Last updated 6 October 2026
Build an ISO 14001:2026 internal audit checklist from your own site, not from the wording of the standard. For each clause from 4 to 10, list the question you will ask, the person you will ask, and the evidence that would prove conformity. Draw the questions from your aspects register, compliance obligations and previous audit results, so they lead you to the drains, stores and records that matter.
At a snack factory in Germiston I was handed last year’s internal audit checklist. Line 41 read “Waste managed according to procedure: Yes”. Twenty metres from the office, used oil drums stood on bare soil behind the boiler house with a dark stain spreading toward the stormwater grid. The auditor had answered the checklist. Nobody had audited the site.
Learn to build checklists that point at evidence with ISO 14001:2026 Internal Auditor, then use them on two audits of a case site evidence pack. You finish with an audit programme and written findings. About 14 hours online, R3 850 on a limited period special, normally R4 670.
What belongs in an ISO 14001 audit checklist?
Five columns: the requirement, the question, who you will ask, the evidence you expect, and what you actually found. A yes or no box is not one of them.
The requirement column can hold a clause of ISO 14001:2026, a line of your own procedure or a permit condition. Clause 9.2.1 a) asks the audit to check conformity with both the organisation’s own EMS requirements and the standard, so your procedures and permits are audit criteria too. The evidence column is the one that does the work. If you cannot say what proof would look like before you arrive, you will accept whatever you are shown.
The tables below are a starting set for a food or beverage site. They are prompts. Cut the rows that do not apply to you and add the ones your own aspects register demands.
What do you ask about context, scope and leadership (clauses 4 and 5)?
Ask whether the site knows its environmental conditions, its interested parties and its scope, and whether top management can show accountability for the EMS without the SHEQ manager in the room.
| Clause | Question | Evidence to look for |
|---|---|---|
| 4.1 | Which environmental conditions affect this site, and which does it affect? | Issues register considering pollution, natural resources, climate change, biodiversity and ecosystem health, each judged relevant or not |
| 4.2 | Which interested party requirements has the site decided to meet? | Interested party register showing which requirements became compliance obligations and which are addressed through the EMS |
| 4.3 | Does the scope leave out any area with significant aspects? | Scope available as documented information and to interested parties. Compare with the site map, the waste yard and off-site stores |
| 5.1 | How does the general manager know the EMS is working? | Interview with top management, management review results, resource decisions |
| 5.2 | Does the policy fit this site’s impacts? | Policy commitments to protect the environment, meet compliance obligations and improve, and how staff were told |
| 5.3 | Who reports EMS performance to top management? | Assigned responsibility and authority, and reports actually delivered |
Interview top management yourself. A general manager who answers “ask Thandi, she does ISO” has told you something about clause 5.1 a) that no document will.
What evidence proves the planning clauses (6.1 to 6.3)?
Registers that are current, connected and used: aspects with significance criteria, compliance obligations with how each applies, risks and opportunities, objectives with action plans, and records of planned changes.
| Clause | Question | Evidence to look for |
|---|---|---|
| 6.1.2 | Were normal, abnormal and potential emergency conditions considered, with a life cycle perspective? | Aspects and impacts, significance criteria and significant aspects. Check one new activity from the last year appears |
| 6.1.3 | Has the site determined how each obligation applies? | Compliance obligations register traced to permits, licences and by-laws on file |
| 6.1.4 | Which risks and opportunities need action? | Register linked to 4.1 issues, 4.2 requirements, aspects and obligations |
| 6.1.5 | How will each action be built into the EMS and checked for effectiveness? | Action plans with an effectiveness check, not only a completion date |
| 6.2 | Are objectives measurable, monitored and resourced? | Objectives with what, who, resources, when and how results are evaluated |
| 6.3 | When did the EMS last change, and was the change planned? | Records of a recent change (new line, new contractor, new permit) assessed before it went live |
Two of these rows are new territory for sites coming off the 2015 edition. Risks and opportunities now have their own sub-clause, 6.1.4, and planning of changes, 6.3, is a new clause. If your site has not yet moved across, Transition to ISO 14001:2026 sorts every change into no action, confirm or build. The transition gap analysis checklist is a different tool from this one: it asks what must change, while an audit checklist asks whether the system works.
What do you check on the floor for clauses 7 and 8?
Competence and awareness of the people whose work causes significant impacts, controlled documents at the point of use, operating criteria that are actually followed, control of contractors and suppliers, and emergency arrangements that have been tested.
| Clause | Question | Evidence to look for |
|---|---|---|
| 7.2 | Is the boiler operator, effluent plant operator or waste handler competent? | Competence evidence, and whether training was checked for effectiveness |
| 7.3 | Can the person at the CIP set say what happens if caustic reaches the drain? | Interview on the floor. Awareness of the significant aspects of their job |
| 7.4 | Who decides what goes to the municipality or a customer, and how? | Communication process, records of external communication, complaint responses |
| 7.5 | Is the version at the chemical store the approved version? | Document on the wall compared with the master list |
| 8.1 | Are operating criteria met, and how are external providers controlled or influenced? | Grease trap job cards, effluent pH logs, waste manifests, contractor briefings, purchasing requirements |
| 8.2 | When was the spill or ammonia response last tested, and what changed after it? | Drill records, post-drill review, spill kit contents compared with the list |
At restaurant groups I add four store-level lines: grease trap condition and cleaning frequency, used cooking oil storage and collection slips, refrigerant service records from the cold room contractor, and generator diesel storage. Clause 8.1 now speaks of externally provided processes, products or services relevant to the EMS. At a 14 store group almost every significant aspect runs through a contractor, so that row carries most of the audit time.
