ISO 14001:2026 transition: timeline, changes vs 2015, deadline

01What actually changed (ISO-confirmed)

• 4.1/4.2 Context: broader environmental conditions — Broader environmental conditions, written into the mandatory text: climate change, biodiversity or ecosystem health, pollution levels and the availability of natural resources now sit in a compulsory paragraph of 4.1 — climate change is no longer an example inside a note but a must-answer item needing a call per dimension; the note under 4.2 adds that interested parties may raise needs around pollution, natural resources, climate change and biodiversity, and a non-legal need becomes a compliance obligation once the organization decides to adopt it. Records to keep: the context analysis updated dimension by dimension, each with a signed relevant/not-relevant call; the interested-party list re-issued wherever new needs appear. How auditors check: they open the 4.1 analysis and verify every dimension has a conclusion traceable to 6.1 risks and opportunities — a blank cell or a stock phrase draws a finding.
• 6.3 (new): change management — A formally new change-management clause (official title “Planning of changes”): once the organization determines a need for changes that affect or can affect the EMS, the changes shall be carried out in a planned manner and managed; the need can come from internal or external sources (see A.6.3), which lists eight change sources a)-h) — new or modified products, services, processes, equipment and facilities; changes in compliance obligations; changes in knowledge and information; technological developments; changes in material or input specifications; asset changes from mergers, joint ventures or divestments; changes in personnel or external providers (incl. contractors); and business interruptions (supply-chain issues, labour disputes, natural disasters, regime change or war). On the ground: build an environmental change-trigger list so every new project, product, regulation, supplier or facility modification passes an environmental review, with the consequences of unintended changes reviewed. Records to keep: the full chain of review, approval, implementation and verification per change. How auditors check: they sample one real change and walk the chain end to end — back-filled records (same-date signatures, jumping version numbers) are easy to spot.
• Annex A: three official clarifications — ISO 14001:2026 also carries an informative Annex A, and both ISO and the accreditation side confirm it clarifies three themes: the linkage between organizational context, risks and opportunities and other clauses; the life-cycle perspective (LCP); and alignment with strategy, business processes and the integrated management system approach — Global ACI’s transition document lists them separately as key-concept clarifications. On the ground: these three are the outline for awareness training and internal-auditor retraining; whatever Annex A says is the lens through which auditors will read your system. Records to keep: sign-in sheets and quiz papers for Annex A training across staff and auditors, plus a translation page mapping A.4/A.6/A.8 points into your organization’s own vocabulary. How auditors check: they ask questions in Annex A’s wording — A.4.1 on how environmental conditions interrelate, A.6.3 on change sources, A.8.2 on the a)-j) emergency checklist — and your documents and training materials must answer in the same language.
• Emergency preparedness: identification in the text, graded response, wider training — Three line-by-line changes in the standard text: ① 6.1.2 now states “the organization shall determine potential emergency situations (see 8.2)” — identification is a hard, explicitly linked requirement; ② 8.2 c) requires actions commensurate with the scale of the emergency and its potential environmental impact — grade scenarios and match response capacity; ③ 8.2 f) extends information and training to interested parties, including persons working under its control — contractors are no longer out of scope. On the ground: document the scenario list as a 6.1.2 output, configure proportionate responses per grade, and include contractors in training sign-ins; BSI paraphrases the identification basis from “reasonably foreseeable” to “all potential”, so the safe move is to include low-probability/high-impact scenarios in your list. Records to keep: the 6.1.2 scenario list, the graded response-configuration table and contractor-inclusive training sign-ins. How auditors check: they walk your plan against Annex A.8.2’s official a)-j) list and ask how each scenario traces to the 6.1.2 evaluation records.
• 6.1 restructured: planning action split into 6.1.5 — In 2015, risks/opportunities and planned actions shared 6.1.4; 2026 splits them into 6.1.4 “Risks and opportunities” and 6.1.5 “Planning action”, and 6.1.1 requires establishing, implementing and maintaining the processes needed to meet 6.1.2-6.1.5, available as documented information to the extent necessary. On the ground: merge the aspects evaluation and the risk/opportunity register into one structured sheet, and make sure the 6.1 processes themselves are documented — “we did it” is not “we have a process”. Records to keep: a definition document for the 6.1 processes (purpose, inputs and outputs, responsibilities, documented extent) and the unified aspects/risks register. How auditors check: they simply ask “where are the 6.1.2-6.1.5 processes defined?” and compare the definition with actual practice — having one without the other draws a finding either way.
• “Outsourced” → “externally provided” — Wording shifts to “control of externally provided processes, products or services”, with control or influence limited to processes relevant to the EMS’s intended outcomes and accountability extending beyond organizational boundaries. On the ground: re-review your supplier list — every externally provided process whose environmental performance you influence (transport, waste disposal, chemical suppliers, contractors included) comes under control and evaluation, and name contractors explicitly when communicating environmental requirements to external providers. Records to keep: the updated supplier list, environmental evaluation and monitoring records per external process, and communication evidence showing environmental requirements sent to providers. How auditors check: they sample evaluation and monitoring records for transport / waste / chemical suppliers and ask which external processes you judged “relevant to the intended outcomes” — and on what criteria.
