Outsourcing your ISO internal audits: when it makes sense

This page explains what the rules and common practice call for. Every site is different, and what a survey or a filing needs at your facility is something we work out with you after we see it.

ISO 14001 (environmental management) and ISO 45001 (occupational health and safety management) both require internal audits of your own management system.

Start with the constraint that takes one option off the table. Your certification body (also called a registrar) cannot perform your internal audits and then certify you on the usual schedule.

Certification bodies operate under their own standard (ISO/IEC 17021-1), which treats internal audits that a certification body provides to a client as a significant threat to that body's impartiality. The remedy it accepts is that the certification body shall not certify that management system for a minimum of 2 years after the internal audits end.

That is a time bar, not a permanent ban, and it is not the strictest rule in that part of the standard. A separate clause bars the certification body from offering management system consulting at all, with no waiting period. That prohibition also covers any part of the same legal entity and anything under the certification body's organizational control.

So the convenient option, hiring your certification body to perform the internal audit because it already knows the system, does not fail outright. It costs you at least 2 years in which that certification body cannot certify you, and for most plants that comes to the same answer.

→ Can your certification body also build your system?

What the standards require for internal audits

Both standards require internal audits at planned intervals. The audits must determine whether the management system conforms to your own requirements and to the standard, and whether it is effectively implemented and maintained.

Three requirements do the work:

That last row is new. ISO 14001:2015 was withdrawn on April 15, 2026, and the 2026 edition adds an explicit requirement that each internal audit have defined objectives. If your program has run for years with "annual audit of the environmental management system" as its stated purpose, it now needs objectives written for each audit.

One thing the internal audit clause does not say. Neither ISO 14001 nor ISO 45001 contains a rule that auditors may not audit their own work. That sentence appeared in ISO 9001:2008, an earlier edition of the quality management standard, and was dropped in the 2015 revision of ISO 9001. It was not carried into the common structure these standards share. What the clause requires is that you "select auditors and conduct audits to ensure objectivity and the impartiality of the audit process."

ISO/TS 9002, the ISO guidance document for ISO 9001, addresses small organizations directly. In some cases, especially in smaller organizations, a person may need to audit their own work. Objectivity is then protected by other means, such as having the results reviewed by someone who did not perform the audit.

So a plant with one EHS (environmental, health and safety) person can meet the internal audit requirement in-house. It has to do so with objectivity safeguards that are designed, documented and followed, and it cannot rest on a claim of independence that the org chart does not support.

→ ISO 14001 clause by clause · Transitioning to ISO 14001:2026

Where a one-person program actually runs into trouble

There are three problems, and none of them is a prohibition.

Objectivity is hard to build in with one person. Picture a plant with one EHS manager and no assistant. That one person does all of the following:

• Wrote the environmental aspects register
• Maintains the compliance obligations register (the list of laws and rules the plant must follow)
• Owns the corrective actions
• Prepares the inputs for the management review

That person is allowed to audit those clauses, but the audit will not find much. The gap you did not think of when you built the register is the gap you will not think of when you audit it. Safeguards help, but they do not fully replace a second pair of eyes.

Time. A full audit program covers every clause and every process across a certification cycle. Each audit takes several days of preparation, on-site work, reporting and follow-up, on top of the job that built the system in the first place. When the calendar gets tight, the follow-up audits are what get dropped.

Knowledge of the technical clauses. To judge whether a compliance obligations register is complete, the auditor has to know what should be on it. Which permit conditions carry recordkeeping? Is hazardous waste generator status being tracked? Does one of the federal standards for hazardous air pollutants apply (a NESHAP subpart)? That is a different skill from knowing the standard.

Here are the usual in-house arrangements, and where each one stands.

Train a production supervisor as an internal auditor. This is legitimate, and it works well for the clauses on competence and training, operational control and emergency preparedness. It works less well for the planning clauses, because a supervisor generally lacks the regulatory background to judge whether a compliance obligations register is complete.

