ISO 14001 internal audit programme (9.2.2): how to plan the year

Last updated 6 October 2026

An ISO 14001:2026 internal audit programme is the documented plan for all internal audits over a period, usually a year. Clause 9.2.2 asks it to set frequency, methods, responsibilities, planning requirements and reporting, to weigh the environmental importance of processes, recent changes and previous audit results, and to define the objective, criteria and scope of every audit it contains.

Mzansi Fresh Meals, a ready meals plant in Nelson Mandela Bay, is one of the case sites in the ASC course. Like all ASC case sites it is a training scenario built from real audit patterns. Its whole audit programme is one line in the SHEQ calendar: “Internal audit, all clauses, November”. The QA manager has done it alone for three years, always on day shift. Meanwhile a second CIP set went in, the hazardous waste contractor changed, and a national retailer has asked how the site plans its environmental audits. That calendar line will not answer the retailer, and it will not satisfy 9.2.2.

Build a programme that does both in ISO 14001:2026 Internal Auditor. A full module covers clause 9.2.2, and part 1 of the assessment is building the programme itself. About 14 hours online, R3 850 on a limited period special, normally R4 670.

What does clause 9.2.2 require in ISO 14001:2026?

A programme with frequency, methods, responsibilities, planning requirements and reporting. For each audit, a defined objective, criteria and scope. Auditors chosen for objectivity and impartiality. Results reported to relevant management. The programme itself available as documented information.

When you establish the programme, clause 9.2.2 asks you to consider three things: the environmental importance of the processes concerned, changes affecting the organisation, and the results of previous audits. Clause 9.2.1 sets the purpose. Audits happen at planned intervals and tell you whether the EMS conforms to your own requirements and to the standard, and whether it is effectively implemented and maintained.

What changed in 9.2.2 from the 2015 edition

Item	ISO 14001:2015	ISO 14001:2026
Per audit	Criteria and scope	Objective(s), criteria and scope
The programme	Evidence of implementation and results retained	The programme itself available as documented information, plus evidence of implementation and of results
Inputs to the programme	“Take into consideration” importance, changes, previous results	“Consider” the same three. No change of intent

The audit objective requirement is the one most likely to catch sites out at transition audits. A plan that says “Scope: waste yard. Criteria: ISO 14001 and WM-02” is no longer complete. If your system is still on 2015, Transition to ISO 14001:2026 takes you through this and every other change, and preparing for your ISO 14001:2026 transition audit shows what evidence the certification body will sample.

How do you decide how often to audit each process?

Score each process on environmental importance, change since the last audit, and previous results. High scores get audited more often, at the right time of day and season, and by the most capable auditor.

ISO 14001:2026 does not say every clause must be audited every year. It says audits happen at planned intervals and the programme considers importance, change and history. In practice most certification bodies expect to see the whole system covered over the certification cycle, with the high importance areas visited more often.

Setting audit frequency on a food plant (example)

Process	Environmental importance	Change since last audit	Previous results	Frequency
Effluent pit and trade effluent	High: discharge to sewer under permit	Second CIP set installed	Certification body minor on grease trap records	Twice a year, one on night shift
Ammonia refrigeration	High: release would affect people and the stream	None	Clean	Once a year, with ISO 45001
Hazardous waste	High	New contractor	Not audited since change	Twice a year
Boiler and diesel storage	Medium	None	One open opportunity for improvement	Once a year
Purchasing and contractors	Medium	New hazardous waste contractor	Clean	Once a year
Context, leadership, management review	System	Transition to 2026	Clean	Once a year

What does a year’s programme look like?

Six to eight audits spread across the year, each with its own objective, timed to see the process when its risk is highest. One page is enough if every column is filled.

For the plant above, the year might run like this. The rainy season in Nelson Mandela Bay is not as sharp as in the summer rainfall areas, so pick the wet months that apply to your own site.

Example annual programme, ready meals plant

Month	Audit objective	Scope	Auditor
February	Confirm the effluent controls cope with the second CIP set	CIP, effluent pit, grease trap, night shift	Engineering planner, trained
April	Confirm the new hazardous waste contractor is controlled	Hazardous waste store, manifests, contractor evaluation	QA manager
June	Test ammonia emergency response and refrigeration controls (combined with ISO 45001)	Plant room, emergency plan, drill records	SHEQ coordinator with external specialist
August	Check stormwater controls during the wet season	Yard, drains, stormwater outlet, stream bank	Production supervisor, trained
September	Repeat effluent audit to verify the February actions worked	Effluent pit, monitoring results	QA manager
October	Confirm the EMS conforms to the 2026 edition before the transition audit	Clauses 4, 5, 6.1.4, 6.3, 9.3, 10	External consultant

The criteria column is left out here to save space. In the real programme, each row also names its criteria (the clauses, the procedures, the permit), its method (on site, remote, combined) and when the report goes to which manager.

