ISO 14001 Stage 2 Audit: What to Expect and How to Prepare

A Stage 2 site tour compares the environmental aspects register against what is actually happening on the floor. Source: UniCert

The ISO 14001 Stage 2 audit is the visit where your certification body decides whether to recommend you for certification. Auditors come to your site, watch how work is actually done, interview people at every level, and sample records to confirm that your environmental management system (EMS) is fully implemented, operational and effective [2]. Stage 1 confirmed that the system was designed and that you were ready. Stage 2 confirms that the system is lived. The two stages are the halves of a single initial certification audit defined in ISO/IEC 17021-1 [2]. This guide covers the gap between the stages, a session timeline, the clauses auditors focus on, and a nine-step preparation checklist. For the full route to certification, see ISO 14001 certification in the UK. If you are building an EMS as one part of a wider integrated management system certification, the same visit can cover several standards at once.

Stage 1 vs Stage 2: what each covers and the gap between

Stage 1 is a readiness and documentation review. Stage 2 is the implementation and effectiveness audit. ISO/IEC 17021-1 defines them as the two parts of a single initial certification audit, and they ask different questions [2].

At Stage 1, the auditor checks that your EMS is designed, that the core documented information exists (environmental policy, scope, aspects register, compliance obligations, objectives, internal audit and management review arrangements), and that you are ready for Stage 2. Stage 1 also flags areas of concern that could turn into nonconformities later. A structured gap analysis before Stage 1 keeps the number of concerns carried into the gap between stages small.

At Stage 2, the auditor verifies that the EMS is fully implemented, operational and effective, and evaluates conformity with all requirements of ISO 14001 [2]. They are no longer reading your manual. They are testing whether what the manual describes is happening on the floor, in the yard, and in the way your team talks about environmental risk.

Between the two stages you get a defined window to act on what Stage 1 found. Use it. Anything left unresolved from Stage 1 tends to return at Stage 2 as a larger problem, because unclosed corrective actions are reopened as major nonconformities.

What happens during Stage 2: a session timeline

Most Stage 2 audits for an SME run over one to three days on site and follow the same sequence every time. Knowing the order helps you plan who needs to be available and when.

The initial certification audit runs in two stages with a defined gap between them. Source: UniCert

• Opening meeting. Short. The lead auditor confirms scope, the audit plan, timings, site safety rules and confidentiality, and introduces the team.
• Site tour. The auditor walks your operation and observes activities directly: housekeeping, waste storage and segregation, chemical stores, bunding and spill kits, drainage, emission points, and any permitted processes.
• Interviews at all levels. Top management is asked about context, the environmental policy and objectives. Managers are asked how operational controls are run. Operators and contractors are asked what they do, what could go wrong environmentally, and what they would do about it.
• Record sampling. The auditor selects records rather than reading everything: monitoring and measurement data, calibration certificates, training records, permits and consents, waste transfer notes, internal audit reports, corrective actions, and management review minutes.
• Daily feedback. At the end of each day the auditor gives an informal summary, so nothing raised at the closing meeting is a surprise.
• Closing meeting. The auditor presents the findings, grades any nonconformities as minor or major, states the recommendation, and explains what happens next.

The method is the one set out in ISO 19011: the auditor gathers evidence by observation, interview and examination of documented information, then judges whether the EMS works as a functioning management system rather than a documentation exercise [4]. For more on how auditors plan and run the visit, see the ISO 19011 auditing guidelines.

What auditors check in an environmental management system

Stage 2 works through the standard clause by clause. In the ISO 14001 audits I lead, a handful of areas take most of the time, and preparing these well tends to carry the rest.

Environmental aspects and impacts, and how significance was determined

ISO 14001:2015 requires you to determine the environmental aspects of your activities, products and services across a lifecycle perspective, covering normal and abnormal conditions and reasonably foreseeable emergency situations, and to determine which aspects are significant using set criteria (Clause 6.1.2) [1]. The auditor checks that the aspects register is complete, that the significance method has been applied consistently, and that the register matches what they saw on the tour. On an industrial site the aspects that draw the most scrutiny are usually process emissions, effluent and trade discharge, waste storage and segregation, noise, and stored fuels and chemicals; typical environmental aspects vary by process and sector.

