ISO 14001, clause by clause: what each one asks of you

This page explains what the rules and common practice call for. Every site is different, and what a survey or a filing needs at your facility is something we work out with you after we see it.

This guide walks through the main clauses of ISO 14001, the international standard for environmental management systems.

Before anything else: ISO 14001:2015 was withdrawn on April 15, 2026. The current edition is ISO 14001:2026, Edition 4.

That matters more than it sounds, because the clause numbers moved. Guidance written for the 2015 edition now describes a withdrawn standard, and most of it carries no date. The first table below gives you a quick test.

One honest note up front. ISO standards are copyrighted, and the full 2026 list of clauses is not freely published. This page reflects the published summary of changes and the transition guidance from certification bodies (also called registrars), not a line-by-line reading of a purchased copy. If you are making a certification decision, buy the standard.

→ What changed in ISO 14001:2026

What moved

The first row is the trap, and it is also your quick test. A guide that assigns that number to "Planning action" is describing the 2015 edition.

The same applies to your own documented procedures. A cross-reference to that number for planning action now points to a clause about risks and opportunities. Nothing fails visibly, but the reference quietly stops meaning what it said.

The clause 10 change is the same trap, in a place people cite constantly. If a procedure cites "clause 10.2" for corrective action, check it against a purchased copy of the 2026 edition and do not assume it still fits.

Clause number for each topic

The rest of this page refers to each clause by its topic. This table matches each topic to its clause number.

Context of the organization and interested parties

The first of these two clauses asks for your context, meaning the external and internal issues that are relevant to your purpose and affect your ability to achieve the results you intend. The second asks who your interested parties are and what they need and expect. It also asks which of those needs you adopt as compliance obligations, the legal and other requirements your organization has to meet.

The 2026 edition changed clause 4, and the change is easy to miss. Certification body transition guidance reports two things. First, the life cycle perspective now applies when you determine the scope of your management system, not only when you identify aspects. Second, emergency situations are framed as all potential emergency situations, not only reasonably foreseeable ones. Both widen your scope. Otherwise, the description here is the content carried forward from 2015.

Auditors really do follow the link from interested parties to your compliance obligations register. An expectation you adopt becomes a compliance obligation and belongs in that register, whether it is a customer's supplier standard, a corporate commitment or a community agreement. Build your interested-parties list as three columns: party, expectation, and adopted yes or no. If the third column is empty in every row, the list is not doing any work.

Environmental aspects and impacts

Your whole management system runs on this clause. You identify the environmental aspects of your activities, products and services, meaning the ways they interact with the environment, where you can control or influence them. The standard calls the effects of those aspects impacts. You do this with a life cycle perspective in mind.

A life cycle perspective is not a full life cycle assessment (a formal study often shortened to LCA). The standard does not require you to buy or perform one. It requires you to consider the life cycle stages.

Be careful how far you read the 2026 change on upstream and downstream impacts. Certification body transition guidance agrees that the weight on the supply chain went up, but it does not agree on how. Some sources describe a new note to this clause that stresses the life cycle perspective. At least one places a new life-cycle requirement in the clause 4 text on determining scope.

A note is guidance, not a requirement. Confirm the wording against a purchased copy before you rebuild your aspects register around it. In the meantime, a register that considers upstream and downstream impacts holds up under either reading.

→ How to build your aspects and impacts register

Compliance obligations

A caution about the number. The table gives the 2015 number for this clause. Clause 6 was renumbered in 2026, and free sources confirm the new locations of risks and opportunities, planning action and planning of changes. They do not say where this clause landed. The requirement itself is unchanged in substance, but check the number against the standard before you cite it in a procedure.

You must determine the compliance obligations related to your environmental aspects and have access to them. You must also determine how they apply and take them into account.

