5.2 Stage 1 Audit Objectives, Documentation Review & Readiness Assessment

5.1 Stage 1 Audit Objectives, Documentation Review & Readiness Assessment

Quick Answer: The Stage 1 audit in third-party ISO 14001 certification (governed by ISO/IEC 17021-1:2015 Clause 9.3.1.2) serves to review the client's documented EMS, evaluate site-specific conditions and context, assess understanding of key standard requirements (particularly significant environmental aspects and compliance obligations), collect critical scoping data, and determine readiness for the Stage 2 audit. Crucially, the organization must have conducted at least one full internal audit and a top management review prior to Stage 2. Stage 1 outputs identify "Areas of Concern" that could become nonconformities in Stage 2, while maintaining a strict boundary against management consultancy.

---

Purpose and Objectives of the Stage 1 Audit

Initial third-party certification to ISO 14001:2015 is structured into a mandatory two-stage audit process as defined in ISO/IEC 17021-1:2015 (Conformity assessment — Requirements for bodies providing audit and certification of management systems). The Stage 1 audit establishes the foundational baseline for the entire certification journey.

According to ISO/IEC 17021-1 Clause 9.3.1.2.2, the explicit objectives of Stage 1 are to:

1. Audit the client's management system documented information: Verify that the EMS is designed in conformity with ISO 14001:2015 requirements and that documented policies, registers, and operational criteria exist;
2. Evaluate the client's location and site-specific conditions: Undertake discussions with client personnel to determine the operational reality, physical layout, sensitive neighboring receptors, and readiness for Stage 2;
3. Review the client's status and understanding regarding standard requirements: Assess whether personnel understand the core tenets of ISO 14001, in particular the identification of key environmental performance indicators, significant environmental aspects (SEAs), risks and opportunities, and operational controls;
4. Collect necessary scoping and regulatory information: Gather information regarding the scope of the EMS, processes and location(s) used, related statutory and regulatory aspects, environmental permits, consent limits, and compliance obligations;
5. Review the allocation of resources for Stage 2: Agree with the client on the specific details, schedule, logistics, and auditor competencies required for the Stage 2 audit;
6. Provide a focus for planning Stage 2: Gain a sufficient understanding of the client's EMS and site operations in the context of potential environmental aspects to establish a risk-based Stage 2 audit plan;
7. Evaluate whether internal audits and management reviews are being planned and performed: Substantiate that the degree of implementation demonstrates operational maturity and readiness for Stage 2.

+-------------------------------------------------------------------------+
|                   THE STAGE 1 READINESS GATEWAY                         |
+-------------------------------------------------------------------------+
|  Document Review      Site & Context Recon      Readiness Verification   |
|  - Policy & Scope     - Layout & Receptors      - Internal Audits Done? |
|  - Aspects Register   - Permit Boundaries       - Mgmt Review Complete? |
|  - Legal Register     - Process Complexity      - SEAs Understood?      |
+----------------------------+--------------------------------------------+
                             | Outputs
                             v
+-------------------------------------------------------------------------+
|                   STAGE 1 AUDIT REPORT & OUTCOMES                       |
|  - Determination: Ready for Stage 2 / Not Ready                         |
|  - Identification of "Areas of Concern" (Pre-Nonconformities)           |
|  - Agreed Stage 2 Scope, Audit Team Competencies & Schedule             |
+-------------------------------------------------------------------------+

---

Document Review Methodology in Stage 1

While Stage 1 is not merely a desk audit, the rigorous review of documented information (aligned with ISO 19011:2018 Clause 6.3.1) constitutes a primary mechanism for evaluating system design. The audit team scrutinizes the following core documentation:

1. Context, Scope, and Leadership (Clauses 4 and 5)

• EMS Scope Statement (Clause 4.3): Verification of physical, geographic, and organizational boundaries. The auditor evaluates whether the organization has unjustifiably excluded activities, products, or services that interact with the environment or attempted to exclude high-risk facilities;
• Context and Stakeholder Expectations (Clauses 4.1 & 4.2): Evidence that internal/external issues (including climate change) and interested party requirements have been systematically determined;
• Environmental Policy (Clause 5.2): Documented commitments to pollution prevention, compliance fulfillment, and continual improvement, signed by top management and appropriate to the organization's context.