• fulfil → meet: tighter compliance wording — The verb for compliance obligations tightens from “fulfilment” to “meeting”, and behind the wording sits a stricter evaluation basis: obligations mapped to the legal text verbatim, every call evidenced. It pairs with 9.1.2 evaluation of compliance: establish the evaluation process, set the frequency, act when needed after each evaluation, and maintain knowledge and understanding of compliance status. On the ground: re-issue the compliance register — every obligation carrying its legal-text source, evaluations graded “met / not met” with the evidence for the call. Records to keep: the re-issued register, the latest compliance-evaluation round, and records of compliance-status updates. How auditors check: they pick two or three obligations and ask you to justify the “met” grading on the spot — no justification means the evaluation process is failing.
• Leadership: stronger accountability — Top-management commitment is itemized a)-i): accountability for the EMS’s effectiveness; ensuring the policy and objectives are established and compatible with strategy and the environment; integrating EMS requirements into business processes; providing resources; communicating the importance; ensuring intended outcomes are achieved; directing and supporting relevant roles; promoting continual improvement; and supporting other relevant roles to contribute their leadership — with A.5.1 grounding it in culture: promoting a culture that engages persons working for the organization, or on its behalf. Within 5.2, the protection-of-environment pledge can be made specific: conservation of natural resources, sustainable resource use, climate-change mitigation and adaptation, biodiversity protection. On the ground: environmental objectives become a standing management-review item, with recognizable top-management decisions in the minutes. Records to keep: review minutes with decisions, policy briefing and sign-off records. How auditors check: they interview top management in person about how environmental objectives connect to strategy — a delegate speaking for them does not count.
• 9 Internal audit: documented programme & objectives — More rigorous: 9.2.2 requires an audit programme (frequency, methods, responsibilities, planning requirements and reporting) built considering the environmental importance of processes, changes affecting the organization and results of previous audits; the new hard line is 9.2.2 a) — each internal audit shall define the audit objective(s), audit criteria and scope for every single audit. On the ground: write the annual programme as a controlled document and add a mandatory “objective / criteria / scope” column to the plan. Records to keep: the controlled programme, the objective-criteria-scope statement per audit, and the post-audit effectiveness evaluation of the programme itself. How auditors check: they sample the latest internal audit — first whether an objective exists, then whether the report is structured around it, and finally how the programme’s own effectiveness was reviewed.
• Management review: three-part structure — A more structured review: 9.3 now splits into 9.3.1 general (continuing suitability, adequacy and effectiveness), 9.3.2 inputs and 9.3.3 results. Inputs are itemized: status of actions from previous reviews; changes in external and internal issues, in the needs and expectations of interested parties (incl. compliance obligations), in significant environmental aspects and in risks and opportunities; the extent to which environmental objectives are achieved; information on environmental performance incl. trends (nonconformities and corrective actions, monitoring and measurement results, fulfilment of compliance obligations, audit results); adequacy of resources; relevant communications from interested parties incl. complaints; and opportunities for continual improvement. Results must include any implications for strategic direction and opportunities to improve integration with other business processes. On the ground: re-cut the agenda to the new structure and match inputs and outputs item by item. Records to keep: agenda and minutes organized by sub-clause, plus a decision-tracking log. How auditors check: they read the minutes against the 9.3.2 input list — one missing line is one finding.
• Clause 10 renumbered: replace references site-wide — Old 10.1 (general) is deleted, continual improvement moves up from old 10.3 to 10.1 — determining opportunities for improvement (see clause 9 and 10.2) and implementing the actions needed to achieve the EMS’s intended outcomes and enhance environmental performance — and nonconformity/corrective action follows as 10.2, with corrective action commensurate with the significance of the effects, including environmental ones. On the ground: replace clause references across controlled documents — old 10.1 citations deleted, old 10.3 citations become 10.1 — and map improvement mechanisms onto 10.1/10.2 inputs. Records to keep: revision history and a completed-reference-replacement checklist. How auditors check: they open any procedure at random and read the clause references — old numbering still there means the revision only changed the cover page.
• Certification calendar (incl. accreditation milestones) — The official Global ACI-TECH-3-TR 2029-04-30 (M) timeline: published April 2026; accreditation bodies ready by 2026-10-31; certification bodies submit transition declarations by 2027-01-31; AB transition decisions due 2027-04-30 — only then may a CB issue 2026-edition certificates; from 2027-10-31 new initial certificates are 2026-only; 2029-04-30 is the cutoff, binding all ~700,000 accredited 14001 certificates — the earliest of the three systems. On the ground: the 14001 AB/CB milestones are the earliest too, so scheduling this transition audit into the nearest surveillance visit is the first domino of your whole integrated plan. Records to keep: written communication with your certification body confirming it has passed its AB transition decision, plus the transition-audit schedule and plan. How auditors check: at least one witnessed assessment of your CB must be an audit to the 2026 edition before the cutoff — your transition visit may well be that witnessed audit, so nobody will coast through it.

