Knowing the law is one thing, and being able to show that you follow it is another. An environmental management system (EMS) has to do both, and an auditor will ask for proof of the second. This guide explains how to evaluate compliance with legal and other requirements in ISO 14001:2026, for managers and for anyone preparing for the CQI (Chartered Quality Institute) and IRCA (International Register of Certificated Auditors) ISO 14001 Lead Auditor course.

What does ISO 14001:2026 require for compliance evaluation?

It requires the organization to determine its compliance obligations, evaluate whether it meets them and keep the results.

Two parts of the standard work together. In planning, the organization determines the compliance obligations that relate to its environmental aspects and how they apply, and takes them into account in its EMS. In performance evaluation, it sets how often it will evaluate compliance, evaluates it, acts if needed and keeps knowledge of its compliance status up to date. It also keeps documented information as evidence of the results. In the 2015 edition these were clauses 6.1.3 and 9.1.2, so confirm the numbering in the 2026 text. According to the CQI and IRCA summary of key updates, clause 6.1.3 has minor changes related to documenting compliance obligations. Our guide to what ISO 14001:2026 is gives the wider picture.

What counts as legal and other requirements?

Compliance obligations are the legal requirements you must meet and the other requirements you have to or choose to meet.

The key point is that “other requirements” go beyond the law. Use the table below to check you have covered each type.

You cannot show you comply with a requirement you have not written down.

How do you set up a compliance evaluation process?

List your obligations, give each an owner, decide how often to check, choose a method and record the result.

1. List the obligations that relate to your environmental aspects, and note how each applies to your sites and activities.
2. Assign an owner for each obligation or group of obligations.
3. Decide the frequency of evaluation, based on the obligation and its risk.
4. Choose the method for each, such as inspection, data review or audit.
5. Record the result with a date, what was checked and what was found.
6. Act on gaps and report the compliance status to management.

The list of obligations can be a register, a spreadsheet or a database. The standard does not prescribe the format, so choose one people will keep up to date. Our guide to environmental aspects and impacts in ISO 14001:2026 shows where the obligations link to your activities.

How often should you evaluate compliance, and by what method?

The organization decides the frequency and the method, based on the obligation and the risk of getting it wrong.

A permit with a monitoring limit may need regular checks, while a stable contract clause may need a yearly check. Different methods suit different obligations, and one evaluation can often cover several.

Our guide to how to conduct an ISO 14001 internal audit shows how an internal audit can feed the evaluation, and our guide to management review in ISO 14001:2026 shows where the results should be reported.

What do auditors look for when they check compliance evaluation?

Auditors look for a complete list of obligations, evidence that each was evaluated and proof that gaps were acted on.

Expect questions such as “How do you know which requirements apply to you?” and “Show me the last evaluation for this permit.” An auditor will sample a few obligations and trace them from the list to the evaluation record and to any action taken. They will also talk to the people responsible, to see whether they know their obligations. Our guide to what auditors ask during an ISO 14001:2026 audit lists more of these questions, and our guide to operational control in ISO 14001:2026 shows the controls that keep you compliant day to day.

What should you do when the evaluation finds non-compliance?

Treat it as a nonconformity: correct it, find the cause, take action and tell management.

The evaluation exists to find gaps, so finding one is a sign it works. React to the problem first, so it stops. Then look for the cause and take corrective action, and check later that the action worked. Report significant gaps to management, for example through the management review. Keep records of what you found and did, because an auditor will want to see how the organization responded, not only that it found the issue.

What mistakes should you avoid?

The common mistakes are an out-of-date list, no dated results and checking only the law.

• An out-of-date list. New or changed requirements never reach the list.
• No dated results. The list exists, but nobody can show when each item was last checked.
• Only the law. Customer requirements and voluntary commitments are missing.
• One person holds it all. Nobody else knows the obligations or the status.
• No follow-up. Gaps are found but not acted on or reported.

For the wider picture on documents, see our guide on documented information in ISO 14001:2026.

Frequently asked questions

Where 3FOLD Training fits

3FOLD Training is a CQI IRCA Approved Training Partner (ATP 6039853), licensed by the Knowledge and Human Development Authority (KHDA) in Dubai, with offices in Dubai and Chennai. Our ISO 14001 Lead Auditor course is delivered online as 40 hours of Virtual Instructor Led Training (VILT), and you can check the next available batch on the course page. We prepare you for the exam; CQI and IRCA examine and certify. You can also browse our CQI IRCA certified training courses.