ISO 14001:2026 · Clause 9.2 Internal audit
ISO 14001:2026 changed the internal audit clause in two places, and the second one is the harder fix.
This procedure is built to both changes, with the audit program written as a controlled document from the outset. Editable Word format, filled-in worked example, bracketed placeholders wherever the value is yours to set.
The first change is well known. Clause 9.2.2 a) now requires each audit to define its objective(s) alongside the criteria and scope. The 2015 edition required criteria and scope only. Adding an objectives field to the audit plan closes it.
The second gets less attention. The 2015 edition required the organization to retain documented information as evidence of the implementation of the program and the audit results — two items, both retrospective. The 2026 edition requires three things to be available, and the first is the audit program itself.
In most organizations the program is a spreadsheet on the program manager's desktop: uncontrolled, unversioned, and not in the document system at all. Making it available as documented information means bringing it under control, and that takes longer than adding a field.
Worth knowing: Audit objectives are a change to ISO 14001 rather than a new idea in the standards generally. ISO 7101:2023 has required them since 2023. If you hold both, this is established practice on the healthcare side.
| Requirement | Where it comes from | How the template handles it |
|---|---|---|
| Per-audit objectives | Clause 9.2.2 a), new in 2026 | A mandatory field on the audit plan, with worked examples showing why an objective that restates the scope is not an objective. |
| The audit program as available documented information | Clause 9.2.2, new in 2026 | The program is built as a controlled document with revision, owner, and approval. A three-row table maps each newly-required item to where it lives. |
| A before-and-after table | MSI house standard | The 2015 and 2026 clause text side by side, so what changed is visible rather than asserted. |
| No corrective action duty in Clause 9.2 | Deliberate absence | Unlike ISO 9001, ISO 45001, and ISO 7101, ISO 14001 Clause 9.2 carries no action requirement. The procedure says so and routes the duty to Clause 10.2. |
| The compliance evaluation boundary | Clause 9.1.2 | Treating the internal audit as the compliance evaluation is a recurring finding. The two produce two determinations and two records, and the template keeps them apart. |
31 pages, editable Microsoft Word format.
Clause 9.2.2 requires the audit program to consider the environmental importance of the processes concerned. That is the requirement that makes risk-based prioritization mandatory. The template turns it into a mechanism, with aspect significance as the primary lens.
| What varies | Higher risk | Lower risk |
|---|---|---|
| Frequency | Every cycle, re-audited early where findings recur | Longer interval, with the basis recorded |
| Depth | Walked end to end, including handoffs | Key controls sampled |
| Sample size | Large enough to support a conclusion about the system | Sufficient to confirm the control operates |
| Method | On-site, including the shift where supervision is thinnest | Records reviewed remotely |
| Auditor | Most experienced available; second auditor where contested | Any qualified auditor on the register |
Why this matters: Most programs answer the importance-of-processes requirement by adjusting frequency alone. A low-risk and a high-risk process both audited annually, same checklist, same two-hour slot, have not been differentiated in any way that changes what the audit finds.
Environmental managers and management representatives at ISO 14001 certified organizations, particularly those transitioning from the 2015 edition. Also useful to integrated-system managers who need the environmental clause handled correctly rather than folded into a quality procedure.
$149
Single-standard variant. ISO 14001:2026 Clause 9.2, in full.
One-time payment. Immediate download. Editable Microsoft Word format.
Yes. Clause 9.2.2 a) now requires the audit objective(s) to be defined for each audit, alongside the criteria and scope that the 2015 edition already required. The 2026 edition also changed what documented information must be available, and the audit program itself is now on that list.
Because ISO 14001:2026 contains no requirement to determine the sequence and interaction of processes. MSI does not supply a map where the standard does not call for one. The ISO 9001, ISO 13485, ISO 7101, Device, HSE, and IMS variants each carry one.
Both, and that is deliberate. It is written as a filled-in worked example so you can see what each element looks like when done properly, with bracketed placeholders wherever a value is genuinely yours to set — thresholds, roles, systems, retention periods, audit frequency. You are editing a working document rather than filling in a hollow outline.
Editable Microsoft Word (.docx). Adapt it, rebrand it, adopt it into your document control system.
It is structured to the ISO 19011:2026 clause architecture, and it implements the change ISO names in its own foreword — expanded guidance on remote auditing methods, drawing on ISO/IEC TS 17012. Everything beyond that, including the platform-specific competence prerequisite and the evidence-reliability check, is MSI's house standard drawn from 200+ audits attended, and is labeled as such in the document. ISO 19011 is guidance rather than a requirements standard, so no organization is certified against it and no clause of it can be raised as a nonconformity.
A procedure does not pass an audit; an organization does. What this gives you is a procedure that addresses every requirement of the clause with a named owner and a named record, and that describes a process people can actually follow. Conformity is demonstrated by implementation and evidence — a perfect document over a program that ignores it is still a finding. Unfilled placeholders are unmet requirements, so fill them.
Outside this procedure, deliberately. This one owns the audit program, the audit, the report, finding classification, and the follow-up verification. Root cause analysis, the corrective action record, and effectiveness evaluation belong in your corrective action procedure. The handoff is defined at one named point so nothing falls between them.
Every cross-reference is held in a table at the back rather than baked into the body text, precisely so you can renumber to your own system without unpicking the procedure.
Yes. Call MSI at 760-434-9141 to schedule a planning session.
The free Internal Audit Maturity Check scores eight elements of your audit program in under five minutes and returns an element-by-element breakdown with a priority order. It is the same maturity ladder built into this template, so it will tell you which sections matter most to you before you spend anything.
Take the free Internal Audit Maturity Check
If your organization is already certified to ISO 14001:2015, MSI's transition course covers the changes across the whole standard, including both changes to Clause 9.2: ISO 14001:2026 Transition
Management Systems International, LLC is a veteran-owned, female-owned ISO consulting firm co-founded in 1998. MSI has 28 years of experience, has supported 80+ certifications, attended 200+ audits, and trained 600+ professionals across manufacturing, technology, medical device, government, healthcare, and other regulated industries.
This template encodes the patterns that recur across that work — not one organization’s approach generalized, but the structural weaknesses that show up again and again.
To discuss your audit program directly, call MSI at 760-434-9141 or 888-914-9141.
© 2026 Management Systems International, LLC · All rights reserved.
