An internal audit is how an organization checks, for itself, that its environmental management system (EMS) works before a certification body or regulator does. If you have been asked to run one, or you are preparing for the CQI (Chartered Quality Institute) and IRCA (International Register of Certificated Auditors) ISO 14001 Lead Auditor course, this guide gives you the sequence step by step. For the concept behind it, see our explainer on internal audit in ISO 14001:2026.

What are the steps in an ISO 14001 internal audit?

An internal audit follows 9 steps, from building the programme to following up corrective action.

1. Establish the audit programme with frequency, methods, responsibilities and reporting.
2. Set the objectives, scope and criteria for the specific audit.
3. Select impartial, competent auditors.
4. Prepare: review documents and earlier audit results, and draft your questions.
5. Hold the opening meeting to confirm the plan with the auditee.
6. Gather objective evidence on site and in the records.
7. Evaluate and record findings against the criteria.
8. Hold the closing meeting and report results to relevant management.
9. Follow up corrective action and feed results into management review.

What does ISO 14001:2026 clause 9.2 require?

Clause 9.2 requires internal audits at planned intervals, run under an established audit programme, to check that the EMS conforms and is effectively implemented.

The audits check conformity with the organization’s own EMS requirements and with ISO 14001, and they check that the EMS is effectively implemented and maintained. The programme covers matters such as audit frequency, methods, responsibilities, planning, reporting, criteria, scope, auditor selection and objectivity, and it considers the environmental importance of the processes, changes affecting the organization and the results of previous audits. According to our own guide, the 2026 edition adds defining audit objectives to the programme. Confirm the exact wording in the standard.

How do you plan an ISO 14001 internal audit?

Plan by setting the objectives, scope and criteria, choosing impartial auditors, and preparing from documents and earlier results.

What is the difference between scope and criteria?

The scope is the boundary of the audit: which processes, sites, activities and periods are covered. The criteria are what you measure against: ISO 14001:2026, the organization’s own EMS procedures and its compliance obligations.

Who should audit?

Choose auditors who are competent and objective. An auditor should not audit their own work where it could affect the objectivity of the audit, so in a small organization you may swap areas between colleagues.

What should you prepare?

Review the procedures, the environmental aspects register, the compliance obligations list and the results of earlier audits. Then draft open questions for each process. Our guide to audit questions during ISO 14001:2026 audits gives examples, and our ISO 45001 audit plan and checklist guide shows the same planning approach for a related standard.

An internal audit is not a search for blame; it is a search for evidence that the EMS works.

How do you gather evidence in an ISO 14001 internal audit?

Gather objective evidence in 5 ways: interviews, site walkarounds, observation of activities, document and record review, and sampling.

Combine several methods before you draw a conclusion. A procedure may look perfect on paper, so check it against what you see and hear on site.

How do you classify audit findings?

Classify each finding as conformity, opportunity for improvement or nonconformity, based on the objective evidence and the criteria.

Your audit programme may use other terms or grades, so follow its rules. A good nonconformity statement names the requirement, describes the evidence and states what is wrong.

How do you report and follow up an internal audit?

Hold a closing meeting, report the results to relevant management, and follow up corrective action until it is completed and checked.

At the closing meeting, present findings and agree them with the auditee. The report goes to the relevant management, and the organization keeps documented information as evidence of the audit and its results. Corrective action planning, responsibilities and timescales follow, and the auditor later checks whether the actions were completed. The results are also an input to management review.

What mistakes should internal auditors avoid?

The biggest mistakes are auditing only paperwork, auditing your own work and raising findings without evidence.

• Paper-only audits. Check the documents against practice on site.
• Auditing your own work. Objectivity is part of the audit programme.
• Findings without evidence. Record what you saw, who said it and which record supports it.
• No follow-up. An audit that ends at the report does not improve the EMS.
• Copying last year’s plan. Update it for changes and previous results.

Frequently asked questions

Where 3FOLD Training fits

3FOLD Training is a CQI IRCA Approved Training Partner (ATP 6039853), licensed by the Knowledge and Human Development Authority (KHDA) in Dubai. The ISO 14001 Lead Auditor course is delivered as 40 hours of Virtual Instructor Led Training (VILT), with learning management system (LMS) access for recordings and mock exams, and you can check the next available batch on the course page. We prepare you for the exam; CQI and IRCA examine and certify. If you are new to audits, read how a company can prepare for its first ISO 14001 audit.