10.2 Stage 1 Documented Information Review & Outputs

10.2 Stage 1 Documented Information Review & Outputs

Quick Answer: Stage 1’s documented-information review asks whether the EMS is designed and described well enough to support Stage 2. Auditors examine scope, policy, aspects/impacts, compliance obligations, objectives, controls, and evidence that internal audit and management review exist. Stage 1 outputs are readiness conclusions, areas of concern, and Stage 2 planning inputs—not a final certificate recommendation based on full implementation evidence.

Why documented information matters at Stage 1

ISO 14001 requires documented information to the extent necessary for EMS effectiveness, plus specific retained information in several clauses. For certification audits, Stage 1 uses that documented layer as the map of the system. Without a coherent map, Stage 2 sampling becomes guesswork and the risk of wasted audit days—or unfair findings—rises sharply.

Remember the contrast: Stage 1 asks, “Is the map credible and is the organization ready to be tested?” Stage 2 asks, “Does practice match the map and meet ISO 14001?”

What the Stage 1 document review typically covers

Lead auditors should approach EMS documentation as an interconnected system, not a pile of unrelated files. A practical Stage 1 checklist includes:

System identity and leadership direction

• Scope of the EMS (boundaries, products/services, sites, exclusions if any and justification).
• Environmental policy appropriate to the organization’s context and including commitments required by Clause 5.2.
• Roles, responsibilities, and authorities relevant to EMS effectiveness (including reporting on EMS performance).

Planning core (high exam value for EMS)

• Process for identifying environmental aspects and determining significant aspects, including life-cycle perspective as applicable.
• Process for determining and accessing compliance obligations, and planning actions to address them.
• Environmental objectives, planning to achieve them, and linkage to significant aspects/compliance obligations.
• Actions to address risks and opportunities related to aspects, compliance obligations, and other issues/needs.

Support and operation (design evidence)

• Competence/awareness arrangements and communication processes as documented.
• Documented information control methods.
• Operational planning and control for significant aspects and outsourced processes.
• Emergency preparedness and response arrangements relevant to environmental emergency scenarios.

Performance evaluation and improvement (readiness gates)

• Monitoring, measurement, analysis, and evaluation design—including compliance evaluation.
• Internal audit programme and evidence audits are planned and performed.
• Management review inputs/outputs showing reviews are planned and performed.
• Nonconformity and corrective action process description (implementation depth comes mainly at Stage 2).

During Stage 1, auditors look for consistency: Does the scope match the site tour? Do significant aspects connect to operational controls and objectives? Do compliance obligations appear in planning and evaluation design? Incoherence is a readiness problem even if individual templates look polished.

Documented information vs implementation evidence

A client can “pass” a superficial document glance yet fail Stage 2 because controls are not implemented, monitoring is not performed, or management review is a signature exercise without EMS substance. Conversely, strong operational practice cannot rescue Stage 1 if the organization cannot show a defined scope, policy, or completed internal-audit/management-review cycle when the CB requires those readiness signals.

Required Stage 1 outputs

Stage 1 must leave a clear trail for the client and for Stage 2 planning. Typical outputs include:

1. Stage 1 report (or equivalent documented conclusions) summarizing what was reviewed, site/conditions understanding, and readiness status.
2. Areas of concern that could be classified as nonconformities during Stage 2 if not resolved—written so the client understands what must change before Stage 2.
3. Confirmation or refinement of audit scope, including sites, processes, and any multi-site considerations.
4. Stage 2 planning inputs: processes/shifts to sample, competence needs (e.g., wastewater specialist), time allocation, and logistics.
5. Agreement on Stage 2 timing—including deferral when readiness is not demonstrated.

Exam tip: Stage 1 outputs are about readiness communication and planning, not about pretending Stage 2 is finished. A Stage 1 report that only lists document titles without stating readiness implications is weak professional practice.

Handling gaps found in documentation

When Stage 1 finds missing or inadequate documented information (for example, no environmental policy, aspects process that ignores a major process line, or no compliance-obligations determination method), the lead auditor:

• Records the issue as an area of concern tied to the relevant ISO 14001 requirement.
• Explains the Stage 2 risk if the organization proceeds unchanged.
• Avoids consulting-style rewriting of the client’s EMS (impartiality).
• Recommends corrective work and, when appropriate, rescheduling Stage 2.

If the organization insists on keeping an aggressive Stage 2 date despite critical gaps, the CB still controls whether Stage 2 proceeds; proceeding into a predictable Major Nonconformity helps no one.

Closing the Stage 1 documentation story

Treat Stage 1 documented-information review as building the Stage 2 investigation plan. The output package should make Stage 2 focused, fair, and efficient—while making readiness gaps impossible to ignore. That is how Domain 5 expects Lead Auditors to connect paperwork review to certification-audit discipline.