ISO 14001 Consulting

A management system is the set of documented policies, procedures and routines a company follows. ISO 14001 is the international standard for an environmental management system, and ISO 45001 is the international standard for an occupational health and safety management system.

Both standards ask for the same kinds of things. You set objectives, keep a register of the legal and other requirements that apply to you, check your own system through internal audits, have top management review its performance, and correct what falls short. Most plants already have more of a system in place than they realize, although much of it is not yet documented.

ISO 14001 is not required by law. It is a contractual requirement, written in by a customer, mandated by a parent company or passed down a supply chain. If a single customer's contract is the reason, find out exactly what that customer is asking for before you build anything, because now and then it is less than full certification.

ISO 45001 usually starts the same way, with a customer requirement or a parent company. Sometimes it starts with a general manager who decides the safety program should no longer live in one person's head.

ISO 14001 covers environmental management, and ISO 45001 covers occupational health and safety. Their ten-clause structures are nearly identical, so a large part of the system only has to be built once. You can run one integrated management system and hold two certificates, which is cheaper than certifying each standard on its own.

An integrated system shares one internal audit program, one management review and one document control system. Some elements stay separate. Identifying environmental aspects and identifying safety hazards are different exercises, and the ISO 45001 clause on consultation and participation of workers has no counterpart in ISO 14001. More on running both as one integrated system.

For a first-time implementation at one site, 6 to 12 months is realistic, and it can go faster if you already have a management system running. A gap assessment in the first few weeks turns the project into a dated plan with names on it. Anyone who quotes you a timeline before seeing the plant is guessing.

One part cannot be rushed: the system has to operate long enough to generate the records an auditor will ask for. For ISO 45001, records of worker consultation and participation have to accumulate over time. The schedule also depends far more on your people's availability than on ours. See the timeline, phase by phase.

There are three separate costs: the fees you pay to the certification body (also called a registrar) that audits you and issues the certificate, the cost of any consulting support, and your own team's time. The third is usually the largest, and the easiest to leave out of a budget.

Having more than one site is the single biggest cost driver. Three other factors raise the cost: a complex operation, starting from nothing, and having no staff time to spare. Programs you already run bring it down, and so does a gap assessment before any other work begins. The certification body's audit fees recur on a 3-year cycle, so budget for the whole cycle. More on what drives cost.

Internal staff time is usually the largest cost of the project, and it rarely shows up in a quote. Your team writes procedures, conducts the first internal audits, takes part in the management review, gathers records and answers questions during audits. Most of that load lands on one person, such as your EHS (environmental, health and safety) lead. For a first-time implementation, it is measured in hundreds of hours, not dozens.

If no one has the capacity for that, the project stalls no matter who you hire, and that is the most common reason ISO projects run long. Every hour your team covers is an hour you do not have to buy.

No. SECA does not issue certificates, and no one who builds your system can. The certificate comes from an accredited certification body (also called a registrar), an outside company that audits your system. The rules those bodies operate under prohibit them from certifying a system they consulted on.

So you hire two companies, by design: we prepare you, and they audit and certify. We stay with you through both audit stages and through corrective action on anything the auditor finds. If one provider offers both services in a single package, ask which accredited body signs the certificate and how the impartiality requirement is being met. Why one company cannot do both.

We start at your facility, not in your binder. The first step is a gap assessment, in which we compare your current practice with the standard, clause by clause, to show what is missing. We then build the missing elements, written to match how your plant actually runs and not how a template says a plant runs.

The work includes an internal audit program and a management review. We then prepare you for both stages of the certification audit, stay on site while it takes place, and help you close any nonconformities the auditor raises. See the steps for ISO 14001 and ISO 45001.

The certification audit has two stages. Stage 1 is a readiness review, in which the auditor reviews your documented system and confirms that your internal audits and management review are being planned and carried out. It typically takes 1 day, and findings are normal.

