3.4 Auditing Clause 9.2: Internal Audit and the Internal Audit Programme
Key Takeaways
- ISO 14001:2015 Clause 9.2 is subdivided into 9.2.1 General and 9.2.2 Internal audit programme.
- Clause 9.2.1 requires audits to test conformity with the organization's own EMS requirements AND with ISO 14001, plus effective implementation and maintenance.
- Clause 9.2.2 requires the programme to consider environmental importance of processes, changes affecting the organization and previous audit results.
- Clause 9.2.2 b) requires objectivity and impartiality of the audit process, not organizational independence — auditing your own department is the breach.
- Internal audit must be examined at every surveillance audit under ISO/IEC 17021-1 Clause 9.6.2.1.
Auditing Clause 9.2: Internal Audit and the Internal Audit Programme
Quick Answer: ISO 14001:2015 splits internal audit into 9.2.1 General — conduct internal audits at planned intervals to determine whether the EMS conforms to the organization's own requirements and to ISO 14001, and whether it is effectively implemented and maintained — and 9.2.2 Internal audit programme, which requires an established programme covering frequency, methods, responsibilities, planning requirements and reporting. Internal audit is one of the elements that must be audited at every surveillance visit under ISO/IEC 17021-1 Clause 9.6.2.1, so it appears in almost every certification-cycle scenario.
What Clause 9.2.1 Actually Requires
The clause has a two-limb test that candidates routinely collapse into one:
- Conformity — does the EMS conform to (a) the organization's own requirements for its EMS, and (b) the requirements of ISO 14001:2015?
- Effectiveness — is the EMS effectively implemented and maintained?
An internal audit programme that only checks documents against ISO 14001 clauses satisfies limb 1(b) and nothing else. It misses the organization's own procedures, and it misses effectiveness entirely. That is a genuine and commonly graded nonconformity: the auditee has audits, but not audits that meet Clause 9.2.1.
What Clause 9.2.2 Requires
The organization shall establish, implement and maintain an internal audit programme including:
- frequency
- methods
- responsibilities
- planning requirements
- reporting of its internal audits
When establishing the programme, three considerations are mandatory:
| Consideration | What the auditor looks for |
|---|---|
| The environmental importance of the processes concerned | Higher frequency and depth for processes with significant aspects — effluent treatment, chemical storage, hazardous waste, emissions abatement |
| Changes affecting the organization | New lines, new permits, new sites, acquisitions, process modifications, regulatory change |
| The results of previous audits | Areas with prior findings revisited sooner and more deeply |
The organization shall also:
- a) define the audit criteria and scope for each audit;
- b) select auditors and conduct audits to ensure objectivity and the impartiality of the audit process;
- c) ensure that the results of the audits are reported to relevant management.
And it shall retain documented information as evidence of the implementation of the audit programme and of the audit results.
The Lead Auditor's Audit Trail for Clause 9.2
1. REQUEST THE PROGRAMME -> frequency, methods, responsibilities,
planning requirements, reporting
2. TEST THE RISK BASIS -> does depth track aspect significance,
change and prior results?
3. TEST CYCLE COVERAGE -> every ISO 14001 clause + every
significant aspect within the period?
4. TEST AUDITOR OBJECTIVITY -> who audited their own work?
5. SAMPLE ACTUAL REPORTS -> criteria and scope stated per audit?
findings evidenced? effectiveness tested?
6. TEST REPORTING -> did results reach relevant management?
7. TEST THE FEEDBACK LOOP -> do results appear in the Clause 9.3
management review input?
8. TEST CLOSURE -> were findings corrected under Clause
10.2 and verified as effective?
Step 4 deserves emphasis. Clause 9.2.2 b) does not say auditors must be independent of the organization — internal auditors are employees by definition. It requires selection and conduct that ensure objectivity and the impartiality of the audit process. In a small site, the practical solutions are cross-departmental auditing (the maintenance planner audits waste; the waste coordinator audits maintenance), rotation, or using a competent external contractor. The nonconformity arises when a person audits their own work or their own department.
Grading Clause 9.2 Findings
| Evidence found | Typical grade | Reasoning |
|---|---|---|
| No internal audits have ever been conducted | Major | Total absence of a required process; the EMS cannot demonstrate self-verification |
| Programme exists but Clauses 4, 5 and 9.3 have never been covered in the three-year cycle | Major | Whole-clause coverage gap; conformity of the EMS as a whole is unverified |
| Every internal audit was conducted by the person responsible for the area audited | Major | Clause 9.2.2 b) objectivity requirement systemically defeated |
| Audits cover all clauses, but reports record only document checks and never test implementation | Major | Clause 9.2.1 effectiveness limb not met across the programme |
| One scheduled audit of twelve slipped by six weeks, authorised and recorded | Minor | Isolated lapse in an otherwise functioning programme |
| Two of fifteen audit reports do not state the audit criteria | Minor | Isolated administrative breach of Clause 9.2.2 a) |
| Findings are reported to the EHS manager but never to the managers of the audited functions | Minor to Major | Clause 9.2.2 c) breach; grade on whether it defeats the programme's purpose |
Worked Scenario: The Audit That Never Left the Office
Evidence. At a Stage 2 audit of a paint manufacturer, the internal audit file contains twelve reports for the year. Each report is a two-page checklist confirming that a procedure exists and is at the correct revision. The site has three significant aspects: solvent vapour emissions, solvent-contaminated washwater, and bulk solvent storage. No internal audit report contains any record of a site visit, an operator interview, an emission monitoring result, or a bund inspection. The internal auditor is the Documentation Controller, who has completed EMS awareness training.
Analysis. Clause 9.2.1 requires audits to determine whether the EMS is effectively implemented and maintained, not merely documented. Twelve consecutive audits that verified only document existence mean the programme has never tested implementation of any significant aspect. This is not an isolated lapse; it is the design of the programme.
Finding. A major nonconformity against Clause 9.2.1, with supporting reference to Clause 9.2.2, because the internal audit programme raises significant doubt about the organization's ability to detect failures in the control of its significant environmental aspects — squarely within the ISO/IEC 17021-1 Clause 3.12 definition.
What the auditor must not do. Recommend that the company appoint a different internal auditor, specify a checklist format, or name a training provider. Those are consultancy. The finding states the requirement, the failure and the evidence; the auditee determines the remedy.
Why This Clause Matters Beyond Stage 2
Under ISO/IEC 17021-1 Clause 9.6.2.1, internal audits are among the elements that must be examined at every surveillance audit, alongside management review, actions on previous nonconformities, complaints, continual improvement progress, continuing operational control, changes, and use of certification marks. A certified organization that lets its internal audit programme lapse in Year 1 will have that failure found in Year 1 — and because internal audit is the mechanism that feeds management review, the failure rarely stays contained to Clause 9.2.
ISO 14001:2015 Clause 9.2.1 requires internal audits to provide information on whether the EMS conforms to which criteria?
At a manufacturing site, every internal audit of the waste management process was conducted by the Waste Management Coordinator. Which requirement is breached?
A paint manufacturer's twelve internal audit reports for the year each confirm only that a procedure exists at the correct revision, with no site observation, interview or monitoring data, across a site with three significant aspects. What is the most defensible finding?
Which consideration is NOT one of the three that ISO 14001:2015 Clause 9.2.2 requires when establishing the internal audit programme?