01Clause-by-clause reading

01Clause-by-clause diff (2015 → 2026)

01Gap checklist (tick off as you close)

• Expand the 4.1 analysis: add climate change, biodiversity or ecosystem health, pollution and resource availability one by one, each with a reasoned relevant/not-relevant call, linked to 6.1 risks and opportunities. Suggested owner: drafted by the EHS lead, issued by the management representative, with top management confirming the strategic linkage. Common slip: fields added without conclusions, or boiler-plate conclusions with no site-specific scenario. Done when: the analysis is updated, signed, every conclusion traces to an action, and each “relevant” call lands somewhere in the risk register or the emergency plan.
• Add controlled documents for 6.1.4 and 6.3: a structured risk-opportunity framework and a change-management process. Suggested owner: drafted by the system lead, co-signed by EHS, production and purchasing. Common slip: a template copied verbatim whose trigger list never maps to your own scenarios. Done when: documents are published, a change-trigger list exists (the A.6.3 a)-h) sources translated into your scenarios), at least one change in the last 6 months shows a full review-approval-implementation-verification trail, and the review of unintended-change consequences is filed.
• Rebuild the emergency plan: the scenario list as a documented 6.1.2 output covering low-probability/high-impact cases, response grades commensurate with scenario scale and potential environmental impact, contractor-inclusive training, plus a post-drill review loop. Suggested owner: EHS leading, with the emergency team and the contractor-owning function in support. Common slip: the plan rewritten while the scenario library stays untouched, so the two no longer match. Done when: the new plan is published, the Annex A.8.2 a)-j) self-check is signed off, at least one post-drill review is filed, and the revision write-back is traceable.
• Replace “outsourced” with “externally provided” site-wide and re-review the supplier list: every external process whose environmental performance you influence is controlled and evaluated. Suggested owner: purchasing leading, with EHS setting the relevance criteria and evaluation method. Common slip: the body text replaced while form templates keep the old word, or contractors left off the list. Done when: the list is updated, evaluation records are complete, and communications of environmental requirements to providers (incl. contractors) are on file.
• Upgrade the compliance register: map each obligation to the legal text verbatim (clause number + source), grade “met / not met” with evidence, and tie it to the 9.1.2 evaluation frequency. Suggested owner: the EHS compliance role maintains it, with legal reviewing regulatory changes. Common slip: the header changed but the grading logic did not, or the legal-update intake went dark with nobody subscribed. Done when: the register is re-issued, the latest evaluation round is fully evidenced, and compliance-status updates are on record.
• Strengthen top-management evidence: environmental objectives on the standing review agenda, recognizable decisions in minutes. Suggested owner: the management representative sets the agenda; top management attends and signs in person. Common slip: resolutions reading “agreed in principle” with nothing executable, or a delegate signing while top management is absent. Done when: the latest review includes environmental decisions signed by top management — a delegate’s signature or a vague resolution does not count.
• Document the audit programme and objectives (9): controlled annual programme, objective-criteria-scope per audit, programme effectiveness evaluated afterwards. Suggested owner: the lead auditor maintains the programme, approved by the system lead. Common slip: the programme is controlled but the objective column of the plan still runs empty. Done when: the programme is published and the latest audit carries its objective statement plus a programme-effectiveness review.
• Re-cut management review to the three-part structure; replace clause references per the renumbered clause 10 (old 10.1 citations deleted, old 10.3 continual-improvement citations become 10.1). Suggested owner: the system lead re-cuts the agenda; document control runs the replacement and keeps the completion list. Common slip: the manual re-referenced while procedures and forms keep the old numbering. Done when: review outputs match the structure, reference changes are re-issued under control, and old-version withdrawals are on record.

