 d) requires planned response actions to be tested periodically where practicable. Procedure EP-01 sets an annual drench spill drill.
- Evidence: the last drill record is dated March 2024. Two of three drench line operators interviewed could not show where the drench area spill kit is kept.
- Statement: planned response actions for drench solution spills have not been tested at the frequency set in EP-01.
Example 5: the audit programme itself (9.2.2)
- Requirement: clause 9.2.2 a) requires audit objectives, audit criteria and scope to be defined for each audit.
- Evidence: the plans for the April and August internal audits state criteria and scope. Neither states an audit objective.
- Statement: audit objectives were not defined for two of two audits sampled.
Notice what is missing from all five. No “poor”, no “failed to”, no names, no recommended fix. The fix belongs to the auditee under clause 10.2.
Why does an internal auditor never rule on legality?
Because the internal auditor tests the management system against its criteria, and is not the regulator or the site’s legal adviser. Write that the site has not determined or has not evaluated how an obligation applies, and cite the evidence. Never write that the site is breaking the law.
Look again at Example 2. The tempting version is “the site is in breach of its trade effluent permit”. You may be right, but you have not proved it, and it is not your call. Perhaps the municipality agreed a different sampling schedule in a letter you have not seen. Perhaps the results sit with a laboratory. What you can prove is that the EMS has not determined how the condition applies and that no results were available. That is a nonconformity against 6.1.3 b), and it will push the site to find out the legal position for itself.
Annex A.9.1.2 helps here. Non-compliance with a legal requirement is not automatically a nonconformity if the EMS has picked it up and is correcting it. So the question for the auditor is whether the system knows and is acting. If you see something that could cause pollution right now, such as a discharge reaching a stream, tell relevant management at once and record that you did. Auditing compliance obligations covers the full method for testing legal compliance from the audit side.
Is it a major, a minor or an opportunity for improvement?
ISO 14001:2026 does not define grades. Your audit programme does, so set the definitions before the first audit and apply them the same way every time.
| Grade | Typical meaning | Food site example |
|---|---|---|
| Major nonconformity | A requirement not met at all, or a failure that could cause significant environmental harm or a breach of a compliance obligation | No hazardous waste control in place across the site |
| Minor nonconformity | A single lapse in a system that otherwise works | One of five manifests without a disposal certificate |
| Opportunity for improvement | The requirement is met, but there is a better way | Spill kits conform, but a second kit at the drench line would cut response time |
Internal audits do not have to copy certification body grading, but using similar language helps people take findings seriously. What matters more is that the same evidence always earns the same grade.
Practise grading on real evidence before you grade your colleagues. Start the ISO 14001:2026 Internal Auditor course and work through a dedicated findings and corrective action exercise. About 14 hours, R3 850 for a limited period.
How do you write a finding, step by step?
Gather the evidence on site, confirm it with the auditee, then write requirement, evidence and statement in that order, before you leave the area.
- Record what you see at the time: place, time, quantity, document number, who you spoke to.
- Check the evidence against the criteria: the clause, the procedure or the permit condition.
- Decide if it is a nonconformity, an opportunity for improvement or nothing. If you cannot name a requirement, it is not a nonconformity.
- Show the auditee the evidence and agree the facts, not the grade.
- Write the requirement in your own words, with its reference.
- Write the evidence with enough detail that someone else could find it again.
- Write the statement: one sentence, what is not met.
- Grade it against the definitions in your programme.
- Read it aloud. If it sounds like an opinion, go back to step 6.
Most arguments at closing meetings are about facts the auditor never confirmed. Step 4 kills them in the field. For the questions that lead you to the evidence in the first place, see the ISO 14001:2026 internal audit checklist.
How do you judge the corrective action response?
Check it against clause 10.2: a correction for the problem you found, a real cause, a check for similar problems elsewhere, an action that fits the cause, and a plan to review whether it worked.
The response I reject most is “operator retrained”. For Example 3, retraining fixes nothing if the cause is that nobody owns contractor evaluation after a contractor change. A good response chases the three missing certificates (correction), asks why the system did not flag them (cause), checks the other contractors (extent), assigns ownership and builds a 30 day follow-up into the procedure (action), and samples the next six manifests (effectiveness). Clause 10.2 also asks for the response to fit the significance of the effects, including the environmental impact.
Many of these findings trace back to registers that were never built properly. If that is your site, ISO 14001:2026 Understanding and Implementation builds the aspects, compliance obligations and risk registers with you. Not sure which ISO 14001 course fits your job? WhatsApp ASC on +27 61 483 0381.
Frequently asked questions
What are the three parts of an ISO 14001 audit finding?
The requirement, the objective evidence and the statement of nonconformity. Together they show what should happen, what the auditor found and what is not met.
Can an internal auditor write that a site is breaking the law?
No. The auditor writes that the site has not determined or evaluated how an obligation applies and cites the evidence. Deciding whether the law is broken is for the site’s legal adviser or the authority.
Should a nonconformity include the corrective action?
No. The auditor states the gap. The auditee finds the cause and decides the action under clause 10.2, and the auditor then judges whether the response is adequate.
Does ISO 14001 define major and minor nonconformities?
No. ISO 14001:2026 does not grade findings. The organisation sets grades in its audit programme, often using language similar to certification bodies.
Is an opportunity for improvement a nonconformity?
No. An opportunity for improvement is raised where the requirement is met but performance or the system could be better. The site decides whether to act on it.
Can a verbal statement be audit evidence?
Yes, if it is relevant to the audit criteria and can be verified. Confirm it against a record, an observation or a second person before you rely on it.
Which ASC course teaches you to write findings that stand?
ISO 14001:2026 Internal Auditor takes you from the evidence on site to a finding that cannot be argued with, then to the corrective action decision and the effectiveness check.
R3 850 limited period special, normally R4 670. No VAT is charged, so the price shown is the price paid. Five or more learners: contact ASC for a team rate.
- About 14 hours over 6 modules and 31 lessons, self paced on phone or laptop
- Writing a nonconformity that cannot be argued with
- Opportunities for improvement, observations, grading and the closing meeting
- Judging a corrective action response and verifying effectiveness
- A practice exercise on findings and corrective action decisions
- Pass mark 70 percent, certificate of completion with a verification code
- Is it for me? Yes if you write findings, answer them as a process owner, or run the audit programme.
- How long does it take? About 14 hours, in lessons short enough for a lunch break.
- Will it work at my site? Yes. The method applies on any site, and you can work on your own instead of the case sites.
Moving a 2015 system across first? Transition to ISO 14001:2026 handles the changes. Every course is on the ISO 14001 training hub.
ISO 14001 is copyright and is not reproduced here. ASC is not affiliated with ISO.
Sources
- ISO 14001:2026, Environmental management systems, ISO
- ISO 19011:2026, Guidelines for auditing management systems, ISO
- National Environmental Management Act 107 of 1998