2. Planning and Risk Assessment (Clause 6)

• Environmental Aspects and Impacts Register (Clause 6.1.2): Scrutiny of the aspect identification methodology across normal, abnormal, and emergency conditions, with a life-cycle perspective. The auditor verifies that significance scoring criteria are rational, repeatable, and consistently applied;
• Compliance Obligations Register (Clause 6.1.3): Comprehensive identification of applicable environmental laws, discharge consents, emissions permits, hazardous waste licenses, and voluntary customer commitments;
• Environmental Objectives and Plans (Clause 6.2): Documented objectives aligned with the environmental policy, measurable where practicable, with defined resources, responsibilities, and timeframes.

3. Operational Control and Emergency Preparedness (Clause 8)

• Operational Criteria (Clause 8.1): Key operating procedures, maintenance criteria, and process control parameters for significant aspects (e.g., wastewater treatment plant operating ranges, bund inspection logs, abatement system maintenance);
• Emergency Response Procedures (Clause 8.2): Procedures for preventing and mitigating environmental emergencies (e.g., chemical spills, fuel line ruptures, toxic vapor releases, firewater containment).

4. Performance Evaluation and Governance (Clause 9)

• Internal Audit Records (Clause 9.2): Internal audit procedures, program schedules, completed audit reports, and nonconformity logs demonstrating system coverage;
• Management Review Minutes (Clause 9.3): Comprehensive management review records demonstrating that top management evaluated EMS suitability, adequacy, and effectiveness.

---

Evaluating Readiness for Stage 2: The Non-Negotiable Prerequisites

A critical responsibility of the Lead Auditor during Stage 1 is determining whether the organization is truly ready to undergo the Stage 2 on-site audit. Stage 2 must never proceed if systemic foundational elements are missing.

The Two Mandatory Prerequisites for Stage 2:

1. Internal Audits (Clause 9.2): The organization must have executed at least one comprehensive cycle of internal audits covering the entire EMS scope and all applicable clauses of ISO 14001:2015;
2. Management Review (Clause 9.3): Top management must have conducted a complete management review evaluating all mandatory inputs (Clause 9.3.a through 9.3.g) and producing documented decisions/outputs.

If the auditor discovers during Stage 1 that internal audits have only covered selected departments, or that the management review was deferred, the client is not ready for Stage 2. Proceeding to Stage 2 under such circumstances guarantees immediate Major Nonconformities against Clauses 9.2 and 9.3, rendering certification impossible and wasting client and audit team resources.

Stage 1 Decision Pathways

Upon concluding Stage 1, the Lead Auditor must document one of three formal recommendations:

• Ready for Stage 2: Documentation conforms to requirements; prerequisites are fully met; site understanding is clear. Stage 2 proceeds as scheduled;
• Ready Subject to Action on Areas of Concern: Minor documentation ambiguities or localized implementation gaps identified. The client agrees to resolve these concerns prior to Stage 2. Stage 2 proceeds as planned, with specific auditor focus on these areas;
• Not Ready for Stage 2 / Repeat Stage 1: Substantial deficiencies discovered (e.g., incomplete aspect register, missing compliance evaluation, no management review, unresolved legal enforcement actions). The Stage 2 audit must be postponed, and a revised Stage 1 (or documented follow-up) must be conducted once corrective measures are implemented.

---

Stage 1 Outputs: Reporting Areas of Concern

The deliverable of the Stage 1 audit is the Stage 1 Audit Report. Under ISO/IEC 17021-1 Clause 9.3.1.2.3, the report must formally communicate:

1. Summary of documentation review findings;
2. Evaluation of site-specific conditions, activities, and environmental context;
3. Confirmation of the agreed scope of certification;
4. Identification of Areas of Concern (often termed "Points of Concern" or "Issues Requiring Resolution");
5. Allocation of resources and agreed dates/logistics for Stage 2.