Want the programme template and the practice to fill it? Enrol in ISO 14001:2026 Internal Auditor and build a full programme on a case site, then plan and run two of its audits. About 14 hours, R3 850 while the special runs.

What is the difference between audit objective, criteria and scope?

The objective is why you are auditing. The criteria are what you audit against. The scope is where, what and when. ISO 14001:2026 now asks for all three for each audit.

• Objective: “Confirm the new hazardous waste contractor is controlled as WM-02 requires.” It gives the audit a question to answer, which shapes the checklist and the sample.
• Criteria: ISO 14001:2026 clauses 8.1 and 6.1.3, procedure WM-02, the waste management licence conditions held by the contractor, the site’s storage arrangements.
• Scope: hazardous waste store, dispatch yard, purchasing office, manifests and disposal certificates from June to March.

An audit with an objective finishes with an answer. An audit without one finishes with a list. Management can act on an answer.

Who should audit what?

Anyone competent who is not auditing their own work, wherever practicable. Rotate auditors across areas, pair new auditors with experienced ones, and bring in an external party where the site has no independent person with the technical knowledge.

Clause 9.2.2 b) asks you to select auditors and run audits so that they are objective and the audit process is impartial. On a 240 person plant you can usually manage independence: the engineering planner audits waste, the QA manager audits engineering. The note to 3.4.1 allows an external party to audit on the organisation’s behalf, which helps for ammonia plants and boiler stacks where few internal people know the technology.

Restaurant groups need a different pattern. At a 14 store group, rotate store managers so nobody audits their own store, and keep the head office functions (contractor control, legal register) for the SHEQ coordinator’s peer or an external auditor. Where ISO 9001 or ISO 45001 run alongside, some audits can be combined. Combined audits with ISO 9001, ISO 45001 and FSSC 22000 covers when that saves time and when it costs you.

How do you build the programme, step by step?

List the processes, score them, set frequencies, write an objective for each audit, assign auditors, and get the programme approved and filed. Then use it.

1. List every process and area in the EMS scope, including contractors and off-site stores.
2. Note the significant aspects and compliance obligations each one carries.
3. Score environmental importance, changes since the last audit, and previous internal and external results.
4. Set the frequency and timing: shift, season, peak production.
5. Write the objective, criteria and scope for each planned audit.
6. Assign auditors so nobody audits their own work, and record why each was chosen.
7. Set the method (on site, remote, combined), the reporting route and the deadline for reports.
8. Have top management approve the programme and keep it available as documented information.

How do you keep the programme alive during the year?

Review it whenever something changes, report every audit to relevant management, and take the programme’s results into management review. A programme that is never revised is a calendar.

Clause 6.3 asks for changes to be carried out in a planned way, and Annex A.6.3 lists 9.2.2 among the clauses that carry change requirements. A new line, a new permit, a spill or a contractor change should trigger a look at the programme, and often an extra audit. Clause 9.2.2 c) asks for results to reach relevant management, and audit results are a required management review input under 9.3.2 d). Not sure which ISO 14001 course fits your job? WhatsApp ASC on +27 61 483 0381.

Watch the transition timing too. Certification bodies expect the move to the 2026 edition over about three years, ending around 30 April 2029, but confirm the dates with your own certification body. Plan at least one audit against the full 2026 text before that visit.

Frequently asked questions

How often should ISO 14001 internal audits be done?

At planned intervals set by the organisation. ISO 14001:2026 sets no fixed frequency, but asks the programme to consider environmental importance, changes and previous results, so high importance areas are audited more often.

Must every clause be audited every year?

The standard does not say so. Most certification bodies expect the whole EMS to be covered over the certification cycle, with high importance processes audited more often.

Does the audit programme have to be documented in ISO 14001:2026?

Yes. Clause 9.2.2 now requires the audit programme itself to be available as documented information, as well as evidence of its implementation and of the audit results.

What is an audit objective in ISO 14001:2026?

The reason for a specific audit, such as confirming a new contractor is controlled. Clause 9.2.2 a) requires an objective, criteria and scope to be defined for each audit.

Can an external consultant do our ISO 14001 internal audits?

Yes. The notes to the audit definition in clause 3.4.1 allow an internal audit to be done by an external party on the organisation’s behalf. The organisation still owns the programme.

Who approves the internal audit programme?

ISO 14001:2026 does not name an approver. Approval by top management is good practice, because the programme needs resources and its results go to management review.

Which ASC course teaches you to build the audit programme?

Setting up the whole EMS, not only the audits? ISO 14001:2026 Understanding and Implementation builds every register and plan. Compare all four courses on the ISO 14001 training hub.

ISO 14001 is copyright and is not reproduced here. ASC is not affiliated with ISO.

Sources

• ISO 14001:2026, Environmental management systems, ISO
• ISO 19011:2026, Guidelines for auditing management systems, ISO