7.2 Audit Objectives & Criteria

7.2 Audit Objectives & Criteria

Quick Answer: Audit objectives state what the audit is trying to achieve; audit criteria are the policies, procedures, and requirements used as the reference for evaluation. Lead auditors also need a clear scope (boundaries and extent). Objectives + criteria + scope form the triangle that drives planning, sampling, findings, and reporting.

If you cannot state the objectives and criteria in one clear paragraph before opening meetings begin, the audit is not ready. ISO 14001 Lead Auditor exams frequently test whether you can separate these concepts and apply them to realistic EMS scenarios.

Audit Objectives

Audit objectives define the intended outcome of the audit. They answer: Why are we auditing, and what decision or assurance do we need? Objectives are typically established by the audit client and refined with the person managing the audit programme and the lead auditor.

Common EMS / ISO 14001 audit objectives include:

Objectives should be realistic for the available time, competence, and access. An objective such as “verify 100% of legal compliance worldwide in two days” is not achievable and invites superficial auditing. Better: “Evaluate conformity of Site X EMS with ISO 14001 and sampled compliance obligations related to wastewater discharge for the period January–June 2026.”

Who Sets Objectives?

• Audit client — organization or person requesting the audit (may be top management, a customer, or a CB’s scheme process).
• Audit programme manager — ensures objectives align with the overall programme (e.g., annual internal audit programme covering all processes).
• Lead auditor — confirms objectives are clear, achievable, and consistent with scope and criteria before accepting or finalizing the plan.

If objectives change mid-audit (for example, a major spill occurs and the client expands the focus), the lead auditor should renegotiate scope, resources, and criteria as needed and document the change.

Audit Criteria

Audit criteria are the set of requirements used as a reference against which objective evidence is compared. Criteria are the “yardstick.” Without criteria, you can observe activities, but you cannot determine conformity or nonconformity in a defensible way.

For EMS audits, criteria typically include one or more of:

1. ISO 14001 requirements (and, where applicable, related normative references or scheme rules)
2. Legal requirements and other compliance obligations applicable to the organization’s environmental aspects
3. The organization’s own EMS — environmental policy, objectives, documented information, operational controls, emergency procedures
4. Contractual or customer-specific environmental requirements (especially second-party audits)
5. Industry codes or voluntary commitments the organization has adopted as obligations

Criteria Examples in EMS Language

When raising a nonconformity, always link the finding to a specific criterion. “Housekeeping looks poor” is not a finding. “Used oil drums were unlabeled in the north yard, contrary to procedure ENV-OP-12 §5.2 and hazardous-waste labeling requirements” is a finding tied to criteria.

Audit Scope

Although this section focuses on objectives and criteria, scope completes the planning set. Scope describes the extent and boundaries of the audit — physical locations, organizational units, activities, processes, and the time period covered.

Example scope statement for an internal EMS audit:

Audit of the Environmental Management System at Plant Riverton covering receiving, production coating lines, wastewater treatment, and shipping for activities from 1 January 2026 to the audit dates, against ISO 14001:2015, applicable legal compliance obligations for air and water, and EMS documented information.

Scope must match objectives. If the objective is certification readiness for the whole multi-site EMS, excluding a site with major significant aspects without justification undermines the objective.

How Objectives, Criteria, and Scope Interact

Think of a decision tree:

1. Objective — Why audit? (e.g., confirm Stage 2 readiness)
2. Criteria — Against what? (ISO 14001 + legal obligations + EMS docs)
3. Scope — What is included/excluded? (sites, processes, period)
4. Plan — Where to sample, whom to interview, what records to review
5. Findings — Evidence evaluated only against the agreed criteria within scope

If evidence is interesting but outside scope or unrelated to criteria, note it carefully. It may become an opportunity for improvement, a suggestion for a future audit, or — if it indicates a serious risk — something to communicate under professional care, but do not invent criteria after the fact to force a nonconformity.

Setting Objectives for Different Party Types

A lead auditor switching from internal audits to certification audits must adjust vocabulary and rigor: certification objectives are conformity-focused within scheme rules; internal audits may deliberately probe effectiveness and improvement more aggressively.

Practical Planning Checklist

Before the opening meeting, confirm you can answer:

• What are the documented audit objectives?
• What exact criteria apply (standards, laws, procedures, contracts)?
• What is in scope and out of scope?
• Do time and team competence match the objectives?
• How will fulfilment of objectives be reported to the client?

Audits fail more often from unclear objectives and fuzzy criteria than from weak checklists. Master this triangle and your sampling, interviews, and nonconformity writing become coherent and exam-ready.