01Controlled-document revision list

01What the auditor will probe at the transition audit

• Question: does 4.1 genuinely cover climate and biodiversity, or only in vague terms? Why it is asked: climate change now sits in the mandatory 4.1 text, and the auditor separates “labelled” from “assessed”. A good answer: walk the dimensions with a conclusion and a reason each — for example “for our site climate means extreme rainfall overloading the chemical-store drainage; it is in the risk register and as a plan scenario”. Evidence to show: the 4.1 analysis form (itemized conclusions + signatures) and the trace from each conclusion into 6.1 risks and opportunities.
• Question: is 6.3 change management a real process, or back-filled? Why it is asked: a brand-new clause is the easiest to paper over, so the auditor validates it on a real change. A good answer: pick one change on the spot (new supplier / process / regulation) and narrate trigger → review → approval → implementation → verification, pointing out where the unintended-change consequence review happened. Evidence to show: the full-chain records of that change, the trigger list, and the last-6-months change log.
• Question: what scenarios does the emergency plan cover, and does it match the 6.1.2 evaluation records? Why it is asked: 6.1.2 and 8.2 are hard-linked, and a mismatch between the two is the most typical 2026 finding. A good answer: state that the scenario list is a documented 6.1.2 output covering low-probability/high-impact cases, that response grades are commensurate with scenario scale (8.2 c)), and that training includes contractors (8.2 f)). Evidence to show: the 6.1.2 evaluation records, the scenario library, the Annex A.8.2 a)-j) self-check page, contractor-inclusive training sign-ins, and the latest post-drill review.
• Question: are “externally provided” processes actually controlled, with evidence? Why it is asked: once the terminology changed, the auditor checks whether the control scope moved with it. A good answer: name which external processes were judged “relevant to the EMS’s intended outcomes” and on what criteria, and how evaluation and monitoring reach beyond the boundary. Evidence to show: the supplier list, evaluation and monitoring records for transport / waste / chemical providers, and records of communicating environmental requirements to providers (incl. contractors).
• Question: how do you judge obligations “met”? Why it is asked: the shift from fulfil to meet tightens the basis, and an unevidenced call means the evaluation process is failing. A good answer: show the verbatim mapping to legal text, the grading method and frequency, and the mechanism that keeps compliance-status knowledge current. Evidence to show: the re-issued register, the latest evaluation round, and the 9.1.2 process document.
• Question: does management review produce verifiable outcomes under the new three-part structure? Why it is asked: with 9.3 split into three sub-clauses, a missing input and an untraceable output are both findings. A good answer: walk the 9.3.2 input list line by line and show how decisions track to closure. Evidence to show: the agenda and minutes organized by sub-clause, the decision tracker, and the closure rate of the previous meeting’s decisions.
• Question: where does the life-cycle perspective show up in design and purchasing? Why it is asked: the LCP now extends into scope-setting (4.3) and operational control (8.1) — one sentence inside the aspects evaluation is not enough. A good answer: point to the four checkpoints — environmental requirements at each design stage, in purchasing, in communication to providers, and the disclosure of transport/use/end-of-life information. Evidence to show: design-review records, environmental items in supplier-selection criteria, and sample communication records.
• Question: where are the audit programme and objectives? Why it is asked: 9.2.2 a) demands an objective per audit — an audit without one is invalid. A good answer: produce the controlled programme and explain how the objective, criteria and scope of the latest audit were set, and how programme effectiveness is reviewed afterwards. Evidence to show: the controlled programme document, the objective statement and report of the latest audit, and the programme-effectiveness review record.