+-------------------------------------------------------------------------+
|             THE PROGRESSION OF AN UNRESOLVED AREA OF CONCERN            |
+-------------------------------------------------------------------------+
| STAGE 1 AUDIT:                                                          |
| "Area of Concern 01: The organization's procedure for evaluating        |
| compliance obligations (Clause 9.1.2) lacks documented frequency and    |
| does not address municipal sewer discharge consent limits."             |
+------------------------------------+------------------------------------+
                                     | Unresolved over 60-day interval
                                     v
+-------------------------------------------------------------------------+
| STAGE 2 AUDIT:                                                          |
| "Major Nonconformity (Clause 9.1.2): The organization failed to evaluate|
| compliance with municipal sewer consent limits, resulting in undetected |
| exceedances of heavy metals over the preceding quarter."                |
+-------------------------------------------------------------------------+

Lead Auditor Exam Rule: In Stage 1, third-party certification bodies typically do not issue formal nonconformity notices (Minor/Major NCs) because the system's operational implementation has not yet been audited. Instead, findings are designated as Areas of Concern. However, if an Area of Concern remains unaddressed by the client when the Stage 2 audit commences, it must be raised as a Nonconformity during Stage 2.

Time Interval Between Stage 1 and Stage 2

IAF guidelines and certification body rules require a reasonable interval between Stage 1 and Stage 2—typically 30 to 90 days. This provides the auditee sufficient time to remediate documented Areas of Concern and build operational history. If the interval exceeds 6 months, the Stage 1 audit is considered expired under most accreditation rules, requiring Stage 1 to be repeated to account for changes in operational context.

---

Gap Analysis vs. Stage 1 Audit: The Consultancy Boundary

Candidates in the CQI/IRCA Lead Auditor examination must clearly understand the ethical and regulatory boundary separating a Gap Analysis from a Stage 1 Certification Audit.

Under ISO/IEC 17021-1:2015 Clause 5.2 (Management of Impartiality) and Clause 3.2, certification bodies and their auditors are strictly prohibited from providing management system consultancy.

The Impartiality Line: If a certification auditor during Stage 1 states: "Your aspect evaluation matrix is inadequate; you should use a 5x5 severity-frequency matrix like this template I brought, and set your significance threshold at 15," the auditor has committed a severe regulatory violation by delivering consultancy. The auditor may only state: "The methodology in procedure PR-04 does not define clear criteria for determining significance as required by Clause 6.1.2(b). This is an Area of Concern."

---

Stage 1 vs. Stage 2 Audits: Comprehensive Comparison

---

Realistic Audit Scenario: The Premature Stage 1 Application

Scenario: A precision CNC engineering company specializing in aerospace turbine blades applies for ISO 14001 certification. The Lead Auditor arrives on-site for the Stage 1 audit. The company presents an Environmental Manual, an Aspect Register identifying 14 significant environmental aspects (including coolants, metal swarf, and solvent vapor degreasing), and a Compliance Obligations Register.

Upon reviewing Clause 9.2 records, the Lead Auditor notes an internal audit report dated two weeks prior. However, the report indicates that the internal auditor only audited the Human Resources department and the Quality Inspection lab; manufacturing operations, chemical storage, hazardous waste handling, and cooling towers were not audited. Furthermore, when the auditor requests the Management Review records (Clause 9.3), the Operations Director states: "Our Managing Director was overseas on a trade mission last month, so we scheduled the management review for next week, just before your Stage 2 audit begins. We wanted to get Stage 1 finished first."

Lead Auditor Evaluation: Under ISO/IEC 17021-1 Clause 9.3.1.2.2(e), the Stage 1 audit must evaluate whether internal audits and management reviews are being planned and performed to substantiate that the client is ready for Stage 2. The internal audit failed to cover significant operational processes, and the management review was never conducted. The EMS lacks evidence of operational maturity and governance oversight.

The Lead Auditor formally issues a Stage 1 Report recommending that Stage 2 be postponed. The report lists two major Areas of Concern: (1) Incomplete internal audit scope failing to verify operational controls across manufacturing and chemical handling (Clause 9.2), and (2) Absence of a completed top management review evaluating EMS performance (Clause 9.3). Stage 2 cannot be scheduled until the organization submits evidence that a full internal audit and top management review have taken place.