INTRODUCTION TO EMS AUDITING CONCEPTS AND ISO 14000
Edwin Pinero
Office of the Federal Environmental Executive
Overview
The Environmental Management System (EMS) audit is based on the generic concept of auditing. Simply put, an audit, any audit, is the comparison of actual conditions to expected conditions, and a determination as to whether one is in conformance or not in conformance. This is the same philosophy used to perform financial, quality, regulatory compliance, and systems audits. It is prudent to first review what the common elements are in order to better understand why audits are different.
There are several definitions of audit components that are common to any type of audit. ISO 14010 defines these terms for EMS audits, but they apply in other cases also. As a matter of fact, the ISO committee decided not to create auditing standards for other types of audits, such as compliance audits, although it was originally considered. The main reason for deleting the work items was because the concepts and processes defined in 14011, originally intended for EMS audits, were generic enough to be applied “as is” to other types of audits.
An audit is fundamentally a comparison of audit evidence to audit criteria to determine findings. The evidence is the objective information collected through interviews, visual reconnaissance, and documentation review. The audit criteria are the expectations or “rules” of how conditions should be. It is the criteria that distinguish one audit from the next. For example, in compliance auditing, the criteria are the regulations. With an EMS audit, the criteria would be the description of the expected system elements. In this case, the EMS criteria would be that described in ISO 14001, the specification standard.
When evidence is compared to criteria, one can determine whether the audited entity does or does not conform. This determination is a finding, and a finding can either be one of conformance, or non-conformance. Therefore, an audit will always produce findings, even if what is being audited is in full conformance with criteria.
Other key definitions to be aware of with auditing are: objectives, scope, auditee, client, and auditor. The audit objective(s) is simply why you are conducting an audit; usually the reason is to demonstrate conformance to stated criteria. The audit scope is what entity is being audited, and can be a company, a site, or unit within a site or company.
In the ISO 14000 realm, there is a clear distinction between the auditee and client. The auditee is the entity being audited. The client is the party commissioning the audit. For example, a client can be the customer, and the auditee a supplier to that customer. In ISO 14000, this distinction is important because the client sets the scope, objectives, and plan for an audit, not the auditee, although it is expected the auditee will be involved and cooperate.
The auditor is the one actually collecting evidence and determining findings. The auditor can be comprised of several individuals on a team. There are requirements in ISO 14001 that state that those performing functions within the EMS, such as the auditors, be qualified in their tasks. This means the auditors must have received training in EMS auditing. However, there may be audit team members who do not have the training, but are on the team because of some unique expertise, such as process, language, or regulatory knowledge.
The ISO 14000 Auditing Standards
The only standard in the ISO 14000 series that must be followed for third party verification (i.e. “getting certified”) is 14001. In that document, there is a requirement that the management system be periodically audited. Section 4.5.4 of ISO 14001 states that “the organization shall establish and maintain program(s) and procedures for periodic EMS audits to be carried out in order to:
(a) determine whether or not the EMS:
• Conforms to planned arrangements for environmental management including the requirements of this international standard; and
• has been properly implemented and maintained; and
(b) Provide information on the results of the audits to management.”
This requirement means that the organization shall:
- Have procedures governing audits and follow-up actions
- Operate a comprehensive system of audits
- Plan its audits
- Document its audits
- Demonstrate that EMS activities comply with planned arrangements
- Determine that the EMS has been properly implemented and maintained
- Schedule audits on the basis of the status and importance of the activity
- Record results
This however does not convey the full requirements of ISO 14001, as many other clauses of the standard also have an impact upon the EMS.
The ISO 14000 committee decided to prepare guidance standards for users describing techniques to help meet the audit requirement of ISO 14001. The resulting auditing standards