02Answer-card preparation (one page per probe)

• Write one answer card per probe: a one-line conclusion + evidence index (document/record numbers) + owner + data source.
• Bind evidence by clause number into a “transition evidence pack” — anything findable within 30 seconds.
• Write a half-page method for scenario identification: sources (regulations / incident databases / walkdowns / complaints) → list → assessment → plan mapping.
• For unfinished items, bring a remediation plan (milestones + owners) — EMS auditors tolerate “planned” far more than “unplanned”.
• Walk the environmental route in advance: chemical store, waste staging, emergency equipment — 2-3 staged points each.
• Carry the gap-analysis report — EMS auditors first judge how deeply you understood the 4.1 expansion.

01Milestone timeline

02Deliverables at each node

• 4.1-expansion gap-analysis report (itemized conclusions + sign-off + a dated action table) — before T-18; drafted by EHS, issued by the management representative.
• New controlled-document pack (6.1.4 / 6.3 / emergency / external-provider / compliance register / manual clause map) — re-issued before T-18 with the six-step revision workflow fully traced.
• Controlled audit programme + one full internal-audit report on the new structure (per-audit objectives and a programme-effectiveness review) — before T-9.
• Three-part management-review outputs (itemized decisions + tracker) + closed nonconformities — before T-3.
• Transition evidence pack (clause-indexed) + answer cards + the Annex A.8.2 self-check page — finalized before T-0.

03Official transition rules at a glance (Global ACI-TECH-3-TR 2029-04-30 (M))

• The official transition-audit scope: the changed requirements of the 2026 edition (vs the previous), changes to your context, and any other needed system changes — EMS audits already interrogate context hardest, so this matters most for you.
• Ride on a surveillance or recertification visit or run standalone; remote via ICT is officially allowed (IAF MD 4 / Global ACI TECH-3-003) if audit objectives are demonstrably met.
• Extra audit time is “possible”: justified per ISO/IEC 17021-1 and IAF MD 5 (TECH-3-004), considering the degree of system change and whether it rides the annual audit; a full system audit may need none.
• Decline and the certificate lapses on 2029-04-30, possibly before the full cycle — the CB may shorten validity; update the “certificate validity” line in your compliance register accordingly.
• If your certification body opts out: it must notify all affected clients in writing by 2027-01-31 — the earliest deadline brings the earliest such notices; treat one as the trigger to switch bodies.