Compliance obligations and evaluation of compliance

Clause 6.1.3 requires you to determine and have access to the compliance obligations related to your environmental aspects, and to keep documented information on them [1]. Clause 9.1.2 requires you to evaluate compliance at planned intervals, take action where needed, and retain the results as evidence [1]. The auditor wants a current legal register covering every applicable permit, consent and regulation, plus records showing that you actively evaluated compliance and acted where an obligation was not being met.

Operational controls

Clause 8.1 requires you to establish, implement, control and maintain the processes needed to meet EMS requirements, including operating criteria for your significant aspects and control of outsourced processes [1]. For each significant aspect there should be a control, and it should be followed in practice: waste segregation, chemical storage and handling, discharge and emission controls, contractor management, and environmental criteria built into procurement.

Emergency preparedness and response

Clause 8.2 requires you to identify potential emergency situations, plan the response, test the planned actions where practicable, and review and revise the process after tests or actual incidents [1]. You should be able to show the identified scenarios, the response procedures, the test records, and the changes that followed. The auditor may ask an operator to talk through a spill response on the spot.

Monitoring and measurement of significant aspects

You should monitor what matters, keep measuring equipment calibrated, and analyse the data rather than just file it. Trends and exceedances should feed back into action.

Objectives and improvement

Environmental objectives should be measurable, resourced, tracked, and clearly linked to your significant aspects and compliance obligations. The auditor looks for evidence of progress, not just a target on a page.

Awareness among staff and contractors

People are expected to describe the environmental aspects relevant to their own role and know what to do in an emergency. Generic awareness training does not hold up here, because auditors interview people at random and ask about their specific job.

A nine-step ISO 14001 audit preparation checklist

Work through these in the weeks before Stage 2. In my experience the most common causes of Stage 2 findings are uncontrolled or outdated documents, missing records, staff who cannot describe the aspects relevant to their role, and unresolved corrective actions carried over from Stage 1. This checklist targets each of them. The same preparation logic applies across management system standards; see also how to prepare for an ISO 9001 audit.

1. Close every open corrective action from Stage 1 and any previous audit, with objective evidence. Unresolved actions are reopened as major nonconformities.
2. Reconcile the aspects register against a physical walk of the whole site. Add anything missing, and re-check significance ratings against current activity levels.
3. Bring the legal register up to date and complete a documented evaluation of compliance, including the results and any follow-up.
4. Check document control. Remove superseded procedures from circulation and confirm the current versions are available where the work actually happens.
5. Assemble records for the period since Stage 1: monitoring data, calibration certificates, waste transfer notes, permits, training records, and contractor inductions.
6. Run at least one full internal audit cycle covering the entire EMS, and hold a management review. Close what they raise before the certification body arrives.
7. Test an emergency scenario and keep the record: who took part, when, what was learned, and what changed as a result.
8. Brief staff and contractors on the environmental aspects of their own roles, not the wording of the policy. Have them practise describing waste routes, spill response and emergency steps in their own words.
9. Prepare the logistics: an audit room, a safety induction, PPE for the auditor, and named people booked to be available for each interview.

How findings work: minor, major and clearing them

The auditor grades each nonconformity as minor or major, and majors block the certificate until they are cleared with evidence.

A minor nonconformity is a single lapse or an isolated gap that does not undermine the EMS as a whole. You submit a corrective action plan with root cause and correction, and it is normally verified at your next surveillance visit.

A major nonconformity is a whole requirement missing, a breakdown of a system element, or a cluster of related minors that together show a process is not working. You must correct it and provide evidence that the auditor verifies, sometimes through a short return visit, before certification can be recommended.

Opportunities for improvement and observations are not nonconformities. No action is required, though they are usually worth considering.

On successful completion of Stage 2, with any major nonconformities cleared and evidenced, the certification body issues the ISO 14001 certificate.

After Stage 2: certificate validity and surveillance

The ISO 14001 certificate is valid for three years. You keep it through annual surveillance audits, with a full recertification audit before the three-year cycle ends [2].

Surveillance audits sample part of the EMS each year rather than the whole system, but they always look at internal audit, management review, corrective actions, evaluation of compliance, and progress against objectives. For a closer look at that annual cycle, see what happens at surveillance audits.

Recertification reassesses the entire system and reviews the improvement trend across the whole three-year period, so the work you do between audits is what carries the certificate forward.

Combined ISO 14001 and ISO 45001 audits

Because ISO 14001 uses the ISO Harmonised Structure, it shares clauses with ISO 9001 and ISO 45001 and can be audited in a single integrated visit [5].

