How to Survive an ISO 14001 Audit

ISO 14000, Environmental Management, Sustainability

Gabriele Crognale

In the grand scheme of developing an environmental management system (EMS) that conforms to ISO 14001, one should not lose sight of what to expect during an EMS audit conducted by a registrar to establish conformance to ISO 14001. Such audits in registrar’s terms are called registration audits. Subsequent audits to determine whether a facility maintains conformance to ISO 14001 are called surveillance audits.

The main purpose of the registration audit is to certify that an organization’s EMS has been designed to conform to the requirements of ISO 14001 and to recommend that organization for certification to a governing body that accredits the registrar.

Getting There From Here

The first step on the road to ISO certification is to ensure that your facility’s management understands the myriad requirements and responsibilities associated with developing an EMS.

With those responsibilities clear, we can proceed to the next plateau: Since an ISO-influenced system thrives upon an accounting approach of checks, tests, and rechecks, a prudent next step would be to review the documents and procedures that make up the EMS manual (not an ISO requirement, but it does come in handy!).

Once the manual has been reviewed to ensure a greater degree of confidence, the next logical step would be to test the EMS developed by way of an internal EMS audit.

We should add, however, that before the internal audit team begins to work on their first audit, you should take the time to provide the audit team that “volunteered” for this assignment some fundamental training in what EMS audits are all about and what is required of each team member.

Additional criteria regarding ISO 14001 audits can found in the supplemental ISO standards of ISO 14010, 14011, and 14012: 1996(E).

Such training can be provided by in-house ISO experts or by outside consultants with specialized EMS training expertise. It pays to keep in mind, however, that there are a number of practitioners out there performing this service, but the EMS community does not yet have the environmental equivalent of Gomez.com to help you compare service providers. It will fall to you to thoroughly check the references of those potential service providers. In other words, kick the tires before you drive that new car.

With your auditors thoroughly trained and confident in their EMS auditing skills, they should be ready to check your facility’s EMS.

Preparing for the Real Thing

The most critical aspect of an organization’s audit is to ensure that the elements of its EMS are in order and conform to the components of Clause 4 of ISO 14001. Clause 4 refers to all of the requirements of ISO 14001 that need to be addressed as a key condition of certification by the registrar. That knowledge should be of prime importance to the facility manager, and that person should ensure that the key components have been accounted for prior to the first scheduled audit.

More often than not, the facility manager will schedule a preassessment audit with a second party to test the extent of a facility’s readiness for the registrar. The key is ensuring that the preassessment provides value to the client.

From our experience, the following points should be considered during the critical preassessment:

1.	Plan to interview as many managers and line workers as you can. This exercise can provide valuable anecdotal information that may point to gaps that your EMS development team may have overlooked. Then, use the information that’s been gleaned from these interviews to ...

Research whether additional documents may need to be reviewed and included in the list of EMS items that are linked to key ISO procedures. For example, you may find that specific regulatory documents or training requirements may have been overlooked, and their absence may be crucial to the continued success of your EMS.

Review the key ISO 14001 procedures and ensure that critical links are included where necessary. Don’t be overly concerned with any redundancy that you may feel that exists between some of the procedures in question. If critical links were missing, then you would have a right to be concerned.

For example, the procedure dealing with legal and other requirements complements the procedure dealing with monitoring and measuring, and it can be linked to the procedure dealing with training, awareness, and competence. Having strategic links between these procedures strengthens your EMS.

Check training records of key employees. Workers who have critical job responsibilities with respect to environmental considerations should have received some form of (documented) training. If not, or if records are spotty, this should be a red flag for you.

The Audit: It’s Show Time!

Assuming that your preassessment audit went well and that key shortcomings in your EMS program have been identified and corrected, you should be ready for the registrar’s audit. While we are on the subject, here are a few key points that you should consider:

	Any questions or apprehensions you may have had about the registrar and how their auditors conduct audits should have been addressed to your satisfaction already. Otherwise, you may get off on the wrong foot even before the audit begins.
	Ensure that the registrar’s auditor selected for your facility will be available for subsequent audits. Otherwise, you may have to reeducate other auditors about the facility “on your nickel.”
	Ensure that the auditor has provided you a copy of their audit plan, which identifies what ISO element is to be audited, who is to be interviewed, and what areas will be audited.

Presuming that you have attended to all these items, the audit should be rather straightforward.

Among the items you may want to consider during a registration or a surveillance audit include the following:

1.	The auditor is at your facility to verify that you follow your procedures and work instructions — and that you can document that. In a nutshell, ISO auditing reviews confirm that you “say what you do and do what you say.”
2.	If the auditor interprets a component of your EMS in a way that doesn’t agree with your interpretation, don’t just accept that interpretation. You are free to challenge the auditor and to ask them to explain their position. If you still disagree, you may have to wage an ongoing give-and-take, appeal, or consider another registrar, if you have the time.
3.	If the auditor provides some insight into areas where your EMS could be tweaked, take it. If they are experienced, this is useful added value information that comes under the category of continual improvement.
4.	If the auditor makes observations that could lead to nonconformances and you concur, make sure to address them as soon as possible, especially if these items could jeopardize your EMS certification — and especially if the auditor decides to continue the audit to see whether these nonconformances have been closed out as a condition of certification.

In a Nutshell

Surviving a registrar’s audit, whether the first time registration audit or the ongoing surveillance audit, requires continual diligence on the part of the facility manager, the ISO core team, and the outside ISO support services. It’s not a one shot deal, but that diligence does pay off with significant dividends.

ISO 14000 ISO 14000 ISO 14000 ISO 14000 ISO 14000 ISO 14000 ISO 14000 ISO 14000 ISO 14000 ISO 14000 ISO 14000 ISO 14000 ISO 14000 ISO 14000