01Scenario-identification method (five steps, each with records)

• Step 1 · Fixed sources: permits and regulations (incl. a trigger channel for new rules), incident and near-miss logs, site walkdowns (fixed frequency and route), community complaints and concerns, comparable industry events — five defined intakes, each with an entry point, an owner and a frequency, so scenarios never come from guesswork. Records to keep: the source register and every intake record — auditors ask “when did the scenario list last gain a line, and why”, and a blank answer means the intakes are not running.
• Step 2 · Scenario library: generate scenarios per source, explicitly including low-probability/high-impact ones (major chemical release, extreme-weather shutdown, neighbouring-plant knock-on) — BSI paraphrases the basis as “all potential”, so the safe move is full tail coverage; auditors check the documented 6.1.2 linkage and tail coverage, not slogans. Records to keep: the library with unique IDs and traceable source fields.
• Step 3 · Graded assessment: score each scenario by consequence × likelihood against documented criteria (the criteria themselves re-versioned with traces); the grade sets the plan depth — dedicated page / merged page / no plan but monitored. Records to keep: the criteria document plus a score per scenario. How auditors check: they pick a low-graded scenario and ask why it needs no plan — the answer must land on the documented criteria.
• Step 4 · Plan mapping: every assessed scenario maps to plan sections, response equipment and named responders — no orphan scenarios between list and plan; response configuration follows 8.2 c) and stays commensurate with the scenario grade. Records to keep: the mapping table (scenario ID ↔ plan section ↔ equipment point ↔ responder).
• Step 5 · Drill-and-review loop: run the annual drill plan, file the post-drill review (what worked / what failed / how the plan changes) and write revisions back into the scenario list and training materials; extend information and training per 8.2 f) to interested parties and contractors — the gap most often nonconformed. Records to keep: the drill record, the review record, the revision write-back, and contractor training sign-ins — four documents, one set.

02Scenario-list template (build your library on this)

03Annex A.8.2 official checklist (a)-j) to consider when building the emergency process, landed item by item)

• a) The most appropriate response method — select it by chemical properties and release form (absorb / contain / neutralize / cover), write it into the plan and mark it at the equipment point; never leave the choice to improvisation at the scene.
• b) Internal and external communication arrangements — internal: the duty chain and escalation path in writing; external: templates for regulators, the community and the media prepared in advance per 7.4.3 and your compliance obligations — nobody drafts wording on the day of the event.
• c) Specific actions to prevent or mitigate adverse environmental effects — name the actions (containment, interception, storm-drain sealing) with equipment locations and owners; mitigation must map to the environmental effect, not a generic “handle it”.
• d) Mitigating and responding actions for different types of emergencies — separate action pages for fire, release, explosion and extreme weather, with grading tied to the 8.2 c) proportionality.
• e) Post-incident or post-drill evaluation — a three-question template: what worked / what failed / how the plan changes; the results written back into the plan and the scenario list.
• f) Periodic testing of planned response actions where practicable — the annual drill plan covers every scenario type, and where testing is impracticable the reason is documented, never silently skipped.
• g) Training for emergency personnel — trainees include persons working under your control and contractors (8.2 f)), with sign-ins and quizzes kept; content tracks the current plan version.
• h) Lists of key personnel and assistance agencies — fire, spill-cleaning services, hospital toxicology contacts; verify them periodically (update on any number change) and keep the verification records.
• i) Evacuation routes and muster points — site signage consistent with the plan maps, including versions for night-time and power-loss conditions.
• j) Mutual-aid arrangements with neighbouring organizations — written agreements with one call-chain drill; informal neighbourly goodwill is not an arrangement.

04A full worked scenario (manufacturing: hazardous-chemical release in the warehouse)

• Trigger: a drum of solvent drips during a forklift transfer in the warehouse; the walkdown officer confirms the release volume and chemical properties per step one of the plan — scenario L-03 is already registered in the 6.1.2 list, sourced from a site walkdown six months earlier.
• Response grading: graded level 2 (in-house emergency team) per the documented criteria — level 1 stays on-scene, level 3 would trigger community notification and external services; the response force matches the release scale and its potential environmental impact (8.2 c)).
• Notification chain: scene → EHS duty officer → plant manager; the external call is assessed against 7.4.3 and any notification duty under your compliance obligations; mitigation actions such as storm-drain sealing run per the matching plan clause, all recorded.
• Recovery: released material collected and disposed as hazardous waste, contaminated soil sampled and tested, environmental-impact mitigation documented; the emergency state closes only after recovery is confirmed.
• Post-event review: though a real incident, it still completes the 8.2 e) review — what worked (sealing equipment on site in five minutes), what failed (an expired night-shift contact list), how the plan changes (quarterly contact-list verification) — with revisions written back into the scenario list and training materials, every record numbered and traceable.