For a US plant, this register is:

• An air permit (Title V or synthetic minor)
• Hazardous waste generator status and manifests under the Resource Conservation and Recovery Act (RCRA)
• A Spill Prevention, Control and Countermeasure (SPCC) plan for oil
• An industrial stormwater permit, the Multi-Sector General Permit (MSGP)
• Chemical reporting under the Emergency Planning and Community Right-to-Know Act (EPCRA sections 311, 312 and 313)
• Whatever ADEQ, the Arizona Department of Environmental Quality, or your county air district adds

Guidance written for UK or Australian law will not produce a register that works here, and "environmental legislation, as applicable" is not a register entry.

→ How to build a US compliance obligations register · Toxics Release Inventory reporting (Form R)

Risks and opportunities, planning action and planning of changes

In the 2026 edition, these are three separate clauses. One covers risks and opportunities. The next covers planning action, where you plan how to address your significant aspects, your compliance obligations and your risks and opportunities, and you integrate that action into your processes.

The new planning of changes clause is the one to watch during the transition. Most systems manage change informally, and few document it as a planned activity with an owner. Expect a finding there in your first cycle under the new edition.

Environmental objectives

Objectives must be consistent with your environmental policy, measurable where practicable, monitored, communicated and updated. The planning half is the part that gets skipped. It covers what will be done, with what resources, by whom, by when, and how results will be evaluated.

"Reduce waste" is not an objective. "Reduce hazardous waste shipped off-site by 15% against the 2025 manifest total by December 2027" is one, because you can verify it against records you already create.

Operational control and emergency preparedness

The operational planning and control clause requires you to establish, implement, control and maintain the processes needed to meet requirements, including steps to make sure outsourced processes are controlled or influenced. The 2026 edition extends this to externally provided processes, products and services. That pulls contractors and suppliers further inside your management system than many plants have them today.

The emergency preparedness and response clause asks you to prepare to respond, to respond, and to act to prevent or mitigate the consequences. You also test your response regularly where practicable and review it, above all after an incident or a test.

Testing is the requirement people under-document. For audit purposes, a drill that took place but was never documented did not happen.

Evaluation of compliance

Evaluation of compliance is separate from the internal audit, although the two are often confused. You must determine how often to evaluate, carry out the evaluation, and take action if needed. You must also keep your knowledge and understanding of your compliance status current, and retain documented evidence.

An internal audit that samples one permit condition is not an evaluation of compliance. The output here should be a statement, obligation by obligation, of whether you comply. It should be defensible, and it should trace back to your compliance obligations register.

Internal audit

You must conduct internal audits at planned intervals, and you must select auditors and conduct audits in a way that keeps the audit process objective and impartial. The 2026 edition adds that each internal audit must have defined audit objectives.

Note what the clause does not say: it has no rule against auditors auditing their own work. That sentence belonged to ISO 9001:2008, an edition of the quality management standard, and was dropped in 2015.

ISO/TS 9002, the ISO guidance for ISO 9001, states the opposite case plainly. In smaller organizations, it can be necessary for a person to audit their own work, with objectivity then protected by other means, such as an independent review of the results.

So a one-person environmental, health and safety (EHS) department can meet this clause. The difficulty is not permission but how much the audit finds, because the gap you missed when you built the register is the gap you will miss when you audit it. Write the objectivity safeguards into the audit program, and have someone other than the auditor review the findings.

→ Independent internal audits for ISO 14001 and 45001

Management review

Top management must review the management system at planned intervals. The standard specifies what the review must cover:

• The status of earlier actions
• Changes in issues and in compliance obligations
• The extent to which objectives were met
• Performance information, including nonconformities
• Monitoring and audit results
• Compliance status
• Resources
• Communications from interested parties
• Opportunities for improvement

The usual failure is a meeting that skips the uncomfortable items. Compliance status and communications from interested parties are the two most often missing, and they are also the two an auditor checks first.

What we do and don't hold

We are not an ISO lead auditor firm, and we do not hold that credential. Auditor competence is a responsibility of your certification body under ISO/IEC 17021-1, the international standard that governs certification bodies. Your certification body is a different organization doing a different job.

What we bring is the layer underneath, such as the annual Toxics Release Inventory report (Form R). The standard requires you to identify compliance obligations like that one and to evaluate whether you meet them.

→ ISO 14001 consulting · ISO 45001 clause guide