The shared clauses cover context, leadership, planning, support, operation, performance evaluation and improvement. In an integrated audit the auditor tests the shared Harmonised Structure once against both standards, then examines the topic-specific parts separately: environmental aspects and impacts for ISO 14001, and hazard identification and occupational health and safety risk for ISO 45001.

Audit duration is sized under IAF MD 5 from your headcount and the complexity of your operations [3], and integrated audits are governed by IAF MD 11 [5]. A combined visit is usually shorter than two separate audits and puts less strain on your team, which is worth planning for early if both standards are in scope.

Practical summary of the key steps covered in this guide. Source: UniCert

Frequently asked questions

How long does an ISO 14001 Stage 2 audit take?

For most SMEs it is one to three days on site. The certification body calculates the audit time under IAF MD 5, based on your headcount and the complexity of your operations, so a low-risk office will differ from a manufacturing site that holds environmental permits [3].

What is the difference between Stage 1 and Stage 2?

Stage 1 is a readiness and documentation review that confirms the EMS is designed and that you are ready to proceed. Stage 2 verifies that the EMS is fully implemented, operational and effective, and evaluates conformity with every requirement of ISO 14001 [2].

Can we fail the Stage 2 audit?

You are not usually told "pass" or "fail" on the day. If the auditor raises a major nonconformity, the certification decision is paused until you correct it and provide evidence that the auditor verifies. The most common causes are unresolved actions from Stage 1, missing records, uncontrolled or outdated documents, and staff who cannot describe the environmental aspects of their role. For more detail, see whether you can fail an ISO audit.

When do we get the certificate?

After Stage 2 is completed successfully and any major nonconformities are cleared with evidence, the certification body issues the ISO 14001 certificate. It is valid for three years, subject to annual surveillance.

Can Stage 2 cover ISO 14001 and ISO 45001 together?

Yes. The two standards share the Harmonised Structure, so an integrated audit tests the common clauses once and the standard-specific parts separately. Integrated audits are governed by IAF MD 11 [5].

What Stage 2 really tests

Stage 2 tests whether your EMS operates, not whether the paperwork exists. A documented but not lived system is the classic Stage 2 failure. The teams that pass treat the gap after Stage 1 as working time, walk their own site with the aspects register in hand, and make sure every person an auditor might interview can talk about their own environmental impact. If ISO 14001 is one part of a broader integrated management system certification, plan the combined audit early. Once the certificate is issued, the next thing to understand is how surveillance keeps it in place.

Editorial note. UniCert is accredited by the United Accreditation Foundation (UAF) for ISO 9001, ISO 14001 and ISO 45001, and is an IAF MLA signatory through that accreditation. Accreditation scope: /accreditation

References

1. ISO. ISO 14001:2015, Environmental management systems, Requirements with guidance for use. International Organization for Standardization. Clause references used above: 6.1.2 (environmental aspects), 6.1.3 (compliance obligations), 8.1 (operational planning and control), 8.2 (emergency preparedness and response), 9.1.2 (evaluation of compliance). https://www.iso.org/standard/60857.html
2. ISO/IEC. ISO/IEC 17021-1:2015, Conformity assessment, Requirements for bodies providing audit and certification of management systems, Part 1: Requirements. See 9.3 for the purpose and conduct of the initial certification audit (Stage 1 and Stage 2) and the certification cycle. https://www.iso.org/standard/61651.html
3. International Accreditation Forum. IAF MD 5:2019, Determination of Audit Time of Quality, Environmental, and Occupational Health and Safety Management Systems. https://iaf.nu
4. ISO. ISO 19011:2018, Guidelines for auditing management systems. See Clause 6 (conducting an audit) and Annex A on collecting and verifying evidence. https://www.iso.org/standard/70017.html
5. International Accreditation Forum. IAF MD 11:2013, Application of ISO/IEC 17021 for Audits of Integrated Management Systems. https://iaf.nu
6. Advisera 14001Academy. "ISO 14001:2015 certification audit: nine steps to prepare." (secondary)
7. ISOQAR. "ISO 14001 Audit Process." (secondary)
8. Smithers. "What to Expect from Your First ISO 14001 Audit." (secondary)
9. IAS. "The ISO 14001 Audit Process." (secondary)

Standards pages (iso.org) and IAF mandatory documents (iaf.nu) retrieved 28 August 2026. ISO 14001 clause numbers refer to the 2015 edition. Secondary sources are consultancy and certification-body explainers, cited only where they add practical context and not relied on for clause-level requirements.