ISO 14001 and ISO 45001 internal audit checklist

Has the organisation identified the internal and external issues that affect its environmental and OH&S management system, and are they reviewed when circumstances change?

Evidence: Context analysis (for example SWOT or PESTLE) with a review date; minutes showing it was revisited

Are the relevant interested parties and their needs identified, including workers, and is it clear which of those needs have become compliance obligations?

Evidence: Interested parties register linked to the legal register

Is the scope documented, covering every site, activity and function within the boundary, and does it match the scope on the certificate?

Evidence: Scope statement; certificate; site list

Are the processes of the system and how they interact defined, and do they run as described rather than only on paper?

Evidence: Process map or manual; sample of records from each process

Can top management show how they take accountability for the system, provide resources and integrate it into business decisions?

Evidence: Interview with top management; budget and resourcing decisions; business plans that reference the system

Does top management actively promote a culture where workers report incidents, hazards and risks without fear of reprisal?

Evidence: Reporting statistics; staff interviews; communications from leadership

Does the policy contain the required commitments (pollution prevention or safe and healthy working conditions, compliance, continual improvement, and for OH&S, consultation of workers) and is it communicated and available?

Evidence: Signed policy; notice boards; intranet; induction material

Are responsibilities and authorities for the system assigned and communicated, including who reports system performance to top management?

Evidence: Organisation chart; job descriptions; appointment letters

Is there a working process for consulting non-managerial workers and involving them in hazard identification, incident investigation and setting controls, with barriers to participation removed?

Evidence: Safety committee minutes; worker representatives; suggestion and response records; interviews with workers

Are the risks and opportunities to the system identified, with actions planned, and are planned changes assessed before they happen?

Evidence: Risks and opportunities register; action plan

Are environmental aspects and impacts identified for normal, abnormal and emergency conditions, with a life cycle perspective, and are significant aspects decided using defined criteria?

Evidence: Aspects and impacts register; significance criteria; review date

Is hazard identification ongoing and proactive, covering routine and non-routine work, contractors and visitors, human factors, and psychosocial factors such as workload, hours and harassment?

Evidence: Hazard identification and risk assessment register; psychosocial risk assessment; recent updates

Are OH&S risks assessed with a defined method, and are assessments reviewed after incidents and changes?

Evidence: Risk assessment methodology; sample assessments; revision history

Is there a current register of legal and other requirements for every jurisdiction in scope, with how each applies to the organisation?

Evidence: Legal register with last update date; source references

Are actions planned for significant aspects, hazards, legal requirements and risks, and is their effectiveness evaluated?

Evidence: Action plans with owners and dates; effectiveness reviews

Are objectives set at relevant functions, measurable where practicable, monitored and supported by plans saying what, who, when, resources and how results are evaluated?

Evidence: Objectives and targets register; KPI tracking; progress reports

Are the resources the system needs (people, budget, equipment, time) determined and provided?

Evidence: Budget; staffing; management review decisions on resources

Is the competence required for roles that affect environmental and OH&S performance defined, and is there evidence that people meet it, including training effectiveness?

Evidence: Competence matrix; training records; certificates; effectiveness evaluation

Are workers aware of the policy, the significant aspects and hazards of their own work, their contribution, the consequences of not conforming, and (for OH&S) their right to remove themselves from imminent danger?

Evidence: Induction records; toolbox talks; worker interviews

Is it defined what is communicated internally and externally, when, to whom and how, and are communications from interested parties answered and recorded?

Evidence: Communication plan; external correspondence log; complaints log

Are documents and records identified, approved, version controlled, available where needed, protected and retained for defined periods, including documents of external origin?

Evidence: Document master list; sample of controlled documents; retention schedule

Are operating criteria and controls in place for significant aspects and OH&S risks, and are they followed in practice on site?

Evidence: Procedures and work instructions; site observation; permits; inspection records

Are waste streams segregated, stored, transported and disposed of through licensed contractors, with records kept?

Evidence: Waste manifests; contractor licences; storage area inspection

Are environmental requirements considered in design, procurement and communication to external providers, consistent with a life cycle perspective?

Evidence: Procurement criteria; supplier communications; design review records

Are controls chosen in the order of the hierarchy (eliminate, substitute, engineering, administrative, PPE), and is PPE the last resort rather than the first?

Evidence: Risk assessments showing control selection; PPE register

Are planned changes (new sites, layouts, equipment, processes, staffing, legal changes) assessed for environmental and OH&S impact before they are made, and are unintended changes reviewed?

Evidence: Management of change register; sample change assessments

Does the procurement process make sure purchased products and services meet OH&S requirements?

Evidence: Procurement procedure; purchase specifications; supplier evaluation

Are contractors selected using OH&S criteria, inducted, and controlled on site so their work and yours do not harm each other or others?

Evidence: Contractor prequalification; contracts with HSE clauses; contractor inductions; permits

Are outsourced processes (for example facilities management, cleaning, security, waste) controlled, with the type and extent of control defined?

Evidence: Service contracts; KPIs; supplier audits or reviews

Are emergency situations identified, response plans in place including first aid, people trained, and the response tested by drills and revised afterwards?

Evidence: Emergency response plan; drill reports; fire warden and first aider lists; spill kits

Are fire extinguishers, alarms, emergency lighting, first aid kits and spill kits inspected and in date, and are escape routes clear and signed?

Evidence: Inspection tags and registers; site walk

Is it defined what is monitored and measured, how, when and against what criteria, and is measuring equipment calibrated or verified?

Evidence: Monitoring plan; KPI results; calibration records

Is compliance with every legal and other requirement evaluated at a defined frequency, with results recorded and gaps acted on?

Evidence: Compliance evaluation report; actions for gaps

Is there an internal audit programme covering the whole scope, with impartial auditors, defined criteria and scope for each audit, and results reported to management (and for OH&S, to workers)?

Evidence: Audit programme; audit plans and reports; auditor competence records

Has top management reviewed the system at planned intervals, covering every required input, and recorded decisions and actions as outputs?

Evidence: Management review minutes with each input addressed; action log

Did the review consider trends in worker consultation and participation, and were the relevant outputs communicated to workers?

Evidence: Minutes; communication to workers after the review

Are incidents and nonconformities reported, investigated to root cause with worker participation where relevant, corrected, and checked for effectiveness?

Evidence: Incident log; investigation reports; corrective action register with closure evidence

Is there evidence that environmental and OH&S performance is improving over time, not only that the system is maintained?

Evidence: Trend data; improvement projects; year-on-year KPIs