ISO 14001:2026 introduces several changes that directly affect what internal auditors need to look for. The new Clause 6.3 change management requirement is now auditable. Audit objectives must be explicitly documented in every audit plan. The Clause 4.1 context analysis must address five named environmental conditions. Supply chain controls under Clause 8.1 now explicitly extend to externally provided processes and suppliers.
ISO 14001:2026 doesn't change how internal audits are conducted — the methods, the planning process, the evidence-gathering techniques remain the same. What it changes is what auditors need to look for. Several new and revised requirements create new audit checkpoints that didn't exist under ISO 14001:2015, and auditors who apply their existing checklist without updating it will miss exactly the areas where transition auditors are most likely to find nonconformities. This article explains what changes for EMS internal auditors under ISO 14001:2026 — drawing on the audit experience of Maria Falbo, a Lead Auditor with decades of ISO 14001 experience.
The methodology of an ISO 14001 internal audit is unchanged under the 2026 standard. Auditors still plan audits against defined scope, criteria, and objectives. They still gather evidence through document and records review, physical observation, and staff interviews. They still classify findings as major nonconformities, minor nonconformities, and observations. They still report findings in writing and follow up to verify corrective actions are effective.
The Harmonized Structure of the standard is also unchanged — the same clause numbering, the same overall logic, the same Plan-Do-Check-Act framework. An auditor who understands ISO 14001:2015 will find the structure of ISO 14001:2026 immediately familiar. What they will need to update is their knowledge of the specific new and changed requirements, and their audit checklist and program to reflect them.
For a complete guide to how ISO 14001 internal audits are planned and conducted, see our ISO 14001 Internal Audit: The Complete Guide. For a step-by-step guide to planning and conducting an EMS internal audit, see our guide on how to conduct an ISO 14001 internal audit.
Clause 6.3 is the most significant addition in ISO 14001:2026 from an audit perspective. It is entirely new — there was no equivalent in ISO 14001:2015 — and it is the requirement most likely to generate findings in early transition audits.
Clause 6.3 requires organizations to determine when EMS-related changes are needed and to plan and manage those changes in a systematic way. The auditor's job is to verify two things: that a documented change management process exists, and that it is being used in practice.
First, does a documented process exist? The process should define what types of changes trigger an EMS review — new equipment, process modifications, changes in suppliers or contractors, organizational restructuring, changes in legal obligations. It should assign responsibility for initiating and completing the review. And it should specify what the review involves — how environmental implications are assessed before a change is implemented.
Second, is the process being followed? The audit should examine whether recent operational changes — new equipment installed, process lines modified, suppliers changed — were managed through the change management process. Evidence typically takes the form of change request records, environmental impact assessments for specific changes, or documented decisions. An organization that has a Clause 6.3 procedure but cannot produce evidence that it was applied to a recent significant change has a nonconformity.
The most common Clause 6.3 finding in early ISO 14001:2026 transition audits follows a predictable pattern: the organization has drafted a change management procedure in response to the new requirement, but there is no evidence of implementation. A procedure that exists on paper but cannot be demonstrated in practice is exactly what Clause 6.3 is designed to prevent. When auditing this clause, the question isn't "does the procedure exist?" — it's "show me a recent change that went through it."
The context analysis requirement in Clause 4.1 has been strengthened in ISO 14001:2026. Under the 2015 standard, organizations were required to identify external and internal issues relevant to their environmental purpose. The 2024 climate change amendment made climate a mandatory consideration. ISO 14001:2026 now explicitly names five environmental conditions that must be considered: climate change, biodiversity, pollution levels, resource availability, and ecosystem health.
The auditor verifies that all five conditions have been considered in the context analysis — and that the determination for each is available. Critically, finding that a condition is not relevant to the organization's context is acceptable — but the determination must be visible. An organization that has not considered biodiversity at all — not even to conclude it is not relevant — has a nonconformity under the 2026 standard.
In practice, many organizations transitioning from ISO 14001:2015 will have addressed climate change under the 2024 amendment but not the remaining four conditions. The audit should check whether the context register has been updated to address all five, and whether the assessments are credible.
Clause 8.1 operational controls have been extended under ISO 14001:2026 to explicitly cover externally provided processes, products, and services. Under ISO 14001:2015, the supply chain dimension of operational control was present but less explicitly stated. The 2026 standard makes it directly auditable.
The auditor examines whether the organization has established environmental requirements in its procurement processes — criteria that suppliers and contractors must meet where their activities have significant environmental implications. Evidence might include supplier assessment criteria, contract clauses specifying environmental requirements, supplier questionnaires, or monitoring records for suppliers with significant environmental aspects.
The audit should also examine whether contractor activities on site are covered by the organization's EMS controls — whether contractors are made aware of the significant environmental aspects of the areas they work in, and whether they are required to comply with the organization's operational controls. An organization that has robust internal controls but nothing in its supply chain management that reflects environmental requirements is failing Clause 8.1 under the 2026 standard. For a full guide to what a well-structured ISO 14001 internal audit checklist covers across all clauses, see our ISO 14001 internal audit checklist guide.