Want to practise this on a real evidence pack before you face your own site? See the ISO 14001:2026 Internal Auditor course: two practice audits, a three part assessment and a finished audit programme in about 14 hours. R3 850 while the special lasts.
How do you audit the system checking itself (clauses 9 and 10)?
Follow results through to decisions. Monitoring should feed analysis, compliance evaluation should produce a known status, audits should be reported, management review should decide, and nonconformities should reach root cause and an effectiveness check.
| Clause | Question | Evidence to look for |
|---|---|---|
| 9.1.1 | What is monitored, measured and analysed, and is the equipment calibrated or verified? | Monitoring plan, effluent and energy results, flow meter calibration |
| 9.1.2 | How often is compliance evaluated, and what is the current status? | Compliance evaluation results at the stated frequency, with actions taken |
| 9.2.2 | Is there a documented programme, with objectives, criteria and scope for each audit? | Audit programme, audit plans, reports sent to relevant management |
| 9.3 | Did management review cover every input and record every result? | Minutes or pack covering inputs a) to g) and results a) to f) |
| 10.2 | Was the cause found, and did the action work? | Nonconformity records with cause, extent check and effectiveness review |
Pick one nonconformity from the last certification audit and trace it all the way: the record, the cause, the action, the effectiveness check, and the place on site where it happened. If the same stain is still on the floor, you have your finding.
When does a checklist hide problems?
When it is answered yes or no, when it follows clause order instead of the process, and when it is filled in at the desk. Each of these lets the auditor finish the form without seeing the site.
Clause order is the quiet one. If you audit 6.1.2 in the boardroom at nine and 8.1 at the effluent pit at two, you never connect them. Follow the process instead. Stand at the effluent pit, ask what the significant aspect is, then ask for the register line, the operating criteria, the monitoring results and the last compliance evaluation, in that order. One trail covers five clauses and shows whether they connect.
Time is the other trap. A day shift audit of a plant that runs nights misses the CIP dump at two in the morning. Nobody’s checklist has a row for that, so the programme has to.
How do you build your own checklist?
Start from the audit objective and your significant aspects, then add the clauses, not the other way round. On a medium food site a focused checklist takes about an hour to build.
- Write the audit objective, criteria and scope at the top, as clause 9.2.2 a) requires for every audit.
- List the significant aspects inside that scope from the aspects register.
- For each aspect, note the compliance obligations, operating criteria and monitoring that apply.
- Turn each into a question, a person to ask and the evidence you expect.
- Add the system clauses (4, 5, 9.3, 10) that this audit objective needs.
- Add any finding from the last internal or external audit in scope.
- Note sample sizes, shifts and wet weather conditions you need to see.
- Leave a wide “what I found” column, and write in it on site.
The audit objective in step 1 comes from the programme. How to plan the ISO 14001 internal audit programme shows how to set it. For the full list of documents and records each clause expects, see ISO 14001:2026 documented information. Not sure which ISO 14001 course fits your job? WhatsApp ASC on +27 61 483 0381.
Frequently asked questions
Is there an official ISO 14001:2026 audit checklist?
No. ISO does not publish one. A checklist is the auditor’s own working tool and should be built from the site’s aspects, compliance obligations and the objective of each audit.
Should an internal audit checklist follow the clause order?
Not on site. Following a process or an aspect from the floor back to the registers connects several clauses in one trail, and shows whether the system works as a whole.
Can I use the same checklist every year?
Only as a base. Clause 9.2.2 asks the programme to consider changes and previous audit results, so each checklist should change with the site and with last year’s findings.
What is new in an ISO 14001:2026 audit checklist compared with 2015?
Add rows for risks and opportunities in 6.1.4, planning of changes in 6.3, emergency situations determined in 6.1.2, externally provided processes in 8.1, and audit objectives with a documented programme in 9.2.2.
How many questions should an ISO 14001 checklist have?
As many as the audit objective needs and no more. A focused checklist of 20 to 40 evidence questions for a half day audit beats a 200 line form nobody finishes.
Which ASC course teaches you to audit with a checklist that works?
ISO 14001:2026 Internal Auditor walks every clause of the 2026 edition from the auditor’s side, then puts you on a case site evidence pack to plan, check and report two audits.
R3 850 limited period special, normally R4 670. No VAT is charged, so the price shown is the price paid. Five or more learners: contact ASC for a team rate.
- About 14 hours, 6 modules and 31 lessons, on any phone or laptop
- A lesson on checklists that help and checklists that hide
- The site walk: drains, stores, stacks and bins
- Interviewing, reading records and sampling audit evidence
- Auditing each clause from context to corrective action
- Every activity marked automatically, with a certificate of completion and verification code on passing
- Is it for me? Yes if you audit, run the audit programme or will be audited as a process owner.
- How long does it take? About 14 hours, self paced. Pick it up between shifts.
- Will it work at my site? Yes. Food plants, packhouses and restaurant groups are all in the case sites, and you can use your own site instead.
Building the registers your checklist will test? ISO 14001:2026 Understanding and Implementation builds them with you. See all four courses on the ISO 14001 training hub.
ISO 14001 is copyright and is not reproduced here. ASC is not affiliated with ISO.
Sources
- ISO 14001:2026, Environmental management systems, ISO
- ISO 19011:2026, Guidelines for auditing management systems, ISO
- National Environmental Management: Waste Act 59 of 2008