Management system guidance
9.0 Performance Evaluation
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
9.2 Internal audit
Clause 9.2 requires your organization to carry out internal audits at planned intervals to find out whether the environmental management system conforms to its own EMS requirements and to the requirements of ISO 14001:2026, and whether it is effectively implemented and maintained. The clause has two parts: 9.2.1 General and 9.2.2 ‘Internal audit programme’.
Under 9.2.2, your organization must establish, implement and maintain one or more internal audit programs covering the frequency, methods, responsibilities, planning requirements and reporting of audits. When setting up the program, it must take into account how environmentally important the processes are, any changes affecting the organization, and what previous audits found. It must also:
- Define the objective(s), criteria and scope of each audit;
- Select auditors and conduct audits in a way that ensures objectivity and an impartial audit process;
- Ensure audit results are reported to relevant management.
Documented information must be available covering the audit program(s), evidence that the program has been implemented, and evidence of the audit results.
What changed in ISO 14001:2026
Two changes are worth noting. First, each audit must now have defined audit objective(s) as well as criteria and scope, so the purpose of every audit should be stated in the plan. Second, the documented information requirement now explicitly includes the audit program itself, not just evidence of its implementation and results, and is expressed as ‘available’ rather than ‘retained’. Annex A also links the audit program to the new 6.3 Planning of changes, so audits can be used to check that changes have been well managed.
Setting up the audit program
Base the program on the environmental importance of each process rather than simply working through the clauses. Processes linked to significant environmental aspects, compliance obligations and higher-level risks and opportunities should be audited more often than low-impact support activities. When planning audits and their frequency, consider:
- Processes and activities associated with significant environmental aspects (see 6.1.2);
- Operational controls and emergency arrangements (see 8.1 and 8.2);
- Compliance obligations and the results of compliance evaluation (see 9.1.2);
- Risks and opportunities (see 6.1.4);
- New or changed processes, sites, products, equipment or legislation;
- Externally provided processes, products or services that are controlled or influenced by your organization;
- Activities spread across multiple locations or shifts;
- Previous internal and external audit findings, including nonconformities and how effective the corrective actions were;
- Environmental incidents, complaints and regulator feedback.
All parts of the EMS should be covered over a defined audit cycle, with higher-risk processes visited more frequently. Unscheduled audits may be added after incidents, regulatory inspections, operational changes or concerns raised at management review. Review the frequency and effectiveness of the program as part of 9.3 Management review.
Audit objectives, criteria and scope
For each audit, state:
- Objective(s) – what the audit is meant to achieve, for example to confirm that spill controls in the chemical store are effective, or to verify that a new waste contractor arrangement has been implemented as planned;
- Criteria – the policies, procedures and requirements that audit evidence is compared against, such as ISO 14001:2026, your EMS procedures, permit conditions and other compliance obligations;
- Scope – the extent and boundaries of the audit, such as locations, processes, activities and the time period covered.
Audit evidence consists of records, statements of fact or other information that is relevant to the criteria and can be verified.
Auditor objectivity and competence
Wherever practicable, auditors should be independent of the activity being audited, and in all cases they should act free from bias and conflict of interest. In smaller organizations this may mean cross-auditing between departments or using an external auditor for areas the internal auditor manages. Auditors need environmental knowledge as well as audit skills; ISO 19011 gives guidance on auditor competence and on managing audit programs (see 7.2 Competence).
Conducting and reporting audits
Before auditing an area, check the status of findings from the last audit there. A process-based approach works well once the EMS is established: start with the process owner, follow the process from inputs to outputs, and look at how environmental aspects, operational controls, monitoring and compliance requirements are managed along the way. A checklist helps keep audits systematic and consistent, but should not replace professional judgment.
The audit report should identify the area and processes audited, the objective(s), criteria and scope, the audit team, persons interviewed, nonconformities, observations, opportunities for improvement and any positive practice noted. Hold a closing meeting to present the results, then report them to relevant management. Nonconformities found during internal audits must be subject to appropriate corrective action through 10.2 Nonconformity and corrective action, and audit results are an input to management review and continual improvement (see 10.1).
You should seek and record evidence that an internal audit program exists and reflects environmental importance, changes and previous results; that each audit has defined objective(s), criteria and scope; that auditors are objective and impartial; that audits have been carried out as planned and results reported to relevant management; that nonconformities have been followed up; and that documented information is available for the program, its implementation and the audit results.
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.