ISO 14001:2026 separates emergency situations from abnormal operations in Clause 8.2 — previously they were addressed together. Emergency situations must now be planned for explicitly and independently.
The auditor verifies that the organization has identified potential emergency situations related to significant environmental aspects — not just those that are reasonably foreseeable as the 2015 standard required, but all potential scenarios. Under the 2026 standard, climate-related emergency scenarios are within scope: flooding, extreme weather events, disruptions to utilities or supply chains caused by climate events.
The audit should check whether emergency response procedures are current, whether they reflect the 2026 standard's broader scope of scenarios, and whether drills or exercises have been conducted within the required timeframe. An organization whose emergency response plan still reflects only the scenarios identified under the 2015 standard — without considering climate-related events — has a gap under the 2026 edition.
Our ISO 14001:2026 Internal Auditor course covers every new and updated requirement — built specifically for auditors transitioning from the 2015 standard.
Clause 9.2.2 introduces a new explicit requirement in ISO 14001:2026: internal audit programs must document the objectives for each individual audit — not just the scope and criteria. This is a change from ISO 14001:2015, where audit objectives were implied rather than stated.
In practice, this means audit plans must include a documented objectives statement. Audit objectives for an ISO 14001 internal audit might include: verifying that significant environmental aspects are being controlled as documented; confirming compliance obligations are being actively evaluated; checking that the Clause 6.3 change management process was applied to recent operational changes; or assessing whether environmental objectives are on track.
This is a straightforward update to the audit plan template — but it is auditable. A certification auditor reviewing the internal audit program will look for documented objectives in each audit plan. Their absence is a finding.
Adding documented audit objectives to your audit plan template is a ten-minute task — but it signals something important about how seriously the organization takes its internal audit program. An audit objective statement forces the auditor to articulate what they are trying to determine before they start. It improves planning, focuses evidence gathering, and makes the audit report more useful. The 2026 standard has made it mandatory — but organizations that were already doing this well under ISO 14001:2015 will recognize it as good practice regardless of the requirement.
An ISO 14001:2015 internal audit checklist applied unchanged to a 2026 audit will miss the new requirements. Updating the checklist is a necessary step before the first internal audit conducted against the 2026 standard.
The minimum updates required are: adding Clause 6.3 change management as a new checklist section; expanding the Clause 4.1 section to include all five named environmental conditions; updating the Clause 8.1 section to include supply chain and externally provided processes; separating emergency situations from abnormal conditions in the Clause 8.2 section; and adding an audit objectives field to the audit plan template.
Organizations transitioning from ISO 14001:2015 should also use the updated checklist to conduct a pre-transition internal audit — confirming that the EMS meets the 2026 requirements before the certification body's transition audit. For a full breakdown of what changed in ISO 14001:2026 and why, see our article on ISO 14001:2026 changes and transition.
Internal auditors who were trained and competent under ISO 14001:2015 do not need to start over — the audit methodology is unchanged. What they do need is updated knowledge of the new and changed requirements: Clause 6.3, the expanded Clause 4.1 conditions, the extended Clause 8.1 supply chain scope, and the documented audit objectives requirement. Our Understanding ISO 14001:2026 course covers all the key changes to the standard and is a practical starting point for auditors updating their knowledge.
Organizations transitioning from ISO 14001:2015 should conduct at least one internal audit against the 2026 requirements before their transition audit with the certification body. The internal audit serves as the organization's final opportunity to identify and close nonconformities before the external auditor does. For organizations implementing ISO 14001 for the first time, the internal audit program should be operational — with at least one completed audit cycle — before the Stage 2 certification audit.
A 2015 checklist can be used as a starting point, but it must be updated before the first 2026 audit. At minimum, it needs to add Clause 6.3 change management, expand the Clause 4.1 environmental conditions coverage to all five named conditions, update Clause 8.1 to include supply chain controls, and separate emergency situations from abnormal operations in Clause 8.2.
Transition auditors will focus their attention on the new and changed requirements — particularly Clause 6.3 (evidence of a documented change management process being applied in practice), Clause 4.1 (documented consideration of all five environmental conditions), Clause 8.1 (supply chain and procurement environmental controls), and Clause 9.2.2 (documented audit objectives in internal audit plans). These are the highest-risk areas for nonconformities in transition audits.
No — the internal audit program must still cover all clauses of ISO 14001 across the audit cycle. What ISO 14001:2026 changes is the content within several clauses — particularly Clauses 4.1, 6.3, 8.1, and 8.2 — and the requirement to document audit objectives in the audit program. The clause coverage obligation remains the same.
Maria Falbo has over 25 years of experience working as a Lead Auditor for certification bodies worldwide. She founded Logix ISO with the mission of making expert-level ISO training accessible to organizations of all sizes. Her work spans Quality, Environmental, Occupational Health and Safety, Food Safety, Automotive, and Energy management systems.
Learn more about Maria →Self-paced · 365-day access · Training certificate included