Stage 2 usually follows 2 to 8 weeks later and typically takes 1 to 3 days, or more depending on size and scope. It tests whether the system works in practice, so the auditor examines records, observes the floor and interviews people who are not managers. The certification decision is made by someone outside the audit team, which is why your auditor cannot tell you on the last afternoon that you passed. More on both stages.

The certificate runs on a 3-year cycle. Your certification body returns for a surveillance audit at least once each calendar year, except in recertification years, and the first one must take place no more than 12 months after the date of the certification decision. In year 3 you go through a recertification audit, which is planned to finish before your certificate expires, and then the cycle repeats.

If you let a certificate lapse, you may be starting over, not renewing. Budget for the full 3-year cycle, not only the first invoice.

SECA is a small Arizona firm, and you deal directly with the person who does the work. Ron Fleming has been walking plant floors since 1993. ISO 14001 and ISO 45001 programs are among the areas he works in, and he plans each project himself. His son Marcus has joined the business and is learning it on site with him.

We do not hold an ISO lead auditor credential, and we will not imply that we do. Consulting does not require one. We are based in Arizona and work on site across the United States.

ISO 14001:2026 replaced the 2015 edition on April 15, 2026. The overall structure is familiar, so the transition is not a rebuild. Climate change and biodiversity receive more emphasis. Upstream and downstream impacts do as well, although guidance differs on whether that is a requirement or a note. A new clause covers the planning of changes, operational controls now extend to externally provided processes, products and services, and each internal audit must have stated objectives.

Clause 6 was renumbered. This summary is drawn from guidance published by certification bodies, not from a line-by-line reading of the standard, so check a purchased copy before you rebuild anything or cite a clause number. More on what changed.

Your certificate remains valid through the transition period, which is about 3 years and ends in 2029. Sources point to April 14, 2029, but treat the exact date as unsettled. Your real deadline is probably sooner, because you will transition at one of your regular audits, once your certification body (also called a registrar) is ready to audit to the 2026 edition.

The first step is therefore a 15-minute call to ask your certification body which audit that will be. For a management system in fair shape, the transition is generally a manageable piece of work and not a rebuild. See what the transition involves.

The register should list the requirements that actually apply to you, each one named. ISO 14001 calls these compliance obligations. For a US plant, that can mean your hazardous waste generator status and waste determinations, stormwater and oil spill prevention plans, and federal reports under the Emergency Planning and Community Right-to-Know Act (EPCRA), such as Form R. Add your state and county programs as well.

A register that says “applicable environmental regulations” and stops there will pass a document review, but it will fail in the second stage of the certification audit, when the auditor asks which of your operations triggers which requirement. A register built once and filed away goes stale as volumes, permits and rules change. How to build a compliance obligations register.

Environmental aspects are the points where your operations interact with the environment, and impacts are the effects that result. Your aspects register lists each one, and it should be built from your process steps, not your org chart. A row that says “Maintenance uses chemicals” is too vague to rate, whereas a row that names the tank, what leaves it and where it goes can be rated.

Evaluate each aspect under three conditions: normal operation, abnormal conditions such as startup or maintenance, and emergencies such as a spill or fire. Much of the information comes from documents you already have, such as permits and waste records. Review the register when the plant changes. How to build an aspects register.

Often you can, in part. If you have an EHS (environmental, health and safety) person with time available, a good deal of the management system already exists and simply has not been documented yet. What you may need is a gap assessment and a model to follow, not a long project with us in your conference room.

What most plants cannot spare is the weeks of writing. We would rather scope the job honestly, and be there when you really need us.

Yes. You are not starting from zero, and no one should quote you as if you were. AS9100 is built on ISO 9001:2015, and its structure is close enough to carry over. You already have document control, an internal audit program, a management review process and a working corrective action process.

What remains is the environmental content: the environmental aspects and impacts register, the compliance obligations register, and operational controls for your significant aspects. That costs much less than building a management system from scratch. Tell your certification body you hold AS9100 before they plan the audit. More on combining standards.