Cross-audit between sites. This is a genuinely good option when you have two or more similar sites, but watch for two things: scheduling conflicts and shared blind spots. Sites built from the same corporate template tend to have the same gaps.

The EHS manager audits their own clauses, with safeguards. The standards permit this, and it is worth doing properly rather than apologetically. Write the safeguards into the audit program:

• Someone other than the auditor reviews the findings and signs off on them.
• Evidence is sampled from records, not from memory.
• The objectivity arrangement itself is documented, so that an auditor who asks how it works can see that you meet the requirement.

Have the consultant who built the system audit it. This has the same structural problem as the certification body, from the other direction: the person who wrote the procedure is testing their own document. If we built your system, we say so and we do not audit it.

What an outsourced internal audit program looks like

It is not a single visit. It is a program, planned across the certification cycle, that covers every clause and every process, with the audit frequency for each one depending on its status and importance.

Here is a workable plan for a single-site plant, using ISO 14001:2026 numbering.

Two notes on the numbering. First, ISO 45001:2018 still uses the 2015-era structure, so a combined program for both standards will carry two sets of clause numbers until ISO 45001 Edition 2 is published. Second, clause 10 was merged and renumbered in ISO 14001:2026, while ISO 45001:2018 has a dedicated subclause for corrective action, shown in the table. Which subclause holds it in the 2026 edition of ISO 14001 should be confirmed against the purchased standard, not assumed from 2015-era guidance.

The deliverables from each audit:

• An audit plan with defined objectives, audit criteria and scope
• A record of the interviews conducted and the samples checked
• Findings classified as major, minor or observation
• A report built to go straight into the management review as an input

The follow-up audit is the one that gets skipped, and the one that shows. A corrective action that is closed on paper and never verified is a nonconformity waiting for your certification body to find it. It is faster and cheaper to find it first.

When you may not need this

We would rather say this than sell three audits nobody needed.

If you have a real second person. Two competent EHS staff who can audit each other's clauses meet the requirement at zero outside cost. Use them.

If your system is half built and you have not yet reached Stage 1, the first stage of the certification audit. An internal audit of an unfinished system produces findings you already know about. Finish building, run one cycle, then audit.

If your company genuinely has several qualified sites. Cross-site auditing is often better than an outside firm, because your own auditors already know how the operation works while an outside auditor spends a day learning it.

If what you really want is training. If the goal is to build your own auditing capability so you never need this again, buy the training, not the audit service. That is a different purchase, and we will tell you so.

If a one-person program with documented safeguards is genuinely adequate for the scope of your system. A small, simple site with a stable permit and a short compliance obligations register can run a defensible in-house audit program. Ask what the audit is likely to find before you buy it.

What we do and do not hold

We do not hold an ISO lead auditor credential. We are not going to imply otherwise.

For internal audits, that matters less than it sounds. Under the standard for certification bodies (ISO/IEC 17021-1), auditor credentials are an obligation of your certification body, the organization that issues the certificate. For internal auditors, both standards require objectivity, impartiality and competence, and they do not name a certificate program. Competence is something your own management system defines and demonstrates.

What we bring is the technical layer beneath the management system. We check three things:

• Whether your compliance obligations register is complete. We compare it against your air permit, your hazardous waste generator status (RCRA) and your stormwater obligations. We also compare it against your oil spill prevention requirements (SPCC) and the annual Toxics Release Inventory report (EPCRA section 313).
• Whether the air monitoring that supports your hazard and risk assessment under ISO 45001 exists and is current.
• Whether your noise program stands up against OSHA's noise standard.

That is the part where an internal audit finds something you did not already know.

→ US compliance obligations register · Form R reporting · Air monitoring surveys

You may want a certified lead auditor to perform your internal audits. That is a reasonable requirement, and there are firms that staff it. If deep knowledge of the underlying regulations matters more to you than the credential, that is the trade we offer.

→ ISO 14001 consulting · ISO 45001 consulting