01Evidence-prep checklist for transition-audit day

• 4.1-expansion gap-analysis report — must contain: itemized conclusions with reasons and signatures for climate / biodiversity / ecosystems / pollution / resources, each traced into 6.1. Common gaps: fields added but no conclusions, or conclusions never linked to the risk register. On audit day: lay the report beside the 4.1 analysis form so any named dimension lands on the right row within 30 seconds; have EHS own it with the system function maintaining versions and the trace page.
• Revision history of the new documents — must contain: revision pages for the 6.1.4 / 6.3 procedures, emergency plan and external-provider controls, issue and withdrawal logs, and the completed-reference-replacement checklist. Common gaps: new copies issued while old ones stay in circulation, or replacements unfinished. On audit day: show the history table plus an old-vs-new spread to prove the revision was systematic, not cosmetic; document control owns it, with each document owner supplying the revision notes.
• Scenario-identification method and list — must contain: intake records from the five sources → the scenario library (unique IDs + sources) → graded assessment → plan mapping, incl. low-probability/high-impact cases and the Annex A.8.2 a)-j) self-check page. Common gaps: the scenario list living only in the plan, unreadable from the 6.1.2 records — the two never match. On audit day: show the library beside the 6.1.2 records and walk one scenario through identify → assess → plan → drill; EHS keeps the library, the emergency team keeps drill and review records.
• Change-management case — must contain: at least one real environmental change with the full chain (trigger → review → approval → implementation → verification) plus the unintended-consequence review. Common gaps: the chain breaking at verification, or same-date back-signed papers. On audit day: narrate the timeline page by page, then show the log overview to prove it is not a one-off; the requesting department keeps the trail, EHS keeps the log.
• Compliance register and evaluation — must contain: obligation↔legal-text mapping verbatim (clause number + source + version date), evidence for each “met / not met” grading, and 9.1.2 evaluation frequency with status-knowledge updates. Common gaps: obligation names without legal sources, or gradings without evidence. On audit day: justify two or three gradings on the spot, and be ready to show the legal-update intake (subscription or log); the compliance role maintains it, with legal re-checking regulatory changes quarterly.
• External-provider control evidence — must contain: the relevance criteria for “relevant to the EMS’s intended outcomes”, the supplier list, evaluation and monitoring records for transport / waste / chemical providers, and records of communicating environmental requirements to providers (incl. contractors). Common gaps: control still stuck on the old “outsourced” list, contractors outside the communication scope. On audit day: present list + evaluation + communication as one set and pick one supplier to narrate what was evaluated and what changed; purchasing owns the list, EHS issues the evaluation conclusions.
• Audit programme and effectiveness — must contain: the controlled programme (frequency / methods / responsibilities / planning requirements / reporting), objective-criteria-scope statements per audit, and programme-effectiveness reviews. Common gaps: the programme living as an email calendar, or an empty objective column. On audit day: open the programme original and the latest audit report cover — point to the objective line first, then the report conclusion; the lead auditor maintains it, signed off by the system lead.
• Three-part management-review outputs — must contain: agenda and minutes organized by 9.3.1/9.3.2/9.3.3, inputs ticked off item by item (incl. changes in interested parties’ needs and expectations), and a decision tracker. Common gaps: missing inputs with no explanation, decisions without a tracking column. On audit day: show the ticked input list with decision numbers matching the tracker one to one, and quote the previous meeting’s closure rate on the spot; the management representative chairs it, with the system function sending the